Malicious PDF — malware analysis report

Static analysis result for SHA-256 08801e7be3d34227…

MALICIOUS

PDF

28.08 MB
MD5: c4ca5ee475672c63d315570fd91fe8f5 SHA-1: e8550d731c1a1a65cb6a0dd0a0a281fcd243e2f2 SHA-256: 08801e7be3d3422724b3b5f586225e8ec0594b458baa34b2c80efa9506e55977
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1140 Deobfuscate or Obfuscate Malicious Code

This PDF is flagged as malicious by a machine learning classifier and exhibits characteristics of an advance-fee scam lure. It contains embedded JavaScript, which is likely used to obfuscate malicious content and potentially download a second-stage payload. The PDF is also encrypted, further hiding its malicious components.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 6

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Additional-actions dictionary low PDF_AA
    PDF defines /AA (Additional Actions) that references an executable action (JS/JavaScript/Launch/SubmitForm) — can auto-trigger on document or widget events. Form-field calc/format/validate/keystroke handlers in legitimate interactive forms commonly fire this, so it is reported as a low-weight signal; weaponised auto-execution is flagged by stronger rules (PDF_OPENACTION, encrypted-with-JS, etc.)

Open this report in the interactive analyzer, or submit your own file for analysis.