Malicious PDF — malware analysis report

Static analysis result for SHA-256 0489d4c5ad5d80c3…

MALICIOUS

PDF

33.7 KB Created: ˆëܯ‰#]ù,SÄã}dõ,8Š/þù°V Authoring application: 2.îܸam«õ£N=Çm (via 2.îϸam¡õ¢N1ÇzÈ)
MD5: 33616ae112e6fe0dcc07eb009314c042 SHA-1: b0e63101149edb2d0ea2e70d3acb519970ae531e SHA-256: 0489d4c5ad5d80c377e008df6a4e52093e0d0533e75b963cf254934f83a52d9c
64 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file is encrypted and contains embedded JavaScript, indicated by the PDF_ENCRYPTED_WITH_JS and PDF_JAVASCRIPT heuristics. This suggests the document is designed to hide malicious code that is only revealed and executed when opened in a vulnerable PDF reader. The embedded JavaScript is likely responsible for downloading and executing a second-stage payload, although its exact functionality could not be determined due to obfuscation. The file's SHA256 hash is provided as a primary IOC.

Heuristics 4

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0009_000.js
7ad5a674e4cb50a27a778806d50974cb6d0cd05dae857338a13d0c245eeaee99		 pdf-javascript-stream PDF /JS object 9 at offset 0x3CA 31888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.