Malicious PDF — malware analysis report

Static analysis result for SHA-256 f0928f524c7fc9b4…

MALICIOUS

PDF

4.0 KB Created: 2010-04-14 12:42:52 +02:00 Authoring application: PDFCreator Version 0.9.5 (via GPL Ghostscript 8.61)
MD5: b14c439a7b0aaa335e2f49b3e929b0c8 SHA-1: 5d56c56eb86d3ab4906da38db420d5078c5101b4 SHA-256: f0928f524c7fc9b4a67e9fc23103e238f3b08a5bd3d757c36a9ac546d94e026b
112 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The critical ClamAV detection of 'Pdf.Exploit.Agent-22112' strongly indicates a PDF exploit. The presence of JavaScript actions, embedded JS streams, and the use of ASCIIHexDecode and ASCII85Decode filters further support this, as these are common techniques for obfuscating malicious code within PDF files. The file likely attempts to exploit a vulnerability to download and execute a second-stage payload.

Heuristics 7

  • ClamAV: Pdf.Exploit.Agent-22112 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-22112
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Additional-actions dictionary low PDF_AA
    PDF defines /AA (Additional Actions) that references an executable action (JS/JavaScript/Launch/SubmitForm) — can auto-trigger on document or widget events. Form-field calc/format/validate/keystroke handlers in legitimate interactive forms commonly fire this, so it is reported as a low-weight signal; weaponised auto-execution is flagged by stronger rules (PDF_OPENACTION, encrypted-with-JS, etc.)
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/iX/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://purl.org/dc/elements/1.1/

Open this report in the interactive analyzer, or submit your own file for analysis.