PDF malware analysis — malicious · fbd7c78d2cb79da8

MALICIOUS

PDF

7.5 KB Authoring application: Jgaxivakafowizasi (via 7d619Uohosicilab)

MD5: 0667b23c7b2f8d6ec015055e61aeefa4 SHA-1: 193ab93e5a403a626c1989b404ec39bb04162b52 SHA-256: fbd7c78d2cb79da887c7a951382dadba99d1faf0dc97a802303a90f1a4cf1e08

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF file was flagged as malicious by multiple heuristics, including a high-severity ML classifier and ClamAV detection for obfuscated objects. The presence of embedded JavaScript, indicated by PDF_JAVASCRIPT and PDF_JS firings, suggests the file is designed to execute malicious scripts. The ML classifier's high confidence score further supports the malicious nature of the file. The document body was unreadable, preventing a more specific analysis of the lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9954

Heuristics 3

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `c35f939b8b08b4458e4f2307d4bfd0afc23546c955e11c1da88e87302e40c9b0`	pdf-javascript-stream	PDF /JS object 11 at offset 0x1358	3029 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.