PDF malware analysis — malicious · 6711c2e73f63a1b1

MALICIOUS

PDF

4.5 KB Authoring application: Vabameuaki

MD5: 0214095f77893d0825cfd911a8c88a69 SHA-1: e44f7cbc04830369127af5aab6623169ac62e70a SHA-256: 6711c2e73f63a1b16fa354811a6ef3eb75792ed8a10920c3396edf79ef13ba95

86 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment

This PDF contains obfuscated JavaScript that is designed to be executed. The script reconstructs strings to call functions like 'unescape' and 'eval', and ultimately appears to download and execute a second-stage payload. The ML classifier and specific heuristics strongly indicate malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER

PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `1ec398366107a5fedd9bcf18a57f32d68d58e87986c8ad1c876f457b209e2152`	pdf-javascript-stream	PDF /JS object 11 at offset 0xCA2	815 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.