PDF malware analysis — malicious · 53680bd2075dc9ec

MALICIOUS

PDF

10.9 KB First seen: 2021-01-11

MD5: 467e80d2533ca7ec2d5320bad46e5016 SHA-1: 3326de1265a54c48adc0a957a46044fcc671330e SHA-256: 53680bd2075dc9ecbda505ade2e6ac7f038ddd4fbc37e39a5c884142718aa5cf

166 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF sample contains obfuscated JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT, PDF_JS, and PDF_OBFUSCATED_NAME_OBJECT. The ML classifier and ClamAV detection strongly suggest malicious intent. The embedded JavaScript is likely used to exploit a vulnerability and download a secondary payload, a common technique for initial execution and further infection.

Machine Learning

Nyx PDF Classifier malicious score 0.9987

Heuristics 4

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECT

A PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
JavaScript action low 1 related finding PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Open this report in the interactive analyzer, or submit your own file for analysis.