Malicious PDF — malware analysis report

Static analysis result for SHA-256 37574d6881aaa22d…

MALICIOUS

PDF

28.5 KB
MD5: c40311b3ceef8666c8b9bdf06765cdff SHA-1: 4e53977dd90374f709016927e312d87e1ad1a52e SHA-256: 37574d6881aaa22d06a7ad3c377c8d04c65cf93abdbb7ea3b0eacdf9c1a9254c
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link T1059.001 PowerShell T1071.001 Web Protocols

The PDF is encrypted and contains JavaScript, indicating an attempt to hide malicious content and evade static analysis. The presence of a UNC path (`\\192.168.1.1\share\test.txt`) suggests an attempt at NTLM credential theft, potentially related to CVE-2018-4993. The document is also identified as an image-only lure, typical of phishing campaigns designed to trick users into interacting with malicious content.

Heuristics 5

  • UNC path in PDF — possible NTLM credential theft (CVE-2018-4993/CVE-2019-7089) high CVE likely CVE_2018_4993
    PDF contains a UNC path (\\server\share) alongside action triggers — when a vulnerable viewer resolves this path, Windows may send NTLM credentials to the remote host as the matching PDF action is processed
  • Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 2 image(s), only 0 text block(s), carries a click-outward action, and is only 28 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0017_000.js
a101776aad7b096df7ad1bd6d4c62666d1165e0f69a4fc53f232f9fe6aad9efa		 pdf-javascript-stream PDF /JS object 17 at offset 0x1252 85 bytes
javascript_obj0018_001.js
6b3028acdd9af96239847bb6f1c62c224fc45ea284714ed33cb18f191ff89a16		 pdf-javascript-stream PDF /JS object 18 at offset 0x142D 85 bytes
javascript_obj0019_002.js
4e0c2e7f140172a44410b3c94bd6f452bdf829b05570d36b09811e453257fd19		 pdf-javascript-stream PDF /JS object 19 at offset 0x15FB 85 bytes
javascript_obj0020_003.js
77b8753d08bf39db5e3a8856997447590b16a12bac5a310b93359646f8909b81		 pdf-javascript-stream PDF /JS object 20 at offset 0x17E5 85 bytes
javascript_obj0021_004.js
95d6eaeb643aeee61089670c01f0e7e9efd80d7019b09928c24aeec19952f90b		 pdf-javascript-stream PDF /JS object 21 at offset 0x19AC 85 bytes
javascript_obj0022_005.js
114f589d32c686a1bde7caf9d985beaf4561e5762b6dcce07f0f6d7a4a6c7497		 pdf-javascript-stream PDF /JS object 22 at offset 0x1B89 85 bytes
javascript_obj0023_006.js
2259050e2d955f7d42692b7c3ef24128c3e9f1922a432542379b072120709254		 pdf-javascript-stream PDF /JS object 23 at offset 0x1D4B 85 bytes
javascript_obj0024_007.js
8a2384cbdeb484c026f001af9c4e6a17379ce92db6071413145778b31c39e5bf		 pdf-javascript-stream PDF /JS object 24 at offset 0x1F21 85 bytes
javascript_obj0025_008.js
9512fa81f7c5a4d291679fdd327a5c8178a303b665e7c22e89000cc83cf915fe		 pdf-javascript-stream PDF /JS object 25 at offset 0x20F1 85 bytes
javascript_obj0026_009.js
da7e89f32800bba5ed8624bcf806462c4782dc1fa966a7c7fc09f7c051886879		 pdf-javascript-stream PDF /JS object 26 at offset 0x22C0 85 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.