PDF malware analysis — malicious · 605b02918f3b4110

MALICIOUS

PDF

6.90 MB

MD5: bba51a76c8de01c95e4f27c694676fe0 SHA-1: 408165d38b0c193011feb9c38be8417e19ef1eed SHA-256: 605b02918f3b41101b4098c683340624d5a4d3129d4af6dd9b180d0bb81f5811

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1140 Deobfuscate/Decode Files or Information

The PDF file is heavily obfuscated, indicated by the high stream count and the presence of encrypted JavaScript. The PDF_JPX_CVE_2018_4990_RELATED heuristic suggests exploitation of a JPEG2000 vulnerability, which is often used to deliver malicious payloads. The embedded URL, while not definitively malicious, is suspicious in this context. The primary attack vector is likely spearphishing attachment, with the embedded JavaScript serving to download and execute further malicious code.

Machine Learning

Nyx PDF Classifier suspicious score 0.4540

Heuristics 7

JPXDecode + active content — JPEG2000 CVE-family indicator high CVE related PDF_JPX_CVE_2018_4990_RELATED

PDF uses /JPXDecode (JPEG2000) alongside JavaScript, XFA, or RichMedia indicators. This matches the delivery pattern for Adobe Reader JPEG2000 parser exploit families, including CVE-2018-4990, but does not prove the exact malformed JP2/JPX primitive.
Encrypted PDF carries /JS — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS

PDF declares /Encrypt and also references an executable trigger (/JS). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
JBIG2Decode filter medium PDF_JBIG2

JBIG2 image decoder present — historically used in zero-click exploits
Unusually high stream count medium PDF_MANY_STREAMS

PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE

PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.energyplus.gov/cfm/weather_data.cfm
- http://www.webexhibits.org/daylightsaving/

