PDF malware analysis — malicious · 5f3cb40a72322b27

MALICIOUS

PDF

42.6 KB Created: 025Î007k02126\*Kr027G +p.à026¸4¿ Authoring application: 020G4CkÉ'(023>L006±& (via 020Z9D*üd037t030+WT©)

MD5: fcf6dda21c845056656902343feba0b1 SHA-1: b2b224b9bee2959ce701d73294ca0762db03f46c SHA-256: 5f3cb40a72322b27c9c2a37beff74fb12ec20aba72cef828c47e613bc85c5de4

88 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains encrypted JavaScript, indicated by the PDF_ENCRYPTED_WITH_JS heuristic. The embedded JavaScript, specifically 'javascript_obj0017_000.js', uses 'eval' and 'unescape' to deobfuscate and execute code, likely to download and execute a second-stage payload. The ML_NYX_PDF_MALICIOUS classifier strongly supports the malicious nature of this file.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS

PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0017_000.js` `4c6725e0e55e4dfccbe04e66a6ba88dbc5269818ddfeaa643839ec13055fd352`	pdf-javascript-stream	PDF /JS object 17 at offset 0x5FE2	96 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 eval/decoder/string-building token(s).
`javascript_obj0021_000.js` `b5a1bd36953296eb5bb2fe15220685df0ed9a24de9251856de062aa06b219f26`	pdf-javascript-stream	PDF /JS object 21 at offset 0x17BE	96 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.