Malicious PDF — malware analysis report

Static analysis result for SHA-256 1f1a3e5967202f40…

MALICIOUS

PDF

35.9 KB
MD5: 2fd7c020299402fe40eb6a2ee96376e5 SHA-1: 08527bfa1a929cab46fbe94e12c8a64730407bc3 SHA-256: 1f1a3e5967202f401fb783fefb1534e9a32bba1daef9777d76928e75e5184c8f
66 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1566.002 Spearphishing Attachment

The PDF was flagged by an ML classifier with high confidence as malicious. It contains an embedded script payload within a PDF stream, indicating an attempt to execute malicious code. Several embedded files were also extracted, suggesting a multi-stage attack. The specific nature of the script's execution is not fully discernible due to its obfuscated or truncated nature, but its presence strongly suggests the PDF is a delivery mechanism for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/1.0/
    • http://www.xfa.org/schema/xfa-template/2.5/
    • http://www.xfa.org/schema/xfa-data/1.0/

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0008.bin
0a2224c4023b216235b61c3fc4dd17bbfac1ab23a545687f51b97604cf654712		 pdf-embedded-file PDF EmbeddedFile object 8 at offset 0xC6 46 bytes
embedded_file_obj0009.bin
60e9cdf123591c1b6901a80b9071651ea8be44f8f5ff1ba3ac40d4bea4949984		 pdf-embedded-file PDF EmbeddedFile object 9 at offset 0x138 674 bytes
embedded_file_obj0010.bin
aad3c5a80b6938192e67db3c290ab516ef65ec1f018210051ece6db255ac4cd9		 pdf-embedded-file PDF EmbeddedFile object 10 at offset 0x41F 153 bytes
embedded_file_obj0011.bin
919311c4f3a5f8d631c55fffd296ccf550fdb5d7b4350edc85e72b711cfc5686		 pdf-embedded-file PDF EmbeddedFile object 11 at offset 0x4FD 437 bytes
embedded_file_obj0012.bin
072090be5ea6c4a216543a1d4332d27d322264f3038bbd986db2a09048143a1c		 pdf-embedded-file PDF EmbeddedFile object 12 at offset 0x6F7 181 bytes
embedded_file_obj0014.bin
b941416066e8ff6a9a27fb4bd1d009de503d07ce19e4aff67f6791a927facbe1		 pdf-embedded-file PDF EmbeddedFile object 14 at offset 0x7F2 34020 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.