PDF malware analysis — malicious · f7faef3ba07159ad

MALICIOUS

PDF

45.0 KB

MD5: 78393c699fee83f0442aa360a6b75e92 SHA-1: d322f72e1911b979283ea89e61052ebdd48beefe SHA-256: f7faef3ba07159adaf012f682bac5ed8b1ad786a95ad9a4f25ad1c365b309ce3

76 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The critical ClamAV heuristic 'Pdf.Exploit.Agent-36128' indicates a known PDF exploit. The presence of embedded JavaScript, identified by 'PDF_JAVASCRIPT' and 'PDF_JS' heuristics, strongly suggests that the exploit leverages this script to perform malicious actions. The large size of the embedded JavaScript streams further supports the likelihood of a complex payload delivery mechanism, such as downloading and executing a second-stage payload. The document body content is not indicative of a specific lure.

Heuristics 3

ClamAV: Pdf.Exploit.Agent-36128 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36128
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0008_000.js` `5a13e3594163c0a9cc6695b980060846bbd0cd4c91e845ed70951aa43654c0cf`	pdf-javascript-stream	PDF /JS object 8 at offset 0x1E7	45305 bytes
`legacy_pdfkit_stage_000.js` `dfe7159867f45e377fbb2cd573bdaf0c4c54bb50eff8ae98832b2cb3acdb231a`	deobfuscated-js	double percent-decoded annotation JavaScript at offset 0x1E7	33047 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.