PDF malware analysis — malicious · 7aec25d5bdc15b41

MALICIOUS

PDF

6.2 KB

MD5: ec76ff59f18e3b269a44d5cc5ca1861f SHA-1: e484c2b6fe400db071413b528b6a48d73f5ba39f SHA-256: 7aec25d5bdc15b41855f9af1067ddfb6629da8a56eb5c4dcd53e64fbea90b74b

88 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains embedded JavaScript, flagged by multiple heuristics as a stager. This JavaScript is likely responsible for downloading and executing a second-stage payload. The ML classifier strongly indicates malicious intent. Due to the obfuscation and lack of specific indicators, the exact family cannot be determined.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER

PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0016_000.js` `582f0561023923b6daa9bcc92feaaf0fbb54e96e3632caa091aff741933d4637`	pdf-javascript-stream	PDF /JS object 16 at offset 0x12A9	1368 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.