PDF malware analysis — malicious · f15c02949aafea03

MALICIOUS

PDF

16.6 KB Authoring application: Xedeehagireuehoefovi (via Sahagipohesico)

MD5: bce12183197836f9f11aac6eb5450b70 SHA-1: 11059c621cbe3713f836620ae5197389fdc9f690 SHA-256: f15c02949aafea030175d003d93470eab083d3e0ef0a86802f92efed82d362e7

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The critical ClamAV detection and high ML heuristic strongly indicate malicious intent. The PDF contains embedded JavaScript, which is often used to download and execute further malicious content. While the specific JavaScript content was truncated, its presence and the overall classification point to a dropper functionality.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 3

ClamAV: Pdf.Dropper.Agent-5343198-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-5343198-0
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0026_000.js` `4dbcf10d04e0b59ba691940d5f2de54e36a6b11d4f473908e1ec3e0ae2dfe554`	pdf-javascript-stream	PDF /JS object 26 at offset 0x3851	36749 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.