PDF malware analysis — malicious · 3779f1b904ee4cf4

MALICIOUS

PDF

84.7 KB Authoring application: Aspose Pty Ltd. (via Aspose.PDF for .NET 23.4.0)

MD5: cfab7a2f5302b8fcdd98159c3c892404 SHA-1: 18e9e6d893bab03d9b1a47951c9d408a31c59ba4 SHA-256: 3779f1b904ee4cf41f4a266505490682559d09337deb30a2cc08793c2e69385c

68 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF contains embedded JavaScript, indicated by the PDF_EMBEDDED_SCRIPT_PAYLOAD heuristic. The extracted JavaScript files (stream_001_off00000141.js and stream_002_off000003ef.js) are likely responsible for downloading and executing a secondary payload. The XFA form heuristic also suggests a complex document structure often used to host malicious content.

Machine Learning

Nyx PDF Classifier clean score 0.0552

Heuristics 4

Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic (matched inside decoded stream)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.w3.org/1999/02/22-rdf-syntax-ns#

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_001_off00000141.js` `fea4002702423911713200c3eda4d87ed264b363caa20cd9e5be706d0a083110`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x141	1249 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s).
`stream_002_off000003ef.js` `1ea4c85e235fa5beccc34652317477b45392bc9a9f95fafd3fc1f6da238fa571`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x3EF	658 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
`stream_003_off000005cc.bin` `5545f8b5f89e54e1a24d2ae1350106cd79ad207c0945c87de5737df3bd7ed837`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x5CC	129 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.