PDF malware analysis — malicious · 3038f3f158ebad0f

MALICIOUS

PDF

2.6 KB

MD5: 4ef52099f8e6608e24bd127e61ccac19 SHA-1: 7bc962d2808c750a1341b881aa9646ec2fb30806 SHA-256: 3038f3f158ebad0f2ba7dfecca2837e438b878608337e0af73ed1323295afaf2

156 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF contains embedded and obfuscated JavaScript, indicated by multiple heuristic firings including 'PDF_JAVASCRIPT', 'PDF_JS', and 'PDF_GENERIC_STAGE_RECOVERY'. The ML classifier also strongly flagged the PDF as malicious. The JavaScript appears to be a generic exploit stage, but its exact function could not be fully determined due to deobfuscation failures. The reconstructed JavaScript file names are included as IOCs.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 6

Correlated malicious PDF JavaScript signals critical PDF_CORRELATED_MALICIOUS_JS

PDF JavaScript or auto-action content is corroborated by exploit staging, ML, or suspicious extracted-artifact findings. This correlation promotes old exploit-kit PDFs that otherwise remain in the suspicious band because each individual signal is intentionally weighted conservatively.
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
syncAnnotScan annotation-staging primitive low PDF_FOXIT_SYNCANNOTSCAN

PDF JavaScript calls syncAnnotScan() — a no-op annotation-enumeration primitive used by exploit-kit JavaScript to stage payload reads from annotation /Subject fields before eval(). Not a vulnerable sink itself; rarely seen in legitimate PDFs. (matched in decompressed stream)
Scan did not complete info SCAN_INCOMPLETE

PDF JavaScript deobfuscation worker failed (worker exit 1); obfuscated JavaScript was not fully inspected.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0005_000.js` `a3319192cac6d4dc4eeb6af2d736b0ffec979b23116a003bc7c23382761c32a5`	pdf-javascript-stream	PDF /JS object 5 at offset 0x148	733 bytes
`deobfuscated.js` `424c864a136e8388d8362edaa8374a3efff4c3d49b162d7bd23905fa76a0f6ed`	deobfuscated-js	PDF JavaScript deobfuscation pass	3416 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.