Malicious PDF — malware analysis report

Static analysis result for SHA-256 11523504bf87cef2…

MALICIOUS

PDF

454.3 KB
MD5: 628c2edda0fdb20c417d2c2842ecfca5 SHA-1: 5f73be10b9236054dbdfbcec4ea1602b61d28210 SHA-256: 11523504bf87cef2a01e08b1dc94a29c6d67ef0213e3574fc33db2ea517ec2a1
108 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF sample contains embedded JavaScript and triggers heuristics related to XFA forms and JavaScript exploits. The embedded JavaScript streams, particularly 'stream_002_off0000050e.js', are likely responsible for downloading and executing a second-stage payload, indicating a malicious document designed for initial compromise. The presence of multiple extracted JavaScript and binary artifacts further supports this assessment.

Machine Learning

  • Nyx PDF Classifier clean score 0.1908

Heuristics 7

  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://forms.stefcameron.com/2006/06/14/acroform-field-name-generator/
    • http://www.monotype.comMonotype
    • http://ocsp.verisign.com0
    • http://www.adobe.com/go/reader_download
    • http://www.adobe.com/go/acrreader
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xfa/promoted-desc/
    • http://www.xfa.org/schema/xci/3.0/
    • http://www.xfa.org/schema/xfa-template/3.0/
    • http://www.w3.org/1999/xhtml
    • http://www.xfa.org/schema/xfa-data/1.0/
    • http://www.xfa.org/schema/xfa-template/2.8/\
    • http://www.w3.org/1999/xhtml\
    • http://www.xfa.org/schema/xfa-data/1.0/\
    • http://www.xfa.org/schema/xfa-locale-set/2.7/
    • http://www.xfa.org/schema/xfa-connection-set/2.8/
    • http://www.bde.es/InfTrimComYTip
    • http://ns.adobe.com/data-description/
    • https://www.verisign.com/rpa
    • http://ocsp.verisign.com/ocsp/status0
    • https://www.verisign.com/rpa0
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0
    • http://www.microsoft.com/typography
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.html
    • http://cgi.adobe.com/special/acrobat/update
    • http://crl.verisign.com/tss-ca.crl0
    • http://crl.verisign.com/ThawteTimestampingCA.crl0
    • http://logo.verisign.com/vslogo.gif0
    • http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
    • http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
    • https://www.verisign.com/cps0*
    • http://logo.verisign.com/vslogo.gif04
    • http://crl.verisign.com/pca3-g5.crl04
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.html

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00000121.js
6d8fe6a533994ddfe69a896426fe3b7db6a82b0dcd7520289ad970a4d0e1c6d1		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x121 2560 bytes
stream_002_off0000050e.js
d433a5756c5d4dea4c1d5c462684af70355f53a0e1dc86c69e79f50756e0a2b3		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x50E 738041 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 3 long base64-like blob(s).
stream_003_off00028e6a.bin
984e33597cee6a139b4eb9668deb8ae3fd023cb2f29b1dac2e77dd6be0d9a93d		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x28E6A 2893 bytes
stream_005_off0002940c.bin
03ce370fa65ba03e4bf47493c3eb2ead0d7f8285d9431a26cbc7ae86788c3050		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2940C 354 bytes
stream_006_off00029540.bin
eddac3fc8bff30f62fcd24909e18502890e3a23bb770a3d073851c1e51e534e2		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x29540 17902 bytes
stream_008_off0003a16c.bin
b8e2518b116c26bab0e9f8c1672daf405dedad561157502b657e9005be2029aa		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3A16C 367087 bytes
stream_010_off0006e809.js
529357503ec67b623d2a12816cdeea62bd639f2b4ff4e568b01c96cc3f5bfc6f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6E809 1363 bytes
stream_011_off0006e9e7.js
e985b5df65c8c3cf732a9074b575fbc594c1c7f0bccc0994182ec7e5c0f7308a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6E9E7 902 bytes
objstm_0011_00.bin
f2fafb708036d60059bd45a0712d86be54a7e6db94ba7c3f2f96bf59f9b1a89e		 pdf-objstm-decoded PDF /ObjStm 11 0 obj (inflated) 10185 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
font_00_sfnt_off00029d1b.bin
bb2941ec4287d456b111082246b159a552fabcbd95c93efecdf11c9146f57370		 pdf-font-stream PDF embedded font (sfnt) at offset 0x29D1B 96552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.