PDF malware analysis — malicious · 4ded550f6352feb5

MALICIOUS

PDF

100.8 KB

MD5: d44f4778baf05979764414379be9d276 SHA-1: f9075369ea7191530bab96e2f975355db719ad72 SHA-256: 4ded550f6352feb536621612c4c6471d1b8e0245b509323739eea065d116d5bd

62 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file exhibits multiple indicators of malicious activity, including embedded JavaScript and embedded files. The presence of obfuscated JavaScript streams, specifically 'stream_005_off00000fe6.js', strongly suggests an attempt to execute malicious code. This script is likely responsible for downloading and executing a secondary payload, a common technique for malware delivery. The embedded nature and obfuscation point towards an attempt to evade detection.

Machine Learning

Nyx PDF Classifier suspicious score 0.3918

Heuristics 8

Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
String.fromCharCode low PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules. (matched inside decoded stream)
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/mm/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xfa/promoted-desc/

Extracted artifacts 9

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0052.bin` `436f018ed920297b56b62d6fc0a0613006e8c253a6a2c2127d8194ed021530b4`	pdf-embedded-file	PDF EmbeddedFile object 52 at offset 0x182AB	162 bytes
`embedded_file_obj0053.bin` `2f47512cf05d02dd359d79b6fc5239b0435b04e804e01ba2be617b1ea7076f54`	pdf-embedded-file	PDF EmbeddedFile object 53 at offset 0x1839C	1379 bytes
`embedded_file_obj0054.bin` `385ecdde90af9ee809c54dc453a00dd04bac5c7f8a7978762cbd98bfb874a40a`	pdf-embedded-file	PDF EmbeddedFile object 54 at offset 0x1863D	18388 bytes
`stream_004_off00000bca.js` `e6103c82f30cd8596a423b7d63ccaa07a26d141c76c630eb1ff65a7e11e57862`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xBCA	2856 bytes
`stream_005_off00000fe6.js` `265b766826bfb8654cd0c67dd5320fc0f8f37695a8175ec345158199f40ac662`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xFE6	247985 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 eval/decoder/string-building token(s).
`stream_006_off000161c4.bin` `984e33597cee6a139b4eb9668deb8ae3fd023cb2f29b1dac2e77dd6be0d9a93d`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x161C4	2893 bytes
`stream_008_off0001783f.js` `529357503ec67b623d2a12816cdeea62bd639f2b4ff4e568b01c96cc3f5bfc6f`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1783F	1363 bytes
`stream_009_off00017a1c.js` `e985b5df65c8c3cf732a9074b575fbc594c1c7f0bccc0994182ec7e5c0f7308a`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x17A1C	902 bytes
`objstm_0058_00.bin` `97cb82a71958e3bfe0941d5ee9b75692a518d3c12344eeec3c7faed828e404d1`	pdf-objstm-decoded	PDF /ObjStm 58 0 obj (inflated)	662 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.