Malicious PDF — malware analysis report

Static analysis result for SHA-256 1867a442f1f6765c…

MALICIOUS

PDF

114.8 KB Created: 2004-08-17 12:19:46 Authoring application: PDF+Forms 2.0 (via Cardiff Software - TELEform 7.0)
MD5: a18eea7e199c7d44717d445497302460 SHA-1: e6761b41552c43283b3a21459648dba85a24da12 SHA-256: 1867a442f1f6765c52d8f556f77b4e06f7e5019b0c3c1e3e3b49323c3063ad10
162 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded JavaScript streams, with one large stream exhibiting obfuscation indicators and triggering a PDF JavaScript exploit cluster heuristic. The presence of `eval()` calls and the ML classifier flagging the PDF as malicious indicate it is designed to execute arbitrary code. The JavaScript appears to be related to form manipulation and potentially downloading or executing additional payloads, as suggested by the exploit cluster.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5965

Heuristics 9

  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.adobe.com/acrobat/readstep.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/iX/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/

Extracted artifacts 17

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0212_000.js
8c1842de4ccb6a3c96db5313300728b182467d8c490b4d5e0d55a77535907087		 pdf-javascript-stream PDF /JS object 212 at offset 0x116BB 48 bytes
javascript_obj0213_001.js
84391237e30359fab2288524f69e3a5faa52ab0bd4a553b0a541fda146d94ede		 pdf-javascript-stream PDF /JS object 213 at offset 0x1171E 48 bytes
javascript_obj0215_002.js
71e1e912d3442da2981a7809b1fbc56b35d1a2ed332fbfd3bfd013d8dca6105d		 pdf-javascript-stream PDF /JS object 215 at offset 0x118FF 45 bytes
javascript_obj0217_003.js
fee55bfb2b9cdc0658a55b80fe1f14a23f0a7ed79f7fd4ce851144fedf36b2c8		 pdf-javascript-stream PDF /JS object 217 at offset 0x11AC8 58 bytes
javascript_obj0218_004.js
9eb3426cfc88396d15a86b175dfd01c1092cd47e0a9c11a3cf9dba46029db0ca		 pdf-javascript-stream PDF /JS object 218 at offset 0x11B35 83 bytes
javascript_obj0219_005.js
6df41228049e9cfb40e870ad866cb0990b2c5c68d8dedf656036b6960c17fe67		 pdf-javascript-stream PDF /JS object 219 at offset 0x11BBD 91 bytes
javascript_obj0003_015.js
02138ff9152f48b3b584612fba4915d7af23e8ede0ffd728595ba7235dc7f1de		 pdf-javascript-stream PDF /JS object 3 at offset 0xF0 8197 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
javascript_obj0005_016.js
51b416d40e3fe50ca6cc0f31faaf0a6a5b8bacfb1e4c1e4f8ab8982b62aff890		 pdf-javascript-stream PDF /JS object 5 at offset 0xA42 948 bytes
javascript_obj0007_017.js
3c4718d5b4722e6302a5956d94c9292ffa8bca5b293d7b4d2fb92ad68b7a1803		 pdf-javascript-stream PDF /JS object 7 at offset 0xD40 1278 bytes
javascript_obj0009_018.js
37b7eb79892e58dc20ea6975feac49ee9fe3cee1a15414b7be6d53343cdc22b3		 pdf-javascript-stream PDF /JS object 9 at offset 0x105F 1948 bytes
javascript_obj0011_019.js
07707251746d909fbaaac180bbb1c38ba5d42d3c8ee80b844efbc76a1050da70		 pdf-javascript-stream PDF /JS object 11 at offset 0x13DD 365 bytes
javascript_obj0013_020.js
b90d752a956a79317ce850d9dc248626442258f087fc4e591c9c682371ed73d4		 pdf-javascript-stream PDF /JS object 13 at offset 0x1566 879 bytes
javascript_obj0015_021.js
54beb40673c9298f572cf0e8c0a38f651abec4997320e96d7a66a6aa22fbc19a		 pdf-javascript-stream PDF /JS object 15 at offset 0x1772 4040 bytes
javascript_obj0017_022.js
86fa7b6780ea8978b1a9786befc16005d197f318fd763910910709b2ebe819d2		 pdf-javascript-stream PDF /JS object 17 at offset 0x1D00 136 bytes
javascript_obj0019_023.js
5dc825a345efe5e078ad9ec1684ba5d192fdd7934134de2e788cee9f8b089aac		 pdf-javascript-stream PDF /JS object 19 at offset 0x1DFF 262 bytes
javascript_obj0021_024.js
edf27b97ca5533b1482f126283f0a169d3dd1dd63059ba0201e8599590339d98		 pdf-javascript-stream PDF /JS object 21 at offset 0x1F52 4720 bytes
javascript_obj0302_025.js
29b888f21d209b4d2c55766dc62c54b372d34317a55612c33109fae1ee35bdb2		 pdf-javascript-stream PDF /JS object 302 at offset 0x17415 1636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.