Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee10e00d0e14e29f…

MALICIOUS

PDF

97.1 KB
MD5: 6e92c0f2c969911c12c1d5870900e633 SHA-1: 80c6ec332fe19ad1138c5b986790bb1424880f7a SHA-256: ee10e00d0e14e29ff2b21a6ea4e0d038bcd26d8c2d95bceb5e9d0d0c5dd879b7
88 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains an embedded script payload within an XFA form, as indicated by the 'PDF_XFA' and 'PDF_EMBEDDED_SCRIPT_PAYLOAD' heuristics. ClamAV detection 'Pdf.Exploit.Agent-6136306-0' confirms its malicious nature. The embedded script is likely responsible for executing the exploit, although its specific actions are not detailed in the provided evidence. The embedded URLs are not directly actionable for payload delivery.

Heuristics 4

  • ClamAV: Pdf.Exploit.Agent-6136306-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-6136306-0
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xfa-template/2.5/
    • http://www.xfa.org/schema/xfa-data/1.0/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_pdf_script_0000026c.bin
66d242135a265aa4893c97b378260f8f653e7528e258985dea3b128ca97fbf5f		 pdf-embedded-script PDF raw stream script payload at offset 0x26C 98659 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.