Malicious PDF — malware analysis report

Static analysis result for SHA-256 8237f3c523445bff…

MALICIOUS

PDF

124.2 KB Created: 2003-04-24 17:25:24 UTC Authoring application: Acrobat Web Capture 5.0
MD5: 1b6d09d996a5f2bf8c6b14eb20cf2052 SHA-1: f030ebf68d83b3ceb94890d2d86fe263ebdf928d SHA-256: 8237f3c523445bfff61174a70cf19017397beeefa0206142687cb38663f58418
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF contains embedded JavaScript that, after a delay, attempts to export an embedded executable named 'death.api' and an FDF file named 'EVIL.FDF' to specific paths. The ML classifier and the heuristic for an embedded PE payload strongly indicate malicious intent, likely to execute the dropped payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 7

  • Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOAD
    PDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/iX/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
EVIL.FDF
dae2f4ab3975a863b0674caa01eecea368835fa28a533e266258596a5f8708de		 pdf-embedded-file PDF EmbeddedFile object 25 at offset 0x1D7C 332 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
death.api
48e1e3790a02170c2c27c950e7c22776586aaa5efc59d6ea6f594e02a6aeaeaf		 pdf-embedded-file PDF EmbeddedFile object 28 at offset 0x1FDA 237643 bytes
javascript_obj0040_000.js
06cc1895c8742f06def84202431760af78934c56a9a6075eb99246d42052c6ea		 pdf-javascript-stream PDF /JS object 40 at offset 0x4DF 123 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.