PDF malware analysis — malicious · 50f43327b6a844cc

MALICIOUS

PDF

26.1 KB Created: 2011-01-18 15:19:15 +02:00 Authoring application: Direct Loan Promissory Note (via mPDF 5.0)

MD5: e4e64194cd6e0455e3414f61fd375ed1 SHA-1: 3502c6993cc6e07d22c3e57684f883634510f127 SHA-256: 50f43327b6a844cca101ba20d9f1b9b7087ac39a6d8e410120f87d4e5aa18271

150 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment

The PDF contains obfuscated JavaScript that utilizes an unescape function and a getURL redirector. This script is designed to navigate the user to 'http://searchglobalsite.com/in.cgi?11', which is a known malicious domain. The ML classifier strongly indicates maliciousness, and the obfuscated JavaScript points to an attempt to conceal malicious activity, likely for downloading further malware or conducting phishing.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 6

unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits
Obfuscated document JavaScript getURL redirector high PDF_JS_OBFUSCATED_GETURL_REDIRECTOR

PDF document-level JavaScript automatically calls getURL() on an HTTP(S) destination hidden behind percent escapes. The decoded path is a redirector-style endpoint such as /in.cgi or /go.php. This is malicious routing behavior rather than a PDF parser CVE.
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser exited 1. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0020_000.js` `357d06d70777f397a54fd04180a5ee36f36a8ec5c7cbbafdfab41f20901b25ac`	pdf-javascript-stream	PDF /JS object 20 at offset 0x6116	136 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).
`javascript_obj0020_001.js` `607a0753f2d28ea7a383d2e729ee9a1eeb69db22eafb74fa3e1d444ae047c123`	pdf-javascript-stream	PDF /JS object 20 at offset 0x6116	134 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.