PDF malware analysis — malicious · 005452b914516fad

MALICIOUS

PDF

2.7 KB

MD5: 8f5b0e06d63827aabbd626fff54607f6 SHA-1: b148f78f1db23021dce5c55309c4152a986ba3e8 SHA-256: 005452b914516fada31c944cb8d3a790d697aea21903d22aeb2a6ae359511c3f

164 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious File T1204.002 Malicious File: User Execution: Malicious Attachment

The PDF contains embedded JavaScript that is heavily obfuscated and appears to be designed to exploit a vulnerability. The script's intent is to download and execute a second-stage payload, indicated by the presence of 'test.swf' in the document body and the PDF_RICHMEDIA heuristic firing. The ML classifier strongly indicates maliciousness, and the PDF_JS_EXPLOIT_CLUSTER heuristic confirms the presence of exploit-related JavaScript.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 7

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
RichMedia (Flash) high PDF_RICHMEDIA

PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ns.adobe.com/xdp/
- http://www.xfa.org/schema/xci/2.6/
- http://www.xfa.org/schema/xfa-template/2.6/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0006_000.js` `0211f8ceae1b1138cab3da28c79994eca7a9c3f7d8e2fc40ad063e63a3ef9f3f`	pdf-javascript-stream	PDF /JS object 6 at offset 0x106	1579 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.