Malicious PDF — malware analysis report

Static analysis result for SHA-256 35c04d3554044536…

MALICIOUS

PDF

40.0 KB Created: eÂ*³aHéÙ¿/6ò+ã”Ó  ¨× Authoring application: ßÀ,##َj3aÀi (via ßÓ,##ًk3mÀ~ÈÖ)
MD5: a0e5748475b03ef62822afae75d67a91 SHA-1: 83a9cdf3edee49d294425e2b659484733eba6286 SHA-256: 35c04d355404453653ff6cd3f4e96a14d27d60a2753aa0454b5c7aefb74b6a73
64 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, which is used to encrypt the document and hide the malicious payload. The heuristic 'PDF_ENCRYPTED_WITH_JS' indicates that the JavaScript is responsible for obfuscating the content. No document body text was available for analysis. The embedded JavaScript file 'javascript_obj0009_000.js' is the primary indicator of malicious activity, likely serving to download and execute a second-stage payload.

Heuristics 4

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0009_000.js
79a6b84a4918c678ebd01d60298e49209a05bc74c1fa52f3030232b2a70b5c9c		 pdf-javascript-stream PDF /JS object 9 at offset 0x3C6 603 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.