Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ff9306edd77d004…

MALICIOUS

PDF

44.7 KB
MD5: 661e6d7b309132dc19cf4edcec4ce0d6 SHA-1: 15bb960c4a6eceec6b8c1b8c9efb8b5915ea07dc SHA-256: 0ff9306edd77d004b5fb5853896b1b5166c848a118ba71d1e6e44ab8163c05b2
176 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript, identified by multiple heuristics including 'PDF_JAVASCRIPT', 'PDF_JS', and 'PDF_JS_EXPLOIT_CLUSTER'. This JavaScript is likely responsible for exploiting a vulnerability within the PDF reader to execute arbitrary code. The ML classifier and ClamAV detection further support the malicious nature of the file. The benign URLs present do not detract from the malicious JavaScript's likely intent to download and execute a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9615

Heuristics 6

  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/2.6/
    • http://www.xfa.org/schema/xfa-template/2.6/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0012_000.js
8fcc1e49cc9d7db3e30dde4329e274901d0edecfb00836cf06e05273733410bc		 pdf-javascript-stream PDF /JS object 12 at offset 0xA202 3268 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.