PDF malware analysis — malicious · f121d09a669db939

MALICIOUS

PDF

868 B Created: 2011-72-51 03:25:00 Authoring application: ring.fromCharCode

MD5: 317c55b526173586967cdc08f2af1c34 SHA-1: 9b847a4e100c996233047e45189ea36d26b744be SHA-256: f121d09a669db939f393e03bd38ca9d4f5d449d16bc93cf0475b4a73fcc79f21

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The file is identified as a malicious PDF by ClamAV and a machine learning classifier. Static analysis revealed embedded JavaScript, which is a common technique for executing malicious code within PDF documents. The embedded JavaScript is likely responsible for the malicious behavior, potentially downloading and executing a second-stage payload. The ML classifier output of 0.999988 indicates a very high probability of maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

ClamAV: Pdf.Dropper.Agent-7322507-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7322507-0
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0001_000.js` `e28b048eda6c3b031eccffd72ecc4f9899c806e4008124806314ba6a13db47cc`	pdf-javascript-stream	PDF /JS object 1 at offset 0x11F	377 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.