Malicious PDF — malware analysis report

Static analysis result for SHA-256 0931e5b9e492568f…

MALICIOUS

PDF

3.8 KB
MD5: caa4b438456ddd88e4f3039f1ab83134 SHA-1: 6bbfb482c9476650766ec458c89d3c3f3608a0eb SHA-256: 0931e5b9e492568f1213fdb3580ea5ff577bda5e7aa9da276c734a16da0dd934
86 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF is malformed and lacks a standard object graph, indicating it is not a typical document and likely contains an exploit. Heuristics indicate the presence of JavaScript, suggesting it may attempt to execute malicious code. The ML classifier strongly flags this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Malformed PDF header with no object graph high PDF_MALFORMED_NO_OBJECT_GRAPH
    File starts with a PDF header but contains no indirect objects, xref table/stream, or startxref pointer. This is not a normal renderable PDF and can indicate parser fuzzing, evasion, or a corrupt exploit test case rather than benign content.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.