PDF malware analysis — malicious · 7be7b4169b809815

MALICIOUS

PDF

5.2 KB Created: ¦ç ÂòÔÊ½þuºß«T¯ð:(Ù×kø8:£ ~]{w(âú mµº Authoring application: ]@>òO;¿3w}º4âkÞ8ü6NXr·¯UZ¸ (via ,xþÔ+|×¯¾?¤JH¬xQé3 / $·ãRt£NÜæF5ÇþÀÑx¸7Ã/ãâ«Î!ÙÑyÛ1Ô1ÒØRKÐ JãFâÙ)

MD5: 5fdd03aaf2b5231b5afe9ebbd1738666 SHA-1: 99be746cf7acc363292151a861b536c841032b20 SHA-256: 7be7b4169b8098152305d42f3c3a6261fa82ad9030b989998bc940904adbdafd

86 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains JavaScript, indicated by multiple heuristic firings including 'PDF_JAVASCRIPT' and 'PDF_JS'. The 'PDF_ENCRYPTED_WITH_JS' heuristic suggests the JavaScript is used to hide the malicious payload. The ML classifier also flagged this PDF as malicious with high confidence. No specific IOCs like URLs or hashes were extracted, and the JavaScript itself appears to be primarily for obfuscation or basic field manipulation rather than direct payload execution.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 3

Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS

PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
JavaScript action low 1 related finding PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `e89285dffe9b2a759b5b82e9f0cfeb0c495ab0c80df6a684f39c0d8a10c139bc`	pdf-javascript-stream	PDF /JS object 11 at offset 0xE6A	94 bytes
Preview script First 1,000 lines of the extracted script var d = util.printd("mm/dd/yyyy", new Date());var date = this.getField("date");date.value = d;
`javascript_obj0016_000.js` `08bd78ee1e1acf9913e88bd82d627dd8e2afee3bd4adb567850b69a1b139146b`	pdf-javascript-stream	PDF /JS object 16 at offset 0x11FE	112 bytes
Preview script First 1,000 lines of the extracted script Ͷ1��z� ��h�Z�[�n��Y hY^M\D�:�d��Ai�y�� W��0&j � � QePC}�[[� �}9��0Q�3] fC �'d�c$�D &\|�%O=4 ��SEQ�� 4�

Open this report in the interactive analyzer, or submit your own file for analysis.