PDF malware analysis — malicious · 19abb31b2447002c

MALICIOUS

PDF

1.17 MB Created: 2009-12-17 03:14:38 +08:00 Authoring application: PScript5.dll Version 5.2 (via Acrobat Distiller 7.0.5 (Windows))

MD5: d6922c13bd3d837208d8fc1996b39138 SHA-1: cccf7d2d7289b0c9e69c76f72dacd60275cbad36 SHA-256: 19abb31b2447002c9b874d2cc8ff68ef35e8d877bec64238540d4f77a63b6f5d

100 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains embedded JavaScript that is designed to exploit a vulnerability and download a second-stage payload. The ML classifier and generic stage recovery heuristics strongly indicate malicious intent. The recovered JavaScript, while obfuscated, appears to be responsible for fetching and executing further malicious code, likely from an embedded artifact or external source.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 7

Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/mm/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`k1` `d5005e6ee2e649716afeda73fc5624d60ddac2ec2e3497a03f11116991a6a4e7`	pdf-embedded-file	PDF EmbeddedFile object 26 at offset 0x1EC1	1206312 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 8.00, consistent with packed or encrypted content.
`javascript_obj0031_000.js` `f5afe40854b42d8421050c10ad934394b90e4b3c3fc1b1759a2fdb9025ecd23a`	pdf-javascript-stream	PDF /JS object 31 at offset 0x12B202	8096 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 long base64-like blob(s).
`generic_stage_recovery_000.js` `b2c5834fe4a9df54b0698a0fcc300f7ce000b0fcfb7387429fbb910a3f21035f`	deobfuscated-js	generic stage recovery split-literal-normalize from JavaScript object 31 at offset 0x12B202	7640 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.