Malicious PDF — malware analysis report

Static analysis result for SHA-256 70f7ee85df2d40e2…

MALICIOUS

PDF

29.6 KB
MD5: bb16badcd5745772969c8543ccd9b9b1 SHA-1: 76381c377aa03e696dd9d96aafb2dcff71bbb5c6 SHA-256: 70f7ee85df2d40e2c1ee318a6b084289170e4b4fdc94a51fb517d5173a403fe1
74 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript and uses ASCIIHexDecode and ASCII85Decode filters, indicating an attempt to exploit a PDF vulnerability for client execution. The ML classifier strongly suggests malicious intent. The embedded JavaScript is likely responsible for downloading and executing a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation