PDF malware analysis — malicious · 7f8de03078e73158

MALICIOUS

PDF

26.8 KB

MD5: accc7cac9a5310863499fc1e4b64af6e SHA-1: 19e9a0c9c3726f75e4de50953f8648269ed2831a SHA-256: 7f8de03078e73158c243bff3c05419a8ba0f7c7fe3825cf50e476c0797b58fc6

204 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains obfuscated JavaScript that attempts to exploit vulnerabilities. The script decodes a payload from annotation subjects and executes it using `app[fnc](buf)`. This indicates a multi-stage attack designed to download and run a secondary malicious component.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 8

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
Obfuscated multi-stage PDF JavaScript dropper high PDF_JS_OBFUSCATED_DROPPER

PDF JavaScript shows 3 independent signals of exploit-kit-style multi-stage obfuscation: annot_subject_stage, incremental_eval_build, repeated_pluginschk. This is strongly consistent with pre-2011 Adobe Reader PDF droppers — OpenAction JS reads encoded data from annotation subjects, decodes it through one or more hex / base-N loops, and invokes eval indirectly (method name built one character at a time). The actual CVE is hidden in the final decoded layer and is not visible via static analysis.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
String.fromCharCode low PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.
syncAnnotScan annotation-staging primitive low PDF_FOXIT_SYNCANNOTSCAN

PDF JavaScript calls syncAnnotScan() — a no-op annotation-enumeration primitive used by exploit-kit JavaScript to stage payload reads from annotation /Subject fields before eval(). Not a vulnerable sink itself; rarely seen in legitimate PDFs.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js` `f6c97065fa889619cb9a29fe74bbdc6f16ab91ffdbea8e9485e055c68a189b7a`	pdf-javascript-stream	PDF /JS object 7 at offset 0x149	443 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
`javascript_obj0007_001.js` `6d16813d1361047323e35c3c2bc56c44d7961eb35926d0357bcea56baca4d9a2`	pdf-javascript-stream	PDF /JS object 7 at offset 0x169	27132 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
`generic_stage_recovery_000.js` `907f756efe33817cd4fea84b82b54002d89208f6c3c30b5e6a4b1dde33ddf15a`	deobfuscated-js	generic stage recovery split-literal-normalize from JavaScript object 7 at offset 0x149	440 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
`generic_stage_recovery_001.js` `71deed2b1ac087165561a37d7328d8511ae25fa1228eb8d23c79aae6b7ab7c8e`	deobfuscated-js	generic stage recovery split-literal-normalize from JavaScript object 7 at offset 0x169	27129 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
`generic_stage_recovery_002.js` `0f3a57aa65df0669a9ff96b455f26b12f9c65e454a2bd15ee0869f60b0d997b8`	deobfuscated-js	generic stage recovery split-literal-normalize from combined JavaScript objects at offset 0x149	27570 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
`combined_document_js_000.js` `fd2aa0fe37543cbc10b3a11768b70c012cb8d85d74161a75288055739466bcd9`	deobfuscated-js	combined document JavaScript streams at offset 0x149	27576 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
`deobfuscated.js` `1b033fee3095d2f24c3c18afbd94cd5ce377707f9d697184c602c75330f01b8b`	deobfuscated-js	PDF JavaScript deobfuscation pass	27729 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.