PDF malware analysis — malicious · f1c025180d55d64e

MALICIOUS

PDF

7.6 KB Authoring application: Qimigiwova (via 1e1cbBashemeriwesohitaro)

MD5: f121494efe89179c56e726022763f8d4 SHA-1: 09baf01822bc6e5d8994cdf1aeafcc8737577e76 SHA-256: f1c025180d55d64e74b5719b344bf0b81b56c5ed9d28ec233cc3951bd2eb199a

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating obfuscated content. Embedded JavaScript was detected, which is commonly used to download and execute further payloads. The ML classifier's high confidence score supports this assessment.

Machine Learning

Nyx PDF Classifier malicious score 0.9989

Heuristics 3

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0010_000.js` `ed31b16df2b6492a4d5be85b534deca964c2f0e07a8443782787f4ed9c62c93c`	pdf-javascript-stream	PDF /JS object 10 at offset 0x1303	3192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.