Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c96ed894b3c9947…

MALICIOUS

PDF

4.1 KB
MD5: 46207c9d3f6ab5f3eb380ab9da6b6e00 SHA-1: 7555ded5fb781ea688e6484e65302b58622f6b32 SHA-256: 0c96ed894b3c99475b7651256af8c5c2e1ffbe2983abc5f33e442c64b175115f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF sample contains embedded JavaScript, indicated by the PDF_EVAL and PDF_EMBEDDED_SCRIPT_PAYLOAD heuristics. The ML classifier strongly flags this PDF as malicious. The embedded JavaScript, extracted as stream_000_off00000287.js, is likely responsible for executing the malicious payload, potentially downloading additional malware. The benign Adobe and XFA URLs do not appear to be directly involved in the malicious execution chain.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded script payload in PDF stream low PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/1.0/
    • http://www.xfa.org/schema/xfa-template/2.5/
    • http://ns.adobe.com/xtd/
    • http://www.xfa.org/schema/xfa-data/1.0/
    • http://ns.adobe.com/xfdf/
    • http://www.xfa.org/schema/xfa-form/2.8/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_000_off00000287.js
81f29f3acca99324e4f6964f4624cdd60308f6d0e0bf3ef593310fab98ac4450		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x287 10440 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 5 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.