Malicious PDF — malware analysis report

Static analysis result for SHA-256 505c53b99557b643…

MALICIOUS

PDF

32.5 KB Created: ý÷­‘¨Y!IÆ 3𠤌GH\E¼àx Authoring application: G2Ÿâ™Orx‘=vÀS‘Î (via G2Ÿñ™Oxx”=wÀ_‘Ùl)
MD5: b0ae03364ad9a7fea12e056025a60d9a SHA-1: 9541f53f51d5788921e83ad0abcd12da6c1b9a4e SHA-256: 505c53b99557b64375f3b08606c64b69f6c39f01428a475acb1368d4ef365c3f
64 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including 'PDF_JAVASCRIPT' and 'PDF_JS'. The 'PDF_ENCRYPTED_WITH_JS' rule suggests the JavaScript is used to obscure the payload, making static analysis difficult. The presence of JavaScript within a PDF commonly indicates an attempt to deliver a malicious payload, often through obfuscation or by triggering further actions upon opening. No specific family could be identified due to the obfuscation.

Heuristics 4

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0009_000.js
58b40b6d7e40b2106dd80badbc0b9f5dc08693a0a9c726047f0ed36b0044a749		 pdf-javascript-stream PDF /JS object 9 at offset 0x3B7 30672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.