Malicious PDF — malware analysis report

Static analysis result for SHA-256 15f9be649e20d8ca…

MALICIOUS

PDF

44.9 KB
MD5: ce212190173a966bf0345d5692b335cb SHA-1: bdebb0cae0e317989e8bcb8bf5885d21d4e8073a SHA-256: 15f9be649e20d8ca179a95b1d7bfe3d38b51d7b2b406f0a2c3e0c18dcc022067
176 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript, identified by multiple heuristics including PDF_JAVASCRIPT and PDF_JS_EXPLOIT_CLUSTER. This JavaScript is likely responsible for exploiting a vulnerability within the PDF reader to execute a malicious payload. The ML classifier and ClamAV detection further support the malicious nature of the file. While the JavaScript itself is heavily obfuscated, its presence and the exploit cluster firing strongly indicate an attempt to compromise the user's system.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9615

Heuristics 6

  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/2.6/
    • http://www.xfa.org/schema/xfa-template/2.6/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0012_000.js
e38f60c9023f6f88b8b9370313f9e53e3afe3e4b8b257c067899ddc96ce3bd26		 pdf-javascript-stream PDF /JS object 12 at offset 0xA1FB 3357 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.