Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6e946ca460d0c57…

MALICIOUS

PDF

12.1 KB
MD5: 658710e652f3a5d53f883cbf583322d2 SHA-1: c9eb04b97f6d47d610f1dbccaa1540f5cd443a33 SHA-256: f6e946ca460d0c57e8fab98e93b55e112cef0534078eeb5053238247ddf2d06e
78 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains obfuscated JavaScript, as indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. ClamAV also flagged it with Heuristics.PDF.ObfuscatedNameObject, suggesting malicious intent. The embedded JavaScript is likely responsible for executing the malicious payload, though its exact function cannot be determined due to obfuscation. The differential parser failure further supports the presence of malicious manipulation.

Heuristics 4

  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.