PDF malware analysis — malicious · 5e20d79800a8411e

MALICIOUS

PDF

4.5 KB Authoring application: Vabameuaki

MD5: 781e27c4f5d7fd9d924118d9aac36e63 SHA-1: 301c84624c2dff118be8d8b0538027092202bafa SHA-256: 5e20d79800a8411e31a797c4705248cd3fe5aabf1940475d0e8cf155e6c144f2

86 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript that is obfuscated using string concatenation and XOR operations. The script reconstructs the string 'getpageNth1OA8IsbWord' and 'fromG0DCharCodeWqM2', and uses 'unescape' and 'charCodeAt' functions. The primary function of the script appears to be deobfuscating and executing a second-stage payload, as indicated by the 'ML_NYX_PDF_MALICIOUS' heuristic and the JavaScript eval stager. The overall purpose is likely to deliver a malicious payload to the victim.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER

PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `1ec398366107a5fedd9bcf18a57f32d68d58e87986c8ad1c876f457b209e2152`	pdf-javascript-stream	PDF /JS object 11 at offset 0xCA2	815 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.