PDF malware analysis — malicious · fd5f933f96a01e94

MALICIOUS

PDF

47.5 KB Created: 2006-02-16 15:03:51 -08:00 Authoring application: Acrobat PDFMaker 7.0.5 for PowerPoint (via substr)

MD5: b32ddd4d7b5fddbfd1d1dcf54faab7e9 SHA-1: 711f81095cdfe9273d2123c5c48e09e8261967fc SHA-256: fd5f933f96a01e94edd369e8c0aa0421123ad18224b3a68571c291e65270d50a

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The critical ClamAV detection and high ML classifier score indicate malicious intent. The presence of embedded JavaScript, flagged by heuristics, suggests the PDF is designed to exploit a vulnerability and execute code. The large size of the embedded JavaScript stream further supports the likelihood of it containing a downloader or exploit. The document body content is not indicative of user-facing malicious activity, suggesting the exploit is the primary vector.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

ClamAV: Pdf.Exploit.Dropped-94 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Dropped-94
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0076_000.js` `d6947bd5d0e95bffe9cff0f11ba9cea8da0493414667a769d070b9ff76d1a352`	pdf-javascript-stream	PDF /JS object 76 at offset 0x999	45850 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.