Malicious PDF — malware analysis report

Static analysis result for SHA-256 7cf6d3b210595222…

MALICIOUS

PDF

5.4 KB Created: Šwᦩ)éÝ*•X Authoring application: ^EÄ%ò ¥·*óÛ5X (via ^EÄ%ò ÄÝ_ý¤rÖ«öF‡„º¼"¾d)
MD5: 947992175720e41298d3c295f2cf50f2 SHA-1: 190ff77d45c4c0ffa1396c9a6f3e1543f506f637 SHA-256: 7cf6d3b21059522260c18e6c2f4ee7782aaab6045e581b0ad790aeec72f6ffa5
86 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript and is encrypted with JavaScript, indicating an attempt to hide malicious content. The ML classifier strongly flagged this PDF as malicious. The presence of JavaScript actions and embedded JS streams suggests the file is designed to execute code, likely to download and execute a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.