PDF malware analysis — malicious · 05dc0792a89e18f5

MALICIOUS

PDF

36.0 KB First seen: 2022-03-24

MD5: a3a7e49226d703a4aee1d227c6f441e6 SHA-1: ff0979fbfc57104e431e0fb1c1107859789f913a SHA-256: 05dc0792a89e18f5485d9127d2063b343cfd2a5d497c9b5df91dc687f9a1341d

86 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains critical heuristics indicating it functions as a dropper, utilizing JavaScript to launch an embedded executable. The JavaScript action and the exportDataObject + nLaunch heuristic specifically point to this behavior. The embedded file and the decompressed JavaScript stream are the primary artifacts enabling this malicious functionality.

Machine Learning

Nyx PDF Classifier suspicious score 0.4138

Heuristics 5

exportDataObject + nLaunch — embedded-file launch-on-open dropper critical PDF_JS_EXPORT_LAUNCH_DROPPER

PDF JavaScript calls exportDataObject() with nLaunch set, which extracts the document's embedded file and launches it in its default application. This is a launch-on-open dropper: the embedded file is the payload. No benign workflow auto-launches an extracted PDF attachment. (matched in decompressed stream)
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE

PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0028.bin` `250d2cd13474133227c3199467a30f4e1e17de7c7c4190c4784e46ecf77e51fe`	pdf-embedded-file	PDF EmbeddedFile object 28 at offset 0x3D45	21857 bytes
`stream_010_off00008c65.bin` `d32942e2edf165cf7f2d33f8815ea73af25b5cc968e0e92283796cc82ed1c7bc`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x8C65	979 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.