PDF malware analysis — malicious · 3c38d2ccdfe9f08c

MALICIOUS

PDF

100.2 KB

MD5: ced9c834488c168d43344c0d9a5ea352 SHA-1: 6d226d7325643525e38f5177fb21570e966437ca SHA-256: 3c38d2ccdfe9f08c0a8f121cfeb5c77d46d40bbd12e2439f389d268d3a8ac5b7

348 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1218.005 System Binary Proxy Execution: Mshta

The PDF file contains a launch action that targets mshta.exe with a JavaScript URI. This script uses String.fromCharCode and ActiveXObject to construct and execute a command via 'wscript.shell'. The reconstructed command is 'javascript:e=String.fromCharCode;new ActiveXObject(\'wscript.shell\' \'CMD.exe /c FOR /F yusebackqdelims=y %i IN (`dir /b *.PDF` /y/g,e(34 1 \

Heuristics 8

/Launch action target: Mshta critical PDF_LAUNCH_COMMAND

PDF /Launch action specifies an executable target with parameters '"javascript:e=String.fromCharCode;new ActiveXObject('wscript.shell'' — references a known-dangerous executable (cmd, PowerShell, etc.).
/Launch action targets mshta.exe (LOLBIN) critical PDF_LAUNCH_MSHTA

PDF contains a /Launch action whose /F parameter names mshta — Microsoft's legacy HTML Application host, used as a LOLBIN to run inline JScript/VBScript from a /P parameter (typically a `javascript:` URL). MITRE ATT&CK T1218.005.
/Launch /P parameter is a javascript: URL critical PDF_LAUNCH_JS_PROTOCOL

PDF /Launch action passes a `javascript:` URL as the /P parameter — mshta interprets this as JScript when used as the launched handler, giving inline script execution without a separate payload file. MITRE ATT&CK T1218.005 + T1059.005.
Launch action high PDF_LAUNCH

PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND

Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
String.fromCharCode low PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_pdf_script_00000398.bin` `0a4af2107349926725d11e7e467dc99fc3f729cf728b36005d7f8bf7c2e64e28`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x398	67 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s). Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.