PDF malware analysis — malicious · 4cc69264d9f683ba

MALICIOUS

PDF

5.5 KB

MD5: 6649ec0d754255adcc49c162a3f67130 SHA-1: 8ae2b1bc00a858d7bdd0467d60ba5ba823ff2fe7 SHA-256: 4cc69264d9f683bab1feb26cf55161e6929afffa18b2b1a741cc0ab0ef1fbab6

156 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF document was flagged as malicious by an ML classifier and contained embedded JavaScript. The JavaScript stream was partially recovered, indicating it likely attempts to exploit vulnerabilities or download further malicious content. However, due to obfuscation and incomplete scanning, the exact functionality and payload could not be fully determined. The presence of 'PDF_GENERIC_STAGE_RECOVERY' suggests a multi-stage attack.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 6

Correlated malicious PDF JavaScript signals critical PDF_CORRELATED_MALICIOUS_JS

PDF JavaScript or auto-action content is corroborated by exploit staging, ML, or suspicious extracted-artifact findings. This correlation promotes old exploit-kit PDFs that otherwise remain in the suspicious band because each individual signal is intentionally weighted conservatively.
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
syncAnnotScan annotation-staging primitive low PDF_FOXIT_SYNCANNOTSCAN

PDF JavaScript calls syncAnnotScan() — a no-op annotation-enumeration primitive used by exploit-kit JavaScript to stage payload reads from annotation /Subject fields before eval(). Not a vulnerable sink itself; rarely seen in legitimate PDFs. (matched in decompressed stream)
Scan did not complete info SCAN_INCOMPLETE

PDF JavaScript deobfuscation worker failed (worker exit 1); obfuscated JavaScript was not fully inspected.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0005_000.js` `a3319192cac6d4dc4eeb6af2d736b0ffec979b23116a003bc7c23382761c32a5`	pdf-javascript-stream	PDF /JS object 5 at offset 0x148	733 bytes
`deobfuscated.js` `cca45dbcef1f1d15e41f371c7d4e0b1824fc6969b2424fb22167d4abaaf238f4`	deobfuscated-js	PDF JavaScript deobfuscation pass	20967 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.