PDF malware analysis — malicious · 44ff50a0fc160977

MALICIOUS

PDF

5.3 KB Created: 2010-08-07 09:35:52 Authoring application: Wojifajameru (via 59fe7Jecomoqizeqixovo)

MD5: 6c95034d7506af5d3de408d1d2dfbd7d SHA-1: 6e5319db3f104521b7e1331f2914bbc8ac2f1c35 SHA-256: 44ff50a0fc160977c66fa783b64401ab1b5f7e4db3abbf76afaec7afdfcd691c

136 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including 'PDF_JAVASCRIPT', 'PDF_JS', 'PDF_EMBEDDED_SCRIPT_PAYLOAD', and 'PDF_PAGE_WORD_XOR_EVAL_STAGER'. The embedded script, named 'javascript_obj0011_000.js', is identified as a suspicious artifact. The script's purpose is to act as a stager, likely downloading and executing a second-stage payload, which is a common technique for delivering malware.

Heuristics 5

Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER

PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `1e67d6d2c5d97afa0e6512e1bcf867e23c4d4211ffa93bd8a051e8be9ce5d2e9`	pdf-javascript-stream	PDF /JS object 11 at offset 0xE84	1461 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s). Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.