PDF malware analysis — malicious · 450c169045e837a2

MALICIOUS

PDF

14.6 KB Created: N]]7ëÎ¬c×OFã][(

MD5: 3259a3c5d4c75d39eded75d95531f769 SHA-1: 9d579faa69f632f0aea6eaae006dfb11a8c86386 SHA-256: 450c169045e837a2b5bdc610e3c5f9bf50803b48100d9f53f4668c00c3312e01

86 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

The PDF contains embedded JavaScript, which is used to obscure and encrypt the main payload. This technique, combined with the ML classifier's high confidence, indicates a malicious intent to hide and deliver a secondary stage. The specific JavaScript content was not fully analyzed due to obfuscation, but its presence within an encrypted PDF points to an attempt to bypass static analysis and deliver a malicious payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9982

Heuristics 3

Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS

PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0260_000.js` `bf745a34dda2c28199ee4c3e833f67d0d2c9ec2a2f9fcb44ab42a1e767acd0dd`	pdf-javascript-stream	PDF /JS object 260 at offset 0x2358	872 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.