Malicious PDF — malware analysis report

Static analysis result for SHA-256 7883a7ce94ee6979…

MALICIOUS

PDF

1.2 KB
MD5: 55a1f0e655e586abfc17f3e14aae80a1 SHA-1: 7fea7a64bc1bda689b2a4af9877a7a7e07dd69f0 SHA-256: 7883a7ce94ee6979b34842618f36b756e73211cc50261ab55cd042c3ea984f29
166 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF sample contains embedded JavaScript that is designed to decode and execute a payload. The critical heuristic 'PDF_ANNOT_SUBJECT_MARKER_EVAL_STAGER' indicates that the annotation subject is used to launch this execution. The ML classifier and ClamAV detection strongly suggest malicious intent, likely delivered via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Annotation subject percent-decoding eval stager critical PDF_ANNOT_SUBJECT_MARKER_EVAL_STAGER
    OpenAction JavaScript forces annotation enumeration, reads an annotation /Subject payload with getAnnots(), rewrites marker bytes into percent escapes, decodes it with unescape(), and dispatches it through eval. This is a high-confidence exploit-kit staging pattern. It is intentionally not mapped to CVE-2009-1492 unless getAnnots() itself carries the crafted integer or long argument shape for that vulnerability.
  • ClamAV: Pdf.Exploit.Agent-36065 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36065
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js
9c67560e8c63b720885d3efc1627b844b86a6ec08e99e5b65a22eae832045756		 pdf-javascript-stream PDF /JS object 7 at offset 0x1A3 431 bytes
legacy_pdfkit_stage_000.js
33354b3018ed52ec31d9cc772b794595ef9e56340bbc465ec4f1d149c02c921b		 deobfuscated-js repeated-marker hex decoded JavaScript at offset 0x31C 330 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.