PDF malware analysis — malicious · 735de9f26fca88f7

MALICIOUS

PDF

6.5 KB Created: 2010-08-28 07:57:32 Authoring application: Mkasabomezeni (via 96510Qoubodohimowebaxkore)

MD5: 2d234d9687a7db2820217871cf0eb90c SHA-1: f9ad8d846b9c5b15c2ca31ae6d33dd3171edc063 SHA-256: 735de9f26fca88f76c08a9517fb56cc7172f372e1740d0188a543bc5caf62c5e

166 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains obfuscated JavaScript, flagged by multiple heuristics including ClamAV and an ML classifier. The JavaScript appears to be designed to download and execute a second-stage payload, as indicated by the presence of functions like 'eval' and string concatenation for constructing URLs or commands. The obfuscation and the nature of the script strongly suggest malicious intent, likely delivered via spearphishing.

Machine Learning

Nyx PDF Classifier malicious score 0.9933

Heuristics 4

Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECT

A PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `42b7f53538edfd751e5125f559e3d3047a3d7ae108d5e63ef586277b3cede53d`	pdf-javascript-stream	PDF /JS object 11 at offset 0x11E7	1886 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.