PDF malware analysis — malicious · ffba26c5b14fb07f

MALICIOUS

PDF

33.4 KB Created: 2010-03-01 13:29:19 +03:00 Authoring application: ipsumDont (via fdc2397ee9d0dbbcfdc0ba1c0fe3442b)

MD5: c6b72c1a58ab4e0fcae26cb1c7c7ec77 SHA-1: 536425c8a2ffd86ca60191c4c6a7c42ac63816ed SHA-256: ffba26c5b14fb07f80f5df5ee9ead4bcbb7cf019215f0accde1234013d21fa7a

122 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The critical ClamAV detection and ML classifier strongly indicate malicious intent. The presence of multiple JavaScript streams and PDF-specific exploit indicators (ASCII85Decode, Optional Content Group with action trigger) suggest the PDF is designed to exploit vulnerabilities and execute code. The ClamAV signature 'Pdf.Exploit.Agent-17654' is the primary IOC. The exact functionality of the JavaScript streams could not be fully determined due to obfuscation, but their presence is a key indicator of an exploit attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9983

Heuristics 5

ClamAV: Pdf.Exploit.Agent-17654 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-17654
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85

ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0016_000.js` `fe0abed953048b2491c25fcbadb020632b12dde26277cfeae7d7fa2cdfe5d94a`	pdf-javascript-stream	PDF /JS object 16 at offset 0x2536	113 bytes
`javascript_obj0018_001.js` `c08ebfe39d406c7fb3d25c01cddeb159df63cb88f9473d791070470d5365a34e`	pdf-javascript-stream	PDF /JS object 18 at offset 0x264E	34881 bytes
`javascript_obj0020_002.js` `52c0d6c70b97af2c866f8e9bbcd778b1fb6cf388028ab7c184f027b1c8ac5fad`	pdf-javascript-stream	PDF /JS object 20 at offset 0x7FBD	79 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.