PDF malware analysis — malicious · 213ed1f188ea30ac

MALICIOUS

PDF

30.9 KB Authoring application: PyPDF2

MD5: 1f88f1ccbc43c9fa45c506113b483325 SHA-1: fb19131bebf9ed4a1973d1f16890a54e17e4b444 SHA-256: 213ed1f188ea30acebf7ecdd157dee372ab97f6acd27995f23944e3412e7afdb

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The presence of a high-severity PDF_EVAL heuristic and ML_NYX_PDF_MALICIOUS classification strongly suggests malicious intent. The extracted JavaScript, though obfuscated, likely performs actions such as downloading and executing a second-stage payload, as suggested by the 'Script execution terms' and 'Script obfuscation indicators' in the static triage. The specific obfuscated string '034049018037064071066045040063047120038035054002058023070014053044126012051102026002002123031016008' is part of this malicious script.

Machine Learning

Nyx PDF Classifier malicious score 0.9834

Heuristics 4

eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0010_000.js` `e0db8f7ba48a7c02ac8d58add2d959ddb593272cd11f60c91f462b857979a07a`	pdf-javascript-stream	PDF /JS object 10 at offset 0x4AE	6785 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s). Carved artifact contains 3 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.