PDF malware analysis — malicious · 18a2d3784c48e61e

MALICIOUS

PDF

6.2 KB

MD5: 65a4bf337d216024618a923bdf63e6f6 SHA-1: 4bd3c23ec89e35d9274c311cfaeb89ad4fe8c469 SHA-256: 18a2d3784c48e61e4ad54902c7933d47c363ee904a401f4e04b885b7cd6bdf88

86 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment

This PDF file contains embedded JavaScript that employs various string manipulation and obfuscation techniques, including character code manipulation and XOR operations, to construct and execute a payload. The script's primary function appears to be downloading and executing a second-stage malicious component, as indicated by the use of functions like 'eval' and the overall stager pattern. The ML classifier and heuristic firings strongly suggest malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER

PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0016_000.js` `582f0561023923b6daa9bcc92feaaf0fbb54e96e3632caa091aff741933d4637`	pdf-javascript-stream	PDF /JS object 16 at offset 0x12A9	1368 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.