Malicious PDF — malware analysis report

Static analysis result for SHA-256 79daec28be5632ca…

MALICIOUS

PDF

2.2 KB
MD5: 3309a9f2cbacf3af66230e660e9f98b5 SHA-1: 0029b9f79fe999628cd71c47e2d9200c057824dc SHA-256: 79daec28be5632ca5dc1ef54cbdda6661a8c3140616d7b204cb5a273fd1ff89a
70 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains heuristics indicating it is a malicious document with JavaScript exploit stages. The extracted JavaScript code, though obfuscated, appears to be responsible for downloading and executing a second-stage payload. The presence of multiple JavaScript files suggests a multi-stage attack. The ML classifier strongly flags this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 1

  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
generic_stage_recovery_000.js
5a3d618cc83fec1f8003eb2530912f02e653c5baeb1d26e88be81e583830516a		 deobfuscated-js generic stage recovery percent-decode from decompressed stream at 0x72 at offset 0x72 1966 bytes
generic_stage_recovery_001.js
345e044131a08dd1ac7b741746371cfb4c09687390f7933c077c708a4212a1db		 deobfuscated-js generic stage recovery percent-decode -> percent-decode from decompressed stream at 0x72 at offset 0x72 1896 bytes
legacy_pdfkit_stage_000.js
82e437a34ffd7a5adea747c29400e59651eeab351c671fa9b3baf778b23b0fa0		 deobfuscated-js repeated-marker hex decoded JavaScript at offset 0x72 155 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.