PDF malware analysis — malicious · 1dc6ffc5cbf60659

MALICIOUS

PDF

322.7 KB

MD5: 443308ae5543877789153a4922b8fba7 SHA-1: c25d8e21090bd226171bd7fc17ee0d0703e078da SHA-256: 1dc6ffc5cbf60659a9b06be21b3397bed60881ad9888920d709bef7babedec95

94 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

This PDF file was flagged as malicious by an ML classifier and contains multiple JavaScript-related heuristics, including an eval() call. The embedded JavaScript streams, particularly the large decompressed one, are highly suspicious and likely responsible for downloading and executing a secondary payload. The exact functionality of the script is obscured, but its presence and the eval() call strongly indicate malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 4

eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0001_000.js` `17a4bb5ff0cf21511ba4b0451b455174dd57deb1427385b26eb2296ec48ec9cb`	pdf-javascript-stream	PDF /JS object 1 at offset 0xA	49 bytes
`stream_000_off0004f08a.js` `dcefc16710d335e69f60cdd8a0e174d43939d02eaa8dd4c6d7ce4ca63f06495b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4F08A	289498 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.