PDF malware analysis — malicious · 0896ffbf667c942f

MALICIOUS

PDF

27.8 KB Created: 2010-02-18 00:34:25 +03:00 Authoring application: [\$\?\^~\!] (via 01067f6f4ec8b1a0843daccb97664995)

MD5: eee4f0cda07d5158c11e553e7278305b SHA-1: 650d74e05c4e7fa740ed5bcbb800bfe6ed64970c SHA-256: 0896ffbf667c942f725b6dbdb37267521f3a30eff1464508ba7fef442315a780

82 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

This PDF file contains embedded JavaScript, flagged by multiple heuristics, indicating an attempt to exploit a vulnerability for client execution. The JavaScript code, though partially obfuscated, appears to be designed to download and execute a secondary payload. The ML classifier strongly indicates maliciousness, supporting the assessment of a malicious document.

Machine Learning

Nyx PDF Classifier malicious score 0.9979

Heuristics 5

ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85

ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0014_000.js` `26a7c932d82ffc568f5be92f81b58df05e1b6cac0c36b5542d30e33598b297cb`	pdf-javascript-stream	PDF /JS object 14 at offset 0x1BBF	36212 bytes
`javascript_obj0016_001.js` `ad31ae76d1a65224c97dafdf75ef07c5b56929f2f6ef93a9ee566fe28480e691`	pdf-javascript-stream	PDF /JS object 16 at offset 0x68FC	120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.