PDF malware analysis — malicious · 7addbca035558755

MALICIOUS

PDF

3.0 KB

MD5: f133f2517bd858441d003222164d0448 SHA-1: 3df4be099e7c387bc4d58d992e44cabb88343507 SHA-256: 7addbca03555875532cb45bf7eb33cd2873c9c5483099eba0ca2a838dcda126d

86 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 Command and Scripting Interpreter: PowerShell T1059.003 Command and Scripting Interpreter: Windows Command Shell T1059.007 Command and Scripting Interpreter: JavaScript/TypeScript

This PDF file was flagged as malicious by an ML classifier with high confidence. It contains embedded JavaScript, and is encrypted with an /OpenAction, indicating the payload is hidden from static analysis. The presence of JavaScript actions and embedded JS streams suggests the file attempts to execute malicious code upon opening.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS

PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0003_000.js` `642708af103a45d0b51d5072cd0aadb4c0801b497405cf314b349e03b7e79962`	pdf-javascript-stream	PDF /JS object 3 at offset 0x242	1881 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.