PDF malware analysis — malicious · 7c872ecbedb07c23

MALICIOUS

PDF

119.3 KB

MD5: 866ec575cef3dee5d95287ed95f8fc2d SHA-1: d4a3938672f443767c9cdfdb863957ff16cb0fd3 SHA-256: 7c872ecbedb07c237668d2ab41bdef04df2fb578a79c8533ed02d595b48bcffd

232 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious Link

This PDF file exhibits multiple critical heuristic firings related to JavaScript exploits and malicious PDF content. The presence of embedded JavaScript, particularly the 'PDF_JS_EXPLOIT_CLUSTER' and 'PDF_CORRELATED_MALICIOUS_JS' signals, indicates an attempt to leverage known PDF vulnerabilities. The 'ML_NYX_PDF_MALICIOUS' score further supports its malicious nature. While the document body is unreadable, the heuristics strongly suggest that the embedded JavaScript is designed to download and execute a second-stage payload, likely from a URL that was not fully extracted due to deobfuscation failures. The scan was incomplete, which reduces confidence slightly.

Machine Learning

Nyx PDF Classifier malicious score 0.9972

Heuristics 9

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
Correlated malicious PDF JavaScript signals critical PDF_CORRELATED_MALICIOUS_JS

PDF JavaScript or auto-action content is corroborated by exploit staging, ML, or suspicious extracted-artifact findings. This correlation promotes old exploit-kit PDFs that otherwise remain in the suspicious band because each individual signal is intentionally weighted conservatively.
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
String.fromCharCode low PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.
AcroForm button with action trigger low PDF_ACROFORM_BUTTON

PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
Scan did not complete info SCAN_INCOMPLETE

PDF JavaScript deobfuscation worker failed (worker exit 1); obfuscated JavaScript was not fully inspected.

Extracted artifacts 9

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0029_000.js` `80d7888ecf9ad9e4d03cd8cc6959f589c8f8783f37d48bb4d7dae53f6684c595`	pdf-javascript-stream	PDF /JS object 29 at offset 0x1E2A	8603 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
`stream_002_off00000a3e.js` `672d461752be4a970c8e9721164ce074d252b55d09d46cc09259d2ce4fc09f7f`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xA3E	1546 bytes
`stream_003_off00000cfb.bin` `29cf1edfedd4f27f3c450646c5dc2510e6bf9e63eee1cd436ac517a465a2e1bf`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xCFB	1650 bytes
`stream_004_off0000106b.bin` `0f910ffeec733940f6ba1ae41dc6770eab5d615c05bccc95197878b62c8dc45f`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x106B	2928 bytes
`stream_006_off00001600.bin` `4a60a9864cdf7382475d51051a03fdc43b32c31eb508893ccfccece34957f9f1`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1600	56 bytes
`stream_007_off00001688.bin` `fe122a09d8a0444608fdc5a6f4981a2dbd469f5bbfacb4bdd327c28ccc343e13`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1688	149 bytes
`deobfuscated.js` `ccdcf31887dcef245b191ce97219d27350cb5ce0765241b91b7390fbe4fdb679`	deobfuscated-js	PDF JavaScript deobfuscation pass	503102 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 4 long base64-like blob(s).
`font_00_cff_off00004b07.bin` `ea8f409c7366ed46eeb553aa7b404f04641f482ba88463fbe253da60be5787e5`	pdf-font-stream	PDF embedded font (cff) at offset 0x4B07	1138 bytes
`font_01_sfnt_off000054fa.bin` `e31f8c8507e52f29008d946a00becde9f839e34cb108985ce66167bf881adafa`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x54FA	8084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.