PDF malware analysis — malicious · 6c67deb42f216ead

MALICIOUS

PDF

7.1 KB Authoring application: Wezolokofecpo (via 677c9Nworeticakebi)

MD5: f10e2971bbb6fc09f89b85e32748869c SHA-1: ed340ce329e8fba50129012262d189a9d4b0a715 SHA-256: 6c67deb42f216ead1a5e54bf90ca8cbab86ad70d815468299a9de9591df69dba

166 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains obfuscated JavaScript, flagged by multiple heuristics including ClamAV's Heuristics.PDF.ObfuscatedNameObject. The embedded JavaScript is likely responsible for executing the malicious payload, as indicated by the ML classifier's high confidence score. The obfuscation suggests an attempt to evade detection, and the primary function appears to be the execution of further malicious code.

Machine Learning

Nyx PDF Classifier malicious score 0.9953

Heuristics 4

Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECT

A PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `437a5d40b54247c17dfb3ac60e39d3ecfad672a269694af1851a077d9726a8d2`	pdf-javascript-stream	PDF /JS object 11 at offset 0x1342	2272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.