PDF / .TMP malware analysis — malicious · 770d01afda5fbe1f

MALICIOUS

PDF / .TMP

4.5 KB

MD5: f7513aefea831d6ddfc3d1f2ff693371 SHA-1: f49b07929f8a27ed5d1c452c88cc0112afd71f7c SHA-256: 770d01afda5fbe1ffe843c97f46b12e4d093d21ed2f1b1d1ea6cca1c21e64eb9

86 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF document contains embedded JavaScript, identified by heuristics like 'PDF_JAVASCRIPT' and 'PDF_JS'. The JavaScript code appears to be a stager, as indicated by 'PDF_PAGE_WORD_XOR_EVAL_STAGER', which likely downloads and executes a second-stage payload. The script dynamically constructs strings and uses XOR operations, suggesting obfuscation to evade detection. The ML classifier strongly flags this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER

PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `55a98f518bf15c1f6fe7f383030df89eae7fc0640df068de258adf152ba77668`	pdf-javascript-stream	PDF /JS object 11 at offset 0xCA6	824 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.