PDF malware analysis — malicious · 164c586054275433

MALICIOUS

PDF

35.5 KB Created: Ew0µ]1ÆÝ³Ø¥u7:oo¦N Authoring application: B?gän (via Q?máb)

MD5: ab069debb8ce5a5d6a21cf3d1379d1f9 SHA-1: b6c7f71e58a6f5a485935fd1714ea9359852fb9d SHA-256: 164c58605427543313b18911780f3ee62f62c9512306a6260dbbb2993817d7c4

94 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF file contains multiple JavaScript streams, with one being significantly larger and heavily obfuscated, indicating a malicious intent to conceal its functionality. The presence of PDF_ENCRYPTED_WITH_JS and ML_NYX_PDF_MALICIOUS heuristics further supports that the embedded JavaScript is used to hide a malicious payload, likely for downloading and executing a second-stage exploit. The primary attack pattern is likely spearphishing attachment, as is common for malicious PDFs.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 4

Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS

PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0009_000.js` `3d8af6167eb05d0cb049936db558d81ceda2046f08fe3d0987697b4370ae7d6a`	pdf-javascript-stream	PDF /JS object 9 at offset 0x1358	2047 bytes
`javascript_obj0009_000_1.js` `eedeb2654b0eb86899b68547d58ddc9462e1a3e5e1f0b479a5b87e0143990b3f`	pdf-javascript-stream	PDF /JS object 9 at offset 0x13BF	29694 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.