PDF malware analysis — malicious · 2d28fc3bbc15fe46

MALICIOUS

PDF

895.8 KB Created: ÇHHêºb»NõÒÛMI!Ø¥D7Bð¸h/³txVÿK ¢Eên=J Authoring application: ÎöÁ%Lj, þcãúiVË6<7qú:Î!,}¤kÜÄþ5PøÆÜÀÝ! (via -ñz"¦@3¯Jmó'wÛUàü @!%ô[¯ÿÒ ÒEJOÜÆ¬²æ9^Ò¹{Å Kæj}UÏ)

MD5: aad57dd24f21ff9f5041c2b7942e8e73 SHA-1: f745a9a09c56fa8b2b4f975f30b36b978175d772 SHA-256: 2d28fc3bbc15fe46c45bde889fc2ce9184273dd838afc9a5d67a50b7331d3885

96 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

This PDF file was flagged as malicious by an ML classifier and exhibits high-confidence heuristics for JavaScript-based encryption and embedded JavaScript streams. The presence of embedded JavaScript suggests an attempt to obfuscate malicious content and potentially download a second-stage payload. The document body is unreadable, further supporting the idea that the malicious functionality is hidden within the script.

Machine Learning

Nyx PDF Classifier malicious score 0.6827

Heuristics 5

Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS

PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE

PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0172_000.js` `6d6c0d2e5cda43cf399f7abd9fbcb77f03d45077303eba89844b4a5b5e563fe3`	pdf-javascript-stream	PDF /JS object 172 at offset 0xDE97E	608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.