MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1204.002 Malicious File
T1566.001 Spearphishing Attachment
The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT and PDF_JS. The 'POLYGLOT_CHILD_PDF_STATIC_TRIAGE' heuristic suggests a secondary embedded PDF with similar suspicious findings. The presence of 'javascript_obj0040_000.js' as an extracted artifact further supports the use of JavaScript for malicious purposes. This JavaScript is likely used to download and execute a second-stage payload, a common technique for initial access and further infection.
Heuristics 7
-
Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGEA valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
XFA form low PDF_XFAPDF uses XML Forms Architecture — can contain script logic
-
AcroForm button with action trigger low PDF_ACROFORM_BUTTONPDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.datanumen.com/apdfr/
Extracted artifacts 8
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0040_000.jsaedd8a23a1a82c9c9cbaab30091c336f4e1bd9d004c0d085530cf3ee187e2882 |
pdf-javascript-stream | PDF /JS object 40 at offset 0x20DA | 12401 bytes |
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 1 eval/decoder/string-building token(s).
|
|||
stream_001_off00000aef.bin0f910ffeec733940f6ba1ae41dc6770eab5d615c05bccc95197878b62c8dc45f |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xAEF | 2928 bytes |
stream_002_off00000e4d.bin29cf1edfedd4f27f3c450646c5dc2510e6bf9e63eee1cd436ac517a465a2e1bf |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xE4D | 1650 bytes |
stream_003_off000011bc.js672d461752be4a970c8e9721164ce074d252b55d09d46cc09259d2ce4fc09f7f |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x11BC | 1546 bytes |
stream_010_off00005a6c.binfe122a09d8a0444608fdc5a6f4981a2dbd469f5bbfacb4bdd327c28ccc343e13 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x5A6C | 149 bytes |
stream_011_off00005b20.bin4a60a9864cdf7382475d51051a03fdc43b32c31eb508893ccfccece34957f9f1 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x5B20 | 56 bytes |
font_00_cff_off000083e8.binea8f409c7366ed46eeb553aa7b404f04641f482ba88463fbe253da60be5787e5 |
pdf-font-stream | PDF embedded font (cff) at offset 0x83E8 | 1138 bytes |
polyglot_child_pdf_off0003c00f.pdf0eac58e6d9a6fd84d305cbcbabd5d74c93104f86e4ce61533b1a6b70d5f3fa5e |
polyglot-child-pdf | Secondary PDF body inside pdf container at offset 0x3C00F | 461851 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.