PDF malware analysis — malicious · 60bc576c7a965502

MALICIOUS

PDF

4.7 KB Authoring application: Majekizihax i

MD5: 1a1fc4e647b84c80d3685a6fc28cda5b SHA-1: 19c7d76f85b91b9f55adb09b074c7e01bf921fec SHA-256: 60bc576c7a965502c2d7e2bb7dbda162fe6eb81dd75bd389d3563e828fbc1cd6

86 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains embedded JavaScript that is heavily obfuscated. Heuristics indicate this script acts as a stager, likely XORing and evaluating code to download and execute a second-stage payload. The ML classifier strongly flags this PDF as malicious, supporting the conclusion that it is designed to deliver further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER

PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `fd2783f45327cfae5100a8729abbd004704ec6540b47a60551b69499fea54167`	pdf-javascript-stream	PDF /JS object 11 at offset 0xD71	903 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.