PDF malware analysis — malicious · efe3531bec86c582

MALICIOUS

PDF

278.1 KB Created: 2010-04-21 10:30:05 +08:00 Authoring application: Foxit PDF Creator Version 3.0.1.0109

MD5: bbc530dd904a5d74e5dea90a55c92006 SHA-1: 77dd198c73ac3847dce78b9feb5aa6d5f18800e8 SHA-256: efe3531bec86c582d1b0502d7d216aff05b6245cb063fe306a5f2c3c097f8826

76 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The file is a PDF containing obfuscated JavaScript, as indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. ClamAV also flagged it as Heuristics.PDF.ObfuscatedNameObject. The embedded JavaScript stream is likely responsible for the malicious behavior, potentially downloading and executing a second-stage payload. The document body is heavily obfuscated and unreadable, providing no direct clues to the lure.

Heuristics 3

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0006_000.js` `6e7dc78872198583e63e5d4eccbbc4f6078727d5d8955d36a76c3deea7a9cc68`	pdf-javascript-stream	PDF /JS object 6 at offset 0x18B	6710 bytes
`icc_00_off00037080.icc` `2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e`	pdf-icc-profile	PDF ICC profile at offset 0x37080	3144 bytes
`font_00_sfnt_off000399df.bin` `f696a0e66459ff5f08221bd42c0a01f4475faa174f76710dad363296032fbf1f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x399DF	26204 bytes
`font_01_sfnt_off0003df40.bin` `0c54c182fe2f3a5d4254afb78e2287409868a67d9a5ac08e55bb82b210ba977f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3DF40	44996 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.