Malicious PDF — malware analysis report

Static analysis result for SHA-256 481eaa7aa41dbac4…

MALICIOUS

PDF

434.9 KB Created: ßµH%ºÇI+ÂõŠÎ¶WE‡ ›Ùë`“PÒÓ°Z§MÜtºÏ-—ŠXE©blYÖêÊôeɗöîñÇٌ¾|¹…$×/ðª¯,`oøÈÒÑ Authoring application: ßµH%ºÇI+ÂõŠÎ¶WE‡Qלy½~-˜µQKžŸ9‡ØšºŒ¡ÓË©¨÷t†•
MD5: 9dc791146d625b5073c9c218744085bb SHA-1: 758f8148ff4435bce742c73ae24e9edac81c8e5d SHA-256: 481eaa7aa41dbac4b136d1f80e541846f2ac357e5712173540c7326b1f91a3fb
66 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF file contains embedded JavaScript, which is used to obscure and likely execute a malicious payload. The 'PDF_ENCRYPTED_WITH_JS' heuristic indicates that the PDF's content is encrypted and protected by JavaScript, preventing static analysis and suggesting an attempt to evade detection. The 'PDF_IMAGE_ONLY_LURE' heuristic suggests the PDF may be using images to trick the user into interacting with it, while the presence of JavaScript actions and AcroForm buttons points to an interactive exploit. The JavaScript streams themselves were too small and obfuscated to determine their exact function, but the overall pattern strongly suggests a downloader or exploit delivery mechanism.

Machine Learning

  • Nyx PDF Classifier clean score 0.0104

Heuristics 5

  • Encrypted PDF carries /JS — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JS). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0318_000.js
31143778ba75604ab7316ba85b8c4925377b0f98f6d567569d7851735850e510		 pdf-javascript-stream PDF /JS object 318 at offset 0x69F8B 176 bytes
javascript_obj0314_001.js
5c5fe43ed48ff27d488f3414e6b3d08238849d79b4deaef5e53aab32905c954e		 pdf-javascript-stream PDF /JS object 314 at offset 0x6A155 64 bytes
javascript_obj0312_002.js
5a37aa79a733218004c39bccb91fd73fcd1ba43030be1d02886d6f1bc0842d3a		 pdf-javascript-stream PDF /JS object 312 at offset 0x6A2AB 64 bytes
javascript_obj0310_003.js
4a50f5c8be2f1761cd8fe36b26909e3bfac6652b8d962ae838abe5f4bfdc7fa2		 pdf-javascript-stream PDF /JS object 310 at offset 0x6A401 48 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.