SUSPICIOUS
54
Risk Score
Malware Insights
MITRE ATT&CK
T1059.007 JavaScript
T1203 Exploitation for Client Execution
T1566.001 Spearphishing Attachment
The PDF sample contains embedded JavaScript, indicated by multiple heuristic firings including 'PDF_JAVASCRIPT' and 'PDF_JS'. The ML classifier also strongly flagged this PDF as malicious. The embedded JavaScript is designed to execute, likely to download and run a secondary payload, which is a common technique for initial compromise via malicious documents.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
JavaScript action low 1 related finding PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0100_000.js |
pdf-javascript-stream | PDF /JS object 100 at offset 0x632 | 1946 bytes |
SHA-256: 97e6c8fb70f6fedab160a41095c99dce3c9d53a0086d3a8d4e6d47cbe03dce61 |
|||
Preview scriptFirst 1,000 lines of the extracted script
�� v a r v = a p p . v i e w e r V e r s i o n ;
i f ( v < 7 )
{
v a r n = 0 ;
i f ( t h i s . d a t a O b j e c t s ! = n u l l )
n = t h i s . d a t a O b j e c t s . l e n g t h ;
i f ( v > = 5 & & v < 6 & & n > 0 & & ( a p p . v i e w e r V a r i a t i o n = = " F u l l " | | a p p . v i e w e r V a r i a t i o n = = " F i l l - I n " ) )
{
i f ( t h i s . e x t e r n a l )
a p p . a l e r t ( "g,e�hcS T+e�N��DN�0 ��g�w �DN�� ��SUQ� O�[X c ��geO�[Xe�hcRog,� q6T W( A c r o b a t N-bS_ Rog,� ^v� b� e�N� > e�hc\^`' > ]LQev�epcn[��a 0 " , 3 , 0 ) ;
e l s e
a p p . a l e r t ( "g,e�hcS T+e�N��DN�0 ��� b� e�N� > e�hc\^`' > ]LQev�epcn[��a geg�w �DN�0 " , 3 , 0 ) ;
}
e l s e i f ( v > = 6 & & v < 7 )
{
i f ( n = = 0 )
{
v a r n p = t h i s . n u m P a g e s ;
s y n c A n n o t S c a n ( ) ;
f o r ( v a r p = 0 ; p < n p & & n = = 0 ; + + p )
{
v a r a n n o t s = t h i s . g e t A n n o t s ( p ) ;
i f ( a n n o t s ! = n u l l )
{
f o r ( v a r i = 0 ; i < a n n o t s . l e n g t h ; + + i )
{
i f ( a n n o t s [ i ] . t y p e = = " F i l e A t t a c h m e n t " )
{
n = 1 ;
b r e a k ;
}
}
}
}
}
i f ( n > 0 )
{
i f ( t h i s . e x t e r n a l )
a p p . a l e r t ( "g,e�hcS T+e�N��DN�0 ��g�w �DN�� ��SUQ�e�hcz�S�W�v�n�R�ga�v��v��тrN ��_b� q6T � b� e�N��DN� 0 " , 3 , 0 ) ;
e l s e
a p p . a l e r t ( "g,e�hcS T+e�N��DN�0 ��� b� e�hc > e�N��DN� ��SUgeg�w �DN�0 " , 3 , 0 ) ;
}
}
}
|
|||
stream_007_off00000632.js |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x632 | 1336 bytes |
SHA-256: 5c1ab2af46eef55b0d162c3a84464633475df9b138b64aa21a36ffaffbdffa88 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.