PDF malware analysis — malicious · 00e6a81775780592

MALICIOUS

PDF

4.5 KB Authoring application: Vabameuaki

MD5: adb348b5963842598300e65a2ed2180d SHA-1: 1cd8adbaf9eb249fcde88c5d37d6a00602220554 SHA-256: 00e6a817757805926758586a00b0f6428ebf24e0d1fefc14349a609b08449b5c

86 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF contains embedded JavaScript that is heavily obfuscated. The script uses string concatenation and character code manipulation to construct functions like 'unescape' and 'substring', and then uses these to decode and execute further code. The primary function of the script appears to be to download and execute a second-stage payload, as indicated by the use of functions that would typically be involved in fetching and running external code.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER

PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `1ec398366107a5fedd9bcf18a57f32d68d58e87986c8ad1c876f457b209e2152`	pdf-javascript-stream	PDF /JS object 11 at offset 0xCA2	815 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.