Malicious PDF — malware analysis report

Static analysis result for SHA-256 48b6d23a22e5d5b0…

MALICIOUS

PDF

718.3 KB Created: 2008-03-03 17:06:20 +08:00 Authoring application: Advanced PDF Repair: http://www.pdf-repair.com
MD5: f5336336147ddd0fd8764ba702217abf SHA-1: a7fc06e97fbc23970d8f0a33922584f80d1f9348 SHA-256: 48b6d23a22e5d5b07b291e5c1583df93d89e61712238d7e3ac3c69e6e0f2ebe9
104 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

This PDF file was flagged as malicious by an ML classifier and contains embedded JavaScript. The JavaScript stream is obfuscated and uses an eval() call, indicating it is likely designed to execute arbitrary code. The presence of embedded JavaScript and the ML classification strongly suggest a malicious intent, possibly to download and execute a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 7

  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.pdf-repair.com
    • http://www.pdf-repair.com)/Producer(Advanced
    • http://www.pdf-repair.com)/ModDate(D:20100406171120+08
    • http://www.w3.org/1999/xhtml
    • http://www.xfa.org/schema/xfa-data/1.0/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://purl.org/dc/elements/1.1/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0038_000.js
d09b3f8531bbd0b9fb1a15b94dac709f7710e3e969ad94204049ce689fed2ee0		 pdf-javascript-stream PDF /JS object 38 at offset 0x151D 18155 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.