Malicious PDF — malware analysis report

Static analysis result for SHA-256 820974a7d7c6c726…

MALICIOUS

PDF

29.4 KB
MD5: 09ce72e8f4d31a79f112056e437e42a1 SHA-1: 4c82229f9139bfcb508712bbc1623f7b457be7ca SHA-256: 820974a7d7c6c726ee394ae1a34e5fd8b0d2414b857e8fb15643ec37fe39caf8
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment T1027 Obfuscated Files or Information

The PDF contains embedded JavaScript and utilizes ASCIIHexDecode and ASCII85Decode filters, which are common indicators of exploit attempts. A machine learning classifier strongly flagged this PDF as malicious, correlating with the presence of JavaScript. The combination of these factors suggests the PDF is intended to deliver a malicious payload, likely by exploiting a vulnerability within the PDF reader.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • Correlated malicious PDF JavaScript signals critical PDF_CORRELATED_MALICIOUS_JS
    PDF JavaScript or auto-action content is corroborated by exploit staging, ML, or suspicious extracted-artifact findings. This correlation promotes old exploit-kit PDFs that otherwise remain in the suspicious band because each individual signal is intentionally weighted conservatively.
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation