PDF malware analysis — malicious · 655db9e723126f24

MALICIOUS

PDF

3.3 KB

MD5: 691456ced0c0279850286a91a25d9f10 SHA-1: fcb421d0343bd942d07aa8c447b093fae1c8c999 SHA-256: 655db9e723126f24602b85e723f7a79bcc64afee942ed418fc30f2e1efe4095c

206 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains embedded JavaScript that is obfuscated but appears to leverage the `unescape()` function, a common indicator of exploit attempts. The JavaScript is likely designed to execute arbitrary code, as suggested by the 'PDF JavaScript exploit cluster' heuristic and ClamAV detection. The script attempts to extract characters from the document's title property to form a string, which is then passed to a function that likely executes it.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 5

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
ClamAV: Pdf.Exploit.Agent-36121 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36121
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js` `ddfcd27de036eb5b0e53de859c7e386f2ed98e466df4e97bc20a6de96f9c28b5`	pdf-javascript-stream	PDF /JS object 7 at offset 0xA7D	299 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.