PDF malware analysis — malicious · 46db15eb4a59d4ce

MALICIOUS

PDF

158.3 KB

MD5: 4cbf6745cae98ebf27cad8e6dac6f08f SHA-1: dac1b7f27e109221abb7a7a22003583f67335fe4 SHA-256: 46db15eb4a59d4cef6faf0a57ef9f05d15ab9105df00b842f34c28eb7388623d

244 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains embedded JavaScript, flagged as malicious by multiple heuristics including ML classification and exploit cluster detection. The JavaScript is likely responsible for exploiting a vulnerability within the PDF reader, potentially leading to the download and execution of a second-stage payload. While the exact payload mechanism is obscured and the scan was incomplete, the presence of exploit-related signals strongly indicates malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 10

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
Correlated malicious PDF JavaScript signals critical PDF_CORRELATED_MALICIOUS_JS

PDF JavaScript or auto-action content is corroborated by exploit staging, ML, or suspicious extracted-artifact findings. This correlation promotes old exploit-kit PDFs that otherwise remain in the suspicious band because each individual signal is intentionally weighted conservatively.
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
String.fromCharCode low PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.
Scan did not complete info SCAN_INCOMPLETE

PDF JavaScript deobfuscation worker failed (worker exit 1); obfuscated JavaScript was not fully inspected.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ns.adobe.com/xdp/
- http://www.xfa.org/schema/xci/2.6/
- http://www.xfa.org/schema/xfa-template/2.6/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0017_000.js` `00d83f0df12dd0145d49c2412a9ed675e811ac74df112e5d8f8ec75f6ce39fa6`	pdf-javascript-stream	PDF /JS object 17 at offset 0x262F8	4690 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
`javascript_obj0013_001.js` `4fcb53ff79cf0b0954e072193d18fac9274db915419fc585b1d19746b0e345f3`	pdf-javascript-stream	PDF /JS object 13 at offset 0x25C16	1148 bytes
`acroform_b64_00.js` `2dcc302789541914f37753c067c2c4ea2237a5b048127e1f3f24d5698bb1be31`	deobfuscated-js	PDF AcroForm base64 (raw) at offset 0x266FD	2803 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 eval/decoder/string-building token(s).
`deobfuscated.js` `b7b1d50fa87863e0286c1f5ecd91355ef679c7b02a5860019f694a69a9466659`	deobfuscated-js	PDF JavaScript deobfuscation pass	727949 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 10 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.