PDF malware analysis — malicious · 00953c6ebcbfdd15

MALICIOUS

PDF

6.6 KB Created: 2010-05-05 18:52:52 Authoring application: Ridgatanzowen (via Kaminimsavite)

MD5: e0559945163f046a4d3fc17abfe7aa9c SHA-1: 3d40be0aeb0e26234444704990e818c1309c570f SHA-256: 00953c6ebcbfdd15de33b36c3bd86bd702c991a5eb28e31ccdb6e8dda107adbc

86 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF contains embedded JavaScript that is heavily obfuscated using string concatenation and XOR operations. The script appears to be a stager designed to deobfuscate and execute a payload. High-confidence heuristics indicate this is a malicious PDF with a JavaScript launcher. The script reconstructs several function names and string literals, but the final payload URL or execution target is not directly discernible due to the obfuscation.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER

PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0017_000.js` `d40eff94102f1624ca3c5be9c5731d1eefbf83d9b7f60f2393b8b53191c8055b`	pdf-javascript-stream	PDF /JS object 17 at offset 0x14E1	791 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.