PDF / .PHP malware analysis — malicious · 4d6e88eef650c822

MALICIOUS

PDF / .PHP

9.7 KB Created: 2009-02-19 14:45:49 -02:00 Authoring application: Writer (via OpenOffice.org 3.0)

MD5: ecf7a1406befe0d80f424ff6e1e83199 SHA-1: 67d205e15811368ee19d60ae46a4b3bff507ec25 SHA-256: 4d6e88eef650c822fddd5e2461404717f5ee40a74fc08d674e3e8f7ca9a05b64

128 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

This PDF file exhibits multiple high-severity heuristic firings related to JavaScript execution and launching external actions. The presence of an embedded JavaScript stream and an eval() call strongly suggests an attempt to execute arbitrary code. The ML classifier also flagged this PDF as malicious with high confidence. While the exact payload is not clear due to obfuscation, the techniques indicate a malicious intent to exploit the PDF viewer.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 5

Launch action high PDF_LAUNCH

PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0027_000.js` `b8e6996bb6a2304c3ae512ff40d3e1dc4d59fec3adb43acb3bebb1f427427479`	pdf-javascript-stream	PDF /JS object 27 at offset 0x1C1B	3315 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.