MALICIOUS
64
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 Command and Scripting Interpreter: PowerShell
T1204.002 Malicious Link: Malicious File
The PDF file contains embedded JavaScript, identified by the 'PDF_JAVASCRIPT' and 'PDF_JS' heuristics. The 'PDF_METADATA_EVAL_STAGER' heuristic indicates that the JavaScript is used to decode and execute further code, likely from the metadata itself. The use of 'String.fromCharCode' suggests obfuscation to hide the malicious payload. The primary attack pattern involves leveraging JavaScript within the PDF structure to achieve code execution, a common technique for delivering secondary malware.
Heuristics 4
-
PDF metadata JavaScript eval stager high PDF_METADATA_EVAL_STAGERPDF JavaScript reads document metadata fields such as title, subject, or producer, decodes character data with parseInt/String.fromCharCode style helpers, and evals the recovered stage. This is a high-signal exploit-kit staging pattern.
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
String.fromCharCode low PDF_FROMCHARCODEString.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0001_000.js6a04dbb6bbf6a9337548d1e535c203f800df6a4a46339ec3f26ecf12fea9beae |
pdf-javascript-stream | PDF /JS object 1 at offset 0x6156 | 452 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.