Extracted artifacts 32

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objstm_0612_00.bin` `f2b6972403c80892f5dbe28f74bb657f0a7b763b94ab4f1d73d7948b74af19f1`	pdf-objstm-decoded	PDF /ObjStm 612 0 obj (inflated)	2475 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`objstm_10041_00.bin` `dc70cd5297ef03f9ba6836a99424808aa73c44b59e76155776b4cb391b038d4f`	pdf-objstm-decoded	PDF /ObjStm 10041 0 obj (inflated)	355 bytes
`jbig2_00_off00185153.bin` `c20b81a4660c8e2d74578b44b3f94a2babbd04bf1c104fa90e3369444cc929b7`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x185153	680 bytes
`jbig2_01_off001854b4.bin` `2373415d6361db1d4345fb5b08396810f064dd07a20529ee506c25ee47eb0315`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x1854B4	463 bytes
`jbig2_02_off0018573c.bin` `0680dd5099e791be15508e25a05a07e58829bff058f9f885cceaf17b11359480`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x18573C	855 bytes
`jbig2_03_off00185b4d.bin` `14e5feae987646beae368c5e234d7cee67b79567b1988e521e017a785be893c6`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x185B4D	1081 bytes
`jbig2_04_off0018603f.bin` `c46b619a02081297494084531273b8d2a4ed86236401a25fcb032fa889455b24`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x18603F	994 bytes
`jbig2_05_off001864da.bin` `785a2f7d913abf5849cf93d27f75d17e69fe05827ff663107323a5cf088a5eba`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x1864DA	624 bytes
`jbig2_06_off0041d6fd.bin` `066e0bccf663a7b350378f0d40cabde43e7d357e7ee48d7288830ffc3a1eef2f`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x41D6FD	1018 bytes
`jbig2_07_off0041dbb1.bin` `b9a4b67ccc981f170dd431e701664935d12b6ee3b0cf4d67476e4dacbb8fe5a5`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x41DBB1	566 bytes
`jbig2_08_off0041dea2.bin` `ceaf73e792e985a4d3181544cb3f38cfea63c843ec0b2f5c869a8228b41412a5`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x41DEA2	1020 bytes
`jbig2_09_off0041e358.bin` `baf553a95ff0092b08693dae8139df9647e951ab9ff56a2a0be4d273bf741329`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x41E358	397 bytes
`jbig2_10_off0041e59f.bin` `fe74959c64b9038fe0941dcb798c564495c4aafddf216af11ccbb4bf5b6009de`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x41E59F	773 bytes
`jbig2_11_off0041e95e.bin` `4523297136c472530f186fd3faa012ec0943342ef5b970656c617248b3643f48`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x41E95E	423 bytes
`jbig2_12_off0041ebbf.bin` `5691a11cef43e2f050fb66d29483d0311cf32c8d92c1437547fe26e81aba180e`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x41EBBF	623 bytes
`jbig2_13_off0041eee8.bin` `949221d9becf3d36818aff5c48c9248653270fe400dab0a89037645014f0a79a`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x41EEE8	250 bytes
`jbig2_14_off0041f09b.bin` `8cb3b708f5f685810ee3fd3881beea23eedd1108119e452a367b3a4aebe6dc4f`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x41F09B	90 bytes
`jbig2_15_off0058a8ee.bin` `3c3e98d0f5ee6cdd81675fdea7464ead66de73c49c75b8062bc568a5fc5ad44f`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x58A8EE	527 bytes
`jbig2_00_off002f351c.bin` `c01f33f4d4d7696a8ef331e55c0f61e57438ae25e13718f5568abd32f137e43d`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x2F351C	1040 bytes
`jbig2_01_off002f39d7.bin` `578c4e2f8f87617407a38e57aa0715c72a03432c8210867faf0c0b972f0c53f4`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x2F39D7	592 bytes
`jbig2_02_off002f3cd3.bin` `8b67d9788fc168b87d5bc47ff6e854b58a972c9d3db1e05d247e0f6ae5cf6353`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x2F3CD3	1040 bytes
`jbig2_03_off002f418e.bin` `23f5ca55668c533679c9c0dbaf8b8fbc4d961004e7713035ddebf014f7e32678`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x2F418E	416 bytes
`jbig2_04_off002f43d9.bin` `b865c847cfc24744207621b3e1b41e216ce84127f5ca339bd7cc8301de03c111`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x2F43D9	800 bytes
`jbig2_05_off002f47a4.bin` `aecc4952462b9bf636c5c8ddd3509681214fa2b256cd7228692bc73c0bd63c44`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x2F47A4	448 bytes
`jbig2_06_off002f4a0f.bin` `6082e021e468155d64e789346ca783fb5c6a4eabf2cb9fbb6b5418b5cd32958e`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x2F4A0F	640 bytes
`jbig2_07_off002f4d3a.bin` `dc907f5e0ce433a143e88b1da743c270ac49b884a2d18703a79a862531401263`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x2F4D3A	272 bytes
`jbig2_08_off002f4ef5.bin` `f5725938076dee82ce2a56ea277d76d3b98c7d3b5983d13c298e880ff1c47bbf`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x2F4EF5	112 bytes
`jbig2_09_off0045e2eb.bin` `fa78a10b3368befb04b9e96f015c30c6a92ab68a1fe3269854ff3daad4a7093f`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x45E2EB	544 bytes
`jbig2_10_off005c03de.bin` `805ddf5a1538f09f50428977bda0710c244a28cf70866ac5ef4fc6b6e4622864`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x5C03DE	704 bytes
`jbig2_11_off005c0749.bin` `ca81e04a9a23fa8e1b06ab087e4063760455a3732021d7ead2d2b55560ef122c`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x5C0749	480 bytes
`jbig2_12_off005c09d4.bin` `4a6df88b26903880f6ed7af8f0af07236df0f14e7672f7542941d04d2172fbc6`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x5C09D4	880 bytes
`jbig2_13_off005c0df0.bin` `a8b0ccae05ba5b2635476b31a9dfa0c658fe33910b446b1085408a17830f68df`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x5C0DF0	1104 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.