Malicious PDF — malware analysis report

Static analysis result for SHA-256 7eeb0fc0ae2b521d…

MALICIOUS

PDF

52.6 KB Created: 2011-04-13 23:21:25 +03:00 Authoring application: Wiki Student Loan Application Online (via mPDF 5.0)
MD5: c376c419c450fbeab04660bc7b11a68d SHA-1: dd0467f528d033ddaf1866f953d21728ada3d526 SHA-256: 7eeb0fc0ae2b521d65e203b658ab0558746f0d19e094efb102c486056787941c
106 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.007 JavaScript

The PDF file contains embedded JavaScript streams, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ML classifier strongly suggests maliciousness, and the presence of unescape() calls points to obfuscation. The extracted JavaScript files, javascript_obj0036_000.js and javascript_obj0036_001.js, are likely responsible for executing malicious code, potentially downloading and running additional payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9937

Heuristics 4

  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0036_000.js
357d06d70777f397a54fd04180a5ee36f36a8ec5c7cbbafdfab41f20901b25ac		 pdf-javascript-stream PDF /JS object 36 at offset 0xC9D0 136 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).
javascript_obj0036_001.js
607a0753f2d28ea7a383d2e729ee9a1eeb69db22eafb74fa3e1d444ae047c123		 pdf-javascript-stream PDF /JS object 36 at offset 0xC9D0 134 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.