Malicious PDF — malware analysis report

Static analysis result for SHA-256 599ebc439dac11b9…

MALICIOUS

PDF

29.8 KB
MD5: c6824a21e4f05a3a5a40d4099f475de4 SHA-1: 50a652af9dc6e719b38c4cded167bfe55a018959 SHA-256: 599ebc439dac11b9cf96cc48015cade4e7fd85e778130822a87f34703d2c8a2c
106 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript and a Flash object, indicated by the PDF_JAVASCRIPT, PDF_JS, and PDF_RICHMEDIA heuristics. The unescape() call suggests obfuscation within the JavaScript. The embedded artifacts, 'hJzrcNRhacMbB.swf' and 'javascript_obj0006_000.js', are likely components of a malicious payload delivery mechanism, possibly exploiting vulnerabilities within the PDF reader or the Flash player.

Heuristics 6

  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
hJzrcNRhacMbB.swf
767382813fc770c9716554c3266b22eee1636037ca964af05acf6ff66db4a27d		 pdf-embedded-file PDF EmbeddedFile object 16 at offset 0xBF4 26993 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.
javascript_obj0006_000.js
2febbe5e6f50f3be6c34c0d51b1624ee33439d55f6064145bb08c680552bd9b5		 pdf-javascript-stream PDF /JS object 6 at offset 0xF9 1954 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.