Malicious PDF — malware analysis report

Static analysis result for SHA-256 2027fafb396d97e2…

MALICIOUS

PDF

31.4 KB Created: 6Æ ^I»\½ÿÿ,¯+™Ï ãu_æiw Authoring application: Œ-xùlî,­Ïks¬‰ (via Œ>xùlä,¨Ïj¬ž"¡)
MD5: 01157df8ee456125cea678a6c14a9a35 SHA-1: 5d9f63fc7088baad6d94dbb42367bbae33e982e9 SHA-256: 2027fafb396d97e2e48716cb2716cc4a1bbbf0b1fbf2966360f33727b9edb88d
64 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

The PDF file is encrypted and contains embedded JavaScript, indicating an attempt to hide malicious content from static analysis. The heuristics suggest the JavaScript is used to bypass security measures and deliver a payload. The large size of the embedded JavaScript file (29540 bytes) further supports this, as it likely contains obfuscated code designed to download and execute further stages. The document body is unreadable, providing no direct clues to the lure.

Heuristics 4

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0009_000.js
c87fec2852d81578b6a1cd4f0bbdf632c1e14e2a4f3d8b6efabeca81dc224fe4		 pdf-javascript-stream PDF /JS object 9 at offset 0x3C5 29540 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.