Malicious PDF — malware analysis report

Static analysis result for SHA-256 ebbe59bf43cb8a44…

MALICIOUS

PDF

12.4 KB
MD5: 70f407d74870b0b1227e2edb6414362a SHA-1: ae1f4bfea2b4d0fecbd974665341f2369233c82a SHA-256: ebbe59bf43cb8a442eabb90cdf88c07b94b4cb37a3b67034810cd9f93d682794
136 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: Malicious File

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings related to PDF JavaScript actions and streams. ClamAV detections further confirm its malicious nature, identifying it as Pdf.Exploit.Agent-36365 and Pdf.Exploit.Agent-36364. The embedded JavaScript is likely responsible for exploiting a vulnerability within the PDF reader to execute malicious code.

Heuristics 4

  • ClamAV: Pdf.Exploit.Agent-36365 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36365
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0076_000.js
7f2cbb6a4be32c7fe1284458aca6e6dd978ac59556612fb550ce15e45c1b72bf		 pdf-javascript-stream PDF /JS object 76 at offset 0x369 11620 bytes
Detection
ClamAV: Pdf.Exploit.Agent-36364
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.