PDF malware analysis — malicious · 86335b2145e71e78

MALICIOUS

PDF

7.5 KB Authoring application: Jgaxivakafowizasi (via a068dUohosicilab)

MD5: 2203cc68d6abcd8e4ef583372a688276 SHA-1: 5b90fa6ea29a6673aa879843ac35109e92250481 SHA-256: 86335b2145e71e788aa0852492cbe5db86261901746fe92472b17baa78cab44f

166 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains obfuscated JavaScript, flagged by multiple heuristics including ClamAV and an ML classifier. The JavaScript attempts to evaluate strings constructed from character codes, likely to download and execute a secondary payload. This is a common technique for delivering malware via malicious documents.

Machine Learning

Nyx PDF Classifier malicious score 0.9954

Heuristics 4

Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECT

A PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `c35f939b8b08b4458e4f2307d4bfd0afc23546c955e11c1da88e87302e40c9b0`	pdf-javascript-stream	PDF /JS object 11 at offset 0x1358	3029 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.