PDF malware analysis — malicious · 73c585c40abfec71

MALICIOUS

PDF

7.3 KB Authoring application: Bofatezozinefaxfa (via ce6d8Vogewojixariuawi)

MD5: 4df5b71473c2a2424df2acdfe3c978c0 SHA-1: b67efd18b22d4f0b5510de9f594523efa06bba22 SHA-256: 73c585c40abfec718245ab992c871ca3293c6a28738037bec33436e6734ad3c9

166 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF file contains obfuscated JavaScript, flagged by multiple heuristics including ClamAV's Heuristics.PDF.ObfuscatedNameObject. The JavaScript appears to be designed to download and execute a second-stage payload, as indicated by the presence of eval() and unescape() functions, and string concatenation used to build code. The obfuscation and the ML classifier's high score suggest malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9954

Heuristics 4

Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECT

A PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `ca838ab153ea9de4fff1e74bdd0848fd720f71bc6fbee4425be234136cd19b41`	pdf-javascript-stream	PDF /JS object 11 at offset 0x1349	2325 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.