Malicious PDF — malware analysis report

Static analysis result for SHA-256 1129e9177d4e98e5…

MALICIOUS

PDF

299.5 KB Created: *Y™·¢æ†ìj œr|¤À4jSY°®Ä Authoring application: >0Èõú§ÃëuZÀ&iŕ_j3  «Íhõ« (via /Ùèñ¶ÃþWß> ÿœHkzUN®®Íjû±] BÖ+œ)
MD5: 3225b0be47f2c5d068fcac07fcc20163 SHA-1: 4829f68fc9d48997dad35e851ea1fe3d67759b84 SHA-256: 1129e9177d4e98e515a52bf0dccbe0204b43f0b2883c63f1b8e34ef290fdaab5
64 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment

The PDF file contains multiple embedded JavaScript streams and is encrypted with an OpenAction, indicating an attempt to hide malicious content. The presence of JavaScript actions and embedded JS streams suggests the document is designed to execute arbitrary code upon opening. The heuristics indicate that the PDF is encrypted and uses JavaScript to bypass static analysis, likely to download and execute a second-stage payload.

Machine Learning

  • Nyx PDF Classifier clean score 0.1666

Heuristics 4

  • Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures

Extracted artifacts 21

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0151_000.js
903044271c0b4f6ea1e9e960cc0e332d2857338b885e8cbcc5632d5221fbe782		 pdf-javascript-stream PDF /JS object 151 at offset 0x462ED 42 bytes
javascript_obj0152_001.js
642d5865dfd5607753f5db73a533fd268de9541280a4fd0b36f577b007cdf8cd		 pdf-javascript-stream PDF /JS object 152 at offset 0x4633F 42 bytes
javascript_obj0153_002.js
94638e549cc99b1c688599b2a8b102c65ce4d74a019fec261579e0489f077be7		 pdf-javascript-stream PDF /JS object 153 at offset 0x46393 42 bytes
javascript_obj0154_003.js
bc3108eb7e7845188cfb5e25f392432cefc279aac59fa9e0279e8aabaaedb8ba		 pdf-javascript-stream PDF /JS object 154 at offset 0x463E6 42 bytes
javascript_obj0155_004.js
6f159ea6c137bdca8d2d0870341df8d3a14c55f04835eed3081eb8859f62b455		 pdf-javascript-stream PDF /JS object 155 at offset 0x4643A 42 bytes
javascript_obj0156_005.js
ff86bf25b08afd22c37c62d724ee4d2e0293461435d3aa0574d833a567191788		 pdf-javascript-stream PDF /JS object 156 at offset 0x4648C 42 bytes
javascript_obj0157_006.js
0fc419eb20e69791b2497087c6cfff174853f357e7e5b71a2010e04ac09cfbb7		 pdf-javascript-stream PDF /JS object 157 at offset 0x464DE 42 bytes
javascript_obj0158_007.js
af0a5bf77b7d79f635a878336a3453e2a9cb7944e77282b77d5240441ea7f916		 pdf-javascript-stream PDF /JS object 158 at offset 0x46530 42 bytes
javascript_obj0159_008.js
0d89f66fcb8b06db23870a54c2929872cd9afbcd9a8f36e40dca766b17dd0c0a		 pdf-javascript-stream PDF /JS object 159 at offset 0x46582 42 bytes
javascript_obj0160_009.js
62b28ab9a67cb2db7b2a4b7d7bb57a31beed9b38e9590f99459beccd01799431		 pdf-javascript-stream PDF /JS object 160 at offset 0x465D5 42 bytes
javascript_obj0161_010.js
0f371ef1e8f854facf3cb5016c8f89bf7d9233f594c077db1109b8df12386e7d		 pdf-javascript-stream PDF /JS object 161 at offset 0x46627 42 bytes
javascript_obj0162_011.js
97874c99834e17517035859a36e7147a8d8a71b9d31de4d505c8e35ebee335d0		 pdf-javascript-stream PDF /JS object 162 at offset 0x4667A 42 bytes
javascript_obj0163_012.js
00ac58cd676bd6f6a361139a6a38a8a50d0a5b7f15d904a2391fce516d3500da		 pdf-javascript-stream PDF /JS object 163 at offset 0x466CE 42 bytes
javascript_obj0164_013.js
fb9dd31235de7e78189340eb367f50505f468291599c182322826ada51ffbf31		 pdf-javascript-stream PDF /JS object 164 at offset 0x46720 42 bytes
javascript_obj0165_014.js
21328035c57e08c21ed25e50ea9e356ff83c6d94d1f16e7ad1d7567f743889b0		 pdf-javascript-stream PDF /JS object 165 at offset 0x46772 42 bytes
javascript_obj0166_015.js
3d2f6ca2fd374e2627e73d60fdaabe8958b0bdecfd80db1eecf440fd6e8ea16c		 pdf-javascript-stream PDF /JS object 166 at offset 0x467C6 42 bytes
javascript_obj0167_016.js
22ea991d7187cbad9e9b5537a0a09068b771f0b524dae3f1d2f29a1339cd9a6e		 pdf-javascript-stream PDF /JS object 167 at offset 0x46818 42 bytes
javascript_obj0168_017.js
f6a8f5f931ec7a6312fb365bb825d3c1134730ff84f4affe34bf0accc2e4fe7d		 pdf-javascript-stream PDF /JS object 168 at offset 0x4686B 42 bytes
javascript_obj0169_018.js
f5d501d046dbc5d61a1370d807dc8fe034ccc03c660c37a93cf243d94fc31a5a		 pdf-javascript-stream PDF /JS object 169 at offset 0x468BE 42 bytes
javascript_obj0170_019.js
a628f4077c825c45c3147875818c505ad5c8991fa0e5e87c819ffa4b0cdf6851		 pdf-javascript-stream PDF /JS object 170 at offset 0x46910 42 bytes
javascript_obj0171_020.js
06344669540f4a5582deab8bb530fdf77da97b4e653e27446d8f75f2027be435		 pdf-javascript-stream PDF /JS object 171 at offset 0x46962 42 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.