PDF malware analysis — malicious · 74cda0035814df77

MALICIOUS

PDF

26.9 KB Created: 2006-02-01 14:14:12 Authoring application: Wegoptyr (via HghTc6Fs)

MD5: c6f6aa6c0c04a8b4ca539e4fc2e4b6be SHA-1: 715c2150ab4309c72d09a7ca6996aacb157c69c1 SHA-256: 74cda0035814df77b96500f1f65a29bae7af9032f4856689e964ccf081e7ce9d

148 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains obfuscated JavaScript, including multiple eval() calls, which is a strong indicator of malicious intent. The script is designed to download and execute a secondary payload, as evidenced by the PDF_JS_EXPLOIT_CLUSTER heuristic and the presence of embedded JavaScript streams. The obfuscation and exploit cluster suggest a deliberate attempt to compromise the user's system.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 5

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js` `0f5b36585179b32f95206e144104ccd3d0fb36e61fdbd955efec2ff7774a8e05`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1EE	26460 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
`javascript_obj0007_001.js` `8237e04f72bc2c8d333446806432a47d499cf95732bd075b8bb6f5fa506467b7`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1EE	503 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.