PDF malware analysis — malicious · 331f9e574e633593

MALICIOUS

PDF

25.1 KB Created: 2011-72-51 03:25:00 Authoring application: String.fromCharCode

MD5: a6042e588df644b5cfd4c688819017be SHA-1: b097a0844765df9201aa2a76860800fe7f759203 SHA-256: 331f9e574e633593d2fab2b09d05e3bec59868c17e292a1068b8ce27a6e68d3f

94 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript within its metadata, triggered by the `String.fromCharCode` function. This JavaScript is identified as a stager, indicating its purpose is to download and execute a secondary payload. The ML classifier strongly flags this PDF as malicious. Due to the obfuscated nature of the JavaScript and lack of specific indicators, the family is unknown, but the attack pattern is consistent with a malicious document dropper.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF metadata JavaScript eval stager high PDF_METADATA_EVAL_STAGER

PDF JavaScript reads document metadata fields such as title, subject, or producer, decodes character data with parseInt/String.fromCharCode style helpers, and evals the recovered stage. This is a high-signal exploit-kit staging pattern.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
String.fromCharCode low PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0001_000.js` `9a884c4b289b99eeec6694f5e657dc39259cf9660de2e7e9f00daae16b8d2316`	pdf-javascript-stream	PDF /JS object 1 at offset 0x619C	527 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.