Malicious PDF — malware analysis report

Static analysis result for SHA-256 3b3fc7ccf870f381…

MALICIOUS

PDF

46.1 KB
MD5: 3825898bc3c57b34129362b69b01ed80 SHA-1: 144353445339483cbc09d052ced4c81ec806783e SHA-256: 3b3fc7ccf870f3815f43d804b418c7f0bd165de58d481cd85c3eac6328be8fad
122 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

This PDF document was flagged as malicious by an ML classifier and exhibits several high-severity heuristic firings. Notably, it is encrypted and contains JavaScript, indicating an attempt to hide its payload from static analysis. The presence of JavaScript actions and embedded JS streams, combined with ASCIIHexDecode filters, strongly suggests the document is designed to download and execute a second-stage payload. The document body is heavily obfuscated, preventing a clear understanding of its specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 6

  • Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic