Malicious PDF — malware analysis report

Static analysis result for SHA-256 4cbd0cca60fb26f3…

MALICIOUS

PDF

8.0 KB Created: 2010-06-29 10:14:47 +08:00 Authoring application: Acrobat 编辑器 8.0 (via Adobe Acrobat 8.0)
MD5: 096f57b6dd09120cd911d20accd35908 SHA-1: 86c08a9894e63f5461bf4d9ef0702933f58750f3 SHA-256: 4cbd0cca60fb26f334d5634aaeaf2dcc722018decc4c89fba8fbd2807e7df92f
106 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript streams that are heavily obfuscated, indicated by the 'unescape()' calls and 'Hex escape obfuscation' heuristic. The ML classifier strongly suggests malicious intent. The JavaScript is likely designed to exploit a vulnerability in the PDF reader, potentially leading to arbitrary code execution. No specific malware family could be identified due to the obfuscation.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0018_000.js
7d95b5abdd074950383959db145483db1f3404cd081ec4f51dd1252155880488		 pdf-javascript-stream PDF /JS object 18 at offset 0x10EF 2119 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s). Carved artifact contains 1 long hex-escaped blob(s).
javascript_obj0018_001.js
d6e24f998ef208388b326a6b745d7734d5c236b9cac77f499d9124c03b41869a		 pdf-javascript-stream PDF /JS object 18 at offset 0x1111 3853 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s). Carved artifact contains 1 long hex-escaped blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.