PDF malware analysis — malicious · 782c20b797227a25

MALICIOUS

PDF

28.7 KB Created: )àrKPKBËñÍ @©ªB ' Authoring application: ¨ìÒzÎ`T6sÃ (via ¨ìÒzÎ`^6sÃè)

MD5: 97e2b27f54a043f0a91f1bb39c8486a4 SHA-1: 74bc8aba932015a4161e3847aefa3e86fa82152a SHA-256: 782c20b797227a25f581481d4fff46a11d5634d6214f29b77864307634df4e91

94 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment

This PDF file contains embedded JavaScript, which is heavily obfuscated and likely responsible for executing malicious code. The ML classifier and heuristics indicate a high likelihood of malicious activity, with the JavaScript potentially serving to download and execute a secondary payload. The PDF is also encrypted with JavaScript, further hiding its true contents from static analysis.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS

PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0008_000.js` `2c962e50f6ce636560506fffcd28b9bca4349cb403da38c1eb99f851fa44fdaa`	pdf-javascript-stream	PDF /JS object 8 at offset 0x4E6	2047 bytes
`javascript_obj0009_000.js` `85c224471743dcb099c240e6f4c49655b9812f41068bbd66f9efd9af09819395`	pdf-javascript-stream	PDF /JS object 9 at offset 0x3B6	26796 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.