PDF malware analysis — malicious · 1eb4c3a61442fb93

MALICIOUS

PDF

31.4 KB Created: ¾ )'S+&oþÂ³^].X¨ Authoring application: ß:lk.Åg 8ÎÄ (via ß:k.Ïf 4ÎÓéñ)

MD5: 5ecff7b1c1aea53fc0c2466ac903aa85 SHA-1: bf70a7451172a2e7058815d92e2d4d5063b7bfa3 SHA-256: 1eb4c3a61442fb938eed7527805f5e4f4da8111e98fc9b74989c4c7d1811d3cd

64 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The PDF_ENCRYPTED_WITH_JS heuristic suggests that the JavaScript is used to obscure the malicious payload, which is a common technique for malware delivery. The presence of JavaScript actions and optional content groups further supports the malicious intent. The primary mechanism appears to be the execution of hidden JavaScript, likely to download and execute a second-stage payload.

Heuristics 4

Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS

PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0009_000.js` `64af07d79de0904c06856e8c3989b8dc6178bbbbb66de9842a5816b7bbe7dc22`	pdf-javascript-stream	PDF /JS object 9 at offset 0x3C5	29544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.