PDF malware analysis — malicious · 14a18669187494ec

MALICIOUS

PDF

MD5: f411a89cac7f06b6a61b80fc588f3d5b SHA-1: 38d8eb9e08b77507ec18cc469bf3aa3e1795e7a3 SHA-256: 14a18669187494ec0541e354ac471bf4727c28667de20c10d964846b9f325e76

258 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF contains multiple JavaScript streams and triggers several high-severity heuristics related to JavaScript exploits, including eval() and unescape() calls, and a PDF JavaScript exploit cluster. The presence of U3D/3D content and a CVE-related heuristic suggests exploitation of a vulnerability within Adobe Reader's 3D parsing capabilities. The embedded JavaScript is likely responsible for downloading and executing a secondary payload, indicated by the PDF_JS_EXPLOIT_CLUSTER and PDF_EMBEDDED_SCRIPT_PAYLOAD firings.

Machine Learning

Nyx PDF Classifier malicious score 0.5020

Heuristics 10

U3D/3D content in PDF — Adobe Reader 3D parser CVE-family indicator high CVE related PDF_U3D_CVE_RELATED

PDF contains U3D (Universal 3D) or 3D annotation content — CVE-2011-2462 and CVE-2009-3953 are critical vulnerabilities in Adobe Reader's U3D processing that allow arbitrary code execution. U3D content in PDFs is extremely rare in normal documents.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
String.fromCharCode low PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules. (matched inside decoded stream)
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.righthemisphere.com
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/g/img/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#
- http://ns.adobe.com/xap/1.0/t/pg/
- http://ns.adobe.com/xap/1.0/sType/Dimensions#
- http://ns.adobe.com/xap/1.0/g/
- http://ns.adobe.com/pdf/1.3/
- http://www.adobe.com

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_015_off00001e7a.js` `032aebb6881f091b9df0d62aa08e1fd8a2488f1102f8eca56ef4689c2b292b04`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1E7A	26303 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 6 eval/decoder/string-building token(s).
`stream_017_off00003319.js` `f8a1e8a070071e240774eb6c5b6aca58b01debb4da49fa2fd97af8154a74dbb8`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x3319	31437 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 6 eval/decoder/string-building token(s).
`stream_020_off00004bda.js` `f0980fd229ec2af2ec28297dea75f98e43cd1b89bc1e5f075a7228f3e72ed050`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4BDA	70376 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 13 eval/decoder/string-building token(s).
`stream_021_off00007d43.js` `c27d1f4aec5d4e628efc8a177b0d4557089071b190282b5f8a3ecc79a6bcfed7`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x7D43	4383 bytes
`stream_022_off000082d8.bin` `255d0b7f6c1ae6a5092e9eb50d09d737499531700d63bd377748e6756caf5582`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x82D8	262236 bytes
`stream_024_off0002ee5e.js` `08d2faa7ae86a5cd3bbb2ec26fc3475e99d5382cc61b1d18a7b678e9bb305f9e`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x2EE5E	6917 bytes
`objstm_0125_00.bin` `cb3ef1eaa372bce250bcee01b33f72e40d916ffe538aa130b28fe7701a44e360`	pdf-objstm-decoded	PDF /ObjStm 125 0 obj (inflated)	15430 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.