PDF static analysis report

Static analysis result for SHA-256 7bd29539720c2a0a…

SUSPICIOUS

PDF

36.4 KB
MD5: eeccce271befbdf577e246d3afe36240 SHA-1: 2f837956a97395ed283a9228dd6203263923be76 SHA-256: 7bd29539720c2a0a627a6a37f71b50230ee494cba458411653b1ef614d80221f
56 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF document contains embedded files and an embedded script payload, strongly indicating malicious intent. The ML classifier output of 0.999991 further supports this assessment. The presence of XFA forms and embedded files suggests an attempt to exploit PDF vulnerabilities or deliver a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded script payload in PDF stream low PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/1.0/
    • http://www.xfa.org/schema/xfa-template/2.5/
    • http://www.xfa.org/schema/xfa-data/1.0/

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0008.bin
0a2224c4023b216235b61c3fc4dd17bbfac1ab23a545687f51b97604cf654712		 pdf-embedded-file PDF EmbeddedFile object 8 at offset 0xD7 46 bytes
embedded_file_obj0009.bin
f8d5e900a1275ed57cb48fb8d865eaf912c6db3c54d9160ad62026973cda7748		 pdf-embedded-file PDF EmbeddedFile object 9 at offset 0x149 674 bytes
embedded_file_obj0010.bin
88ae8f79423a62321dc2edb8682c510186b8d988a14929b9fbe09006280ac993		 pdf-embedded-file PDF EmbeddedFile object 10 at offset 0x430 163 bytes
embedded_file_obj0011.bin
2735d9bd11e17bc5237b48ec2a76ef94d85322a37a7a08b7eb5dcb10b8a0a238		 pdf-embedded-file PDF EmbeddedFile object 11 at offset 0x518 413 bytes
embedded_file_obj0012.bin
072090be5ea6c4a216543a1d4332d27d322264f3038bbd986db2a09048143a1c		 pdf-embedded-file PDF EmbeddedFile object 12 at offset 0x6FA 181 bytes
embedded_file_obj0014.bin
d9e02ce3f7bd57087daa9e5daa5a5b28113ae7e61fcd34c243146f2d5cf7eaea		 pdf-embedded-file PDF EmbeddedFile object 14 at offset 0x7F5 34538 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.