Malicious PDF — malware analysis report

Static analysis result for SHA-256 80873e6b55917ca3…

MALICIOUS

PDF

936.1 KB Created: Oÿg6¦î½ é-.r¾Ávc*×õ·Àà›O$£Á£8žøòÝ|؂:Ái:Ý.ú={ Authoring application: 䨇ھjŽ4šˆÎzêpÐÔ»¡úL­i.|$pø¥C“ž”ûÔßË£/cJÙz>’% (via Ç!²û4i‘¶›\~صРAZ€…VœßߗfµGÒ>ïw’$ù6HîküýRÉ)
MD5: 647c38afbf8d691536a7a41f94cfef42 SHA-1: 85faec0307ae307ab0bb07ae7912617c3a67d061 SHA-256: 80873e6b55917ca381a1298f6775db132a5da3c451df56a85683ca4be5336109
216 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains embedded JavaScript that attempts to exploit vulnerabilities or trick the user into downloading a malicious file disguised as an update. The script constructs a URL for a supposed update, which is likely a lure to download a secondary payload. The presence of an embedded SWF file and ML classification further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 11

  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cgi.adobe.com/special/acrobat/update
    • http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/2.8/
    • http://www.xfa.org/schema/xfa-template/2.8/
    • http://www.xfa.org/schema/xfa-data/1.0/
    • http://www.xfa.org/schema/xfa-locale-set/2.7/
    • http://ns.adobe.com/xtd/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.xfa.org/schema/xfa-form/2.8/
    • http://www.iec.ch

Extracted artifacts 13

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0014.bin
365c9a507f0089f894d210675abd0eb0fd55de7c1633a56f9dc7c85ed5ac5375		 pdf-embedded-file PDF EmbeddedFile object 14 at offset 0x1A7E 163 bytes
embedded_file_obj0015.bin
e6edbc492bc9c02cd0e8f754886205e3a7ed95bb581b6296bd6d6acfb7d5a499		 pdf-embedded-file PDF EmbeddedFile object 15 at offset 0x1B6E 1590 bytes
embedded_file_obj0016.bin
5f50f1d35100e25b668e60dab452b7b7cb3b8e6b1464806399fb35f6b1bee2c5		 pdf-embedded-file PDF EmbeddedFile object 16 at offset 0x1E6B 6683 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
embedded_file_obj0017.bin
bba75246a3e78e6cc92559d684072eed08816089e73e1e4fa0a7eb4f91c7b33d		 pdf-embedded-file PDF EmbeddedFile object 17 at offset 0x2857 156 bytes
embedded_file_obj0018.bin
c8a82f67dfd8d68c2f8fe494ca2deee4604701c8f02863bf87d222b992e45de9		 pdf-embedded-file PDF EmbeddedFile object 18 at offset 0x2927 2955 bytes
embedded_file_obj0019.bin
4cb349134bdb5f1a1c03281df9b53128ebe947f235398a912a4f0a9f638b24d5		 pdf-embedded-file PDF EmbeddedFile object 19 at offset 0x2CA1 200 bytes
embedded_file_obj0020.bin
9ff8dd6dc461ce1a49903fe91a9730cbd0618d54ce3e72ee49a5c4a11548f4db		 pdf-embedded-file PDF EmbeddedFile object 20 at offset 0x2D95 835 bytes
embedded_file_obj0021.bin
4a60a9864cdf7382475d51051a03fdc43b32c31eb508893ccfccece34957f9f1		 pdf-embedded-file PDF EmbeddedFile object 21 at offset 0x2F6D 56 bytes
poc.swf
f4203e650f970bdcee3a1a005d495b7f888639a27fe7a1e1cc3c360497c78ea2		 pdf-embedded-file PDF EmbeddedFile object 80 at offset 0xE4222 22324 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.99, consistent with packed or encrypted content.
javascript_obj0043_000.js
41ae157811353bd010d5e4c70d33d9b304a2ee7ea48a191ed8a871f61dd0df37		 pdf-javascript-stream PDF /JS object 43 at offset 0x3B4A 1430 bytes
javascript_obj0044_001.js
e985b5df65c8c3cf732a9074b575fbc594c1c7f0bccc0994182ec7e5c0f7308a		 pdf-javascript-stream PDF /JS object 44 at offset 0x3DC1 902 bytes
javascript_obj0045_002.js
529357503ec67b623d2a12816cdeea62bd639f2b4ff4e568b01c96cc3f5bfc6f		 pdf-javascript-stream PDF /JS object 45 at offset 0x3F18 1363 bytes
icc_00_off000e2feb.icc
2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e		 pdf-icc-profile PDF ICC profile at offset 0xE2FEB 3144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.