Malicious PDF — malware analysis report

Static analysis result for SHA-256 f05ad94644cebe6a…

MALICIOUS

PDF

936.8 KB Created: qÂ'Ö§=íDFP«0.¡¯ m=²ì›?^t¯ù¤ö{tÕ¹¨»ó©— Authoring application: ¾"%-Ã{ƒ!›À0,Ô{'m0› øCöqå±ñ®?ë6‹§ L–vºzÝqFØ>ôÇ7Í:w[ð@oiՅ˜¸e (via ìÌ7‰ÿÒm'eõL¡ÚÈ"At{¡zò,ÝZé3æ›MžÝ—"ôÇ{DzaTb9èðZ Ji澨)
MD5: 6560629073cbbe93a57fa5a1515d6507 SHA-1: 35671150a4f1e4e41f3a4f2cffac4937a1f0b5aa SHA-256: f05ad94644cebe6a544d8e0035e746bcaefa88382c228331421571eda2ebe6a6
106 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF is encrypted and appears to be image-only, a common lure technique. Heuristics indicate a payment redirection lure, suggesting a business email compromise attempt. ClamAV detected the file as Pdf.Dropper.Agent-6308054-0, confirming its malicious nature. No scripts were extracted, limiting the ability to determine the exact payload delivery mechanism.

Heuristics 5

  • ClamAV: Pdf.Dropper.Agent-6308054-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-6308054-0
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Encrypted PDF (string and stream contents are opaque to static scan) info PDF_ENCRYPTED
    PDF declares /Encrypt — string objects and stream contents are encrypted with the standard security handler (RC4 or AES). On its own this is informational; legitimate encrypted documents include signed contracts, billing statements, and rights-managed material. Static heuristics cannot inspect encrypted payload bytes.
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: error. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.