PDF malware analysis — malicious · 1c0dcf0e6a397023

MALICIOUS

PDF

25.2 KB Created: 2011-72-51 03:25:00 Authoring application: String.fromCharCode

MD5: 89057ef35bb0e69ce7624887aabee56f SHA-1: 5a6f26d067fa3f237cbd766a295786e4c32d7131 SHA-256: 1c0dcf0e6a39702302e911a8f6c27be258bc202bd52e6bb647634075a0cc9b25

64 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains embedded JavaScript, specifically identified as a 'PDF metadata JavaScript eval stager'. The use of 'String.fromCharCode' and JavaScript actions within the PDF metadata strongly suggests an attempt to obfuscate and execute malicious code. The primary technique observed is the execution of JavaScript, likely to download and run a secondary payload.

Heuristics 4

PDF metadata JavaScript eval stager high PDF_METADATA_EVAL_STAGER

PDF JavaScript reads document metadata fields such as title, subject, or producer, decodes character data with parseInt/String.fromCharCode style helpers, and evals the recovered stage. This is a high-signal exploit-kit staging pattern.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
String.fromCharCode low PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0001_000.js` `be0d5378a80bc4d6c43b977926ab4898a85b6847379b71b9c5e54c45f866c8ad`	pdf-javascript-stream	PDF /JS object 1 at offset 0x61CA	532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.