PDF malware analysis — malicious · fd4eb203b02548f6

MALICIOUS

PDF

47.2 KB Created: 2006-02-16 15:03:51 -08:00 Authoring application: Acrobat PDFMaker 7.0.5 for PowerPoint (via substr)

MD5: 4e6690f617c5ab4740be754085f00402 SHA-1: c09fdb178244b90ccfadfa4fa31bc2a55d461019 SHA-256: fd4eb203b02548f6b858d312940a4ac24939cc995e33e11c6ea488897a3b5422

76 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The file is identified as a malicious PDF by ClamAV, specifically 'Pdf.Exploit.Dropped-94'. Static analysis revealed embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. This JavaScript is likely responsible for executing an exploit, as suggested by the 'unknown_exploit_score'. The PDF was authored using Acrobat PDFMaker, which may be a vector for embedding malicious content. The embedded JavaScript is the primary mechanism for the attack, likely leading to the download or execution of a secondary payload.

Heuristics 3

ClamAV: Pdf.Exploit.Dropped-94 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Dropped-94
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0076_000.js` `15ffcdabf66f79e3b5532c8d0e9954c361dd35bbc3ff741da520baf475b487a3`	pdf-javascript-stream	PDF /JS object 76 at offset 0x99C	45601 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.