PDF malware analysis — malicious · 4b025e6bd80a4819

MALICIOUS

PDF

37.5 KB Created: 2009-09-15 20:20:11 Authoring application: Scribus 1.3.3.13 (via Scribus PDF Library 1.3.3.13)

MD5: a0650e065019b0c8572030234773742d SHA-1: 0a2b81f23fe5a261f9d93f83cdb79050037b1457 SHA-256: 4b025e6bd80a48195eabb64dfa8155e3aeb9f3a008480ff6da96b038b6141ca4

108 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by multiple PDF_JAVASCRIPT and PDF_JS heuristic firings. The ML classifier and ClamAV also flagged the file as malicious. The presence of JavaScript streams suggests the file is designed to execute code upon opening, likely to download and execute a secondary payload. No specific family could be identified, but the delivery mechanism is consistent with a malicious document lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9972

Heuristics 4

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE

PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0017_000.js` `2cf0862608e8b23515a657c1600e9d6894f969f4f0c97c0e23018a793f4d0487`	pdf-javascript-stream	PDF /JS object 17 at offset 0x4AE8	24009 bytes
`javascript_obj0018_001.js` `b5cc54f6ad95929536151b08f94284982d025919e5b72267cf29cb8e63ebe5a1`	pdf-javascript-stream	PDF /JS object 18 at offset 0x8DD1	172 bytes
`javascript_obj0019_002.js` `66910f9e0cdd7087a5f230869c97992ea928d027e184de75c1335105d4a982a6`	pdf-javascript-stream	PDF /JS object 19 at offset 0x8EA0	344 bytes
`javascript_obj0020_003.js` `a8c5b7e5554349b18a9b0cd5bf490ccd93215a77a19cf0089ad8c264785dadd5`	pdf-javascript-stream	PDF /JS object 20 at offset 0x8FE4	164 bytes
`javascript_obj0021_004.js` `74180bd212683b7fa9cd839323f957e5aea163026182a7340f894393ee5c7f3a`	pdf-javascript-stream	PDF /JS object 21 at offset 0x90A7	212 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.