PDF malware analysis — malicious · 6b958cd793b48cfe

MALICIOUS

PDF

6.0 KB

MD5: 2c7975914ae819ff4791145a3ca9ff3a SHA-1: 3855210322fcd66161692ab0474aa73490031848 SHA-256: 6b958cd793b48cfe6d56a3ad8e9ad2385325f637b9d0e846667e2c3c8bdaac85

148 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains embedded JavaScript that is executed using an eval() call, indicating an attempt to exploit a client-side vulnerability. The ML classifier strongly suggests malicious intent. No specific malware family could be identified, and no external URLs or IOCs were extracted from the sample.

Machine Learning

Nyx PDF Classifier malicious score 0.9761

Heuristics 5

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/pdf/1.3/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objstm_0023_00.bin` `86bbb187e0941f9e4aebd47a7076d303bef3ab3adb4f1a15337d4a84b6ade66f`	pdf-objstm-decoded	PDF /ObjStm 23 0 obj (inflated)	355 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.