Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc37dba55714c0f9…

MALICIOUS

PDF

3.2 KB
MD5: e6b00919ebc99f37e371fea375c0c3cf SHA-1: 9d0e2c6f21654ebc65b302bcf648327701c0999a SHA-256: fc37dba55714c0f9e053c2bacf6418a1dff5635ebcde22dadce9e8178806a121
106 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file was flagged by ClamAV as Pdf.Exploit.Agent-36121 and a machine learning model assigned a high maliciousness score. Embedded JavaScript was detected, indicating an attempt to exploit vulnerabilities within the PDF reader. The primary function of the embedded JavaScript appears to be the download and execution of a second-stage payload, though the exact URL is obfuscated within the script.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Exploit.Agent-36121 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36121
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js
ac505428ca1e704312f3ce21040002d1dda1b551bb0baef23695b21a97439cf6		 pdf-javascript-stream PDF /JS object 7 at offset 0x9C9 458 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.