MALICIOUS
166
Risk