Malicious PDF — malware analysis report

Static analysis result for SHA-256 fba60329fdb9f71b…

MALICIOUS

PDF

7.3 KB Created: 2009-08-23 19:47:07 Authoring application: Win32 12.3.0.0 (via PDF Library 4.5.1.5)
MD5: 209a1da301a3f2b194ccb380e9e43896 SHA-1: a27b272bcce35b85fdcbff66753ca850cb955e88 SHA-256: fba60329fdb9f71b8e3a5d2cf3c61f9af2b53db74bba277ce6eb0cdb41d4e6b8
108 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Dropper.Agent-7327558-0' and an ML classifier indicating high maliciousness. The presence of embedded JavaScript, identified by PDF_JAVASCRIPT and PDF_JS heuristics, strongly suggests that the PDF is designed to download and execute a second-stage payload. The document body content is unreadable, providing no further clues.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Dropper.Agent-7327558-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7327558-0
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0014_000.js
c4ea2eb1a18671752404ed851a950de44a08886a272904757d60135228f1569b		 pdf-javascript-stream PDF /JS object 14 at offset 0x398 288526 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.