MALICIOUS
86
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1204.002 Malicious File
The PDF contains embedded JavaScript, identified by heuristics as a 'Page-word XOR JavaScript eval stager'. This stager is designed to execute arbitrary JavaScript code, likely to exploit a vulnerability within the PDF viewer. The ML classifier strongly indicates malicious intent. No specific family could be identified, but the technique suggests a downloader or exploit delivery mechanism.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGERPDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0010_000.js7ad1ee8cba7784f1a95b635244a4165fad123a151fe73c8fc9a0d61755caba74 |
pdf-javascript-stream | PDF /JS object 10 at offset 0xCAB | 874 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.