PDF malware analysis — malicious · 075f8dbcfa283c2d

MALICIOUS

PDF

267.0 KB

MD5: 1e91f4138f19221d90e58eae355162e3 SHA-1: 6f91b4515030cf019731cc386caa2b9fa6bd1e3e SHA-256: 075f8dbcfa283c2df74b2fccc37e86563c55768badcc3565e25ca3a99469565e

256 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

This PDF file contains embedded JavaScript that is heavily obfuscated and utilizes techniques common in exploit delivery. The script attempts to exploit PDF viewer vulnerabilities, indicated by the 'PDF_JS_EXPLOIT_CLUSTER' and 'PDF_UNESCAPE' heuristics. The recovered JavaScript stage suggests it is designed to download and execute a secondary payload, a common tactic for malware droppers. The presence of U3D content also points to potential exploitation of Adobe Reader 3D parser vulnerabilities.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 9

U3D/3D content in PDF — Adobe Reader 3D parser CVE-family indicator high CVE related PDF_U3D_CVE_RELATED

PDF contains U3D (Universal 3D) or 3D annotation content — CVE-2011-2462 and CVE-2009-3953 are critical vulnerabilities in Adobe Reader's U3D processing that allow arbitrary code execution. U3D content in PDFs is extremely rare in normal documents.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0015_000.js` `8ab855865d9d76fe0ae0a74b2039492241f0f82c886e002081348e27c6f68212`	pdf-javascript-stream	PDF /JS object 15 at offset 0x415DC	10948 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
`generic_stage_recovery_000.js` `d70659d37cae0cccb0db1deec12c5c4856ee989b59881014ca7054499c152e2b`	deobfuscated-js	generic stage recovery marker-MM-to-%u from JavaScript object 15 at offset 0x415DC	7661 bytes
`u3d_00_off0000039e.bin` `db47f9e6c2fa22cca9aaaaba842bc1035f54c0acd3737dbd64b69dc1671da5eb`	pdf-3d-stream	PDF U3D 3D stream at offset 0x39E	1268 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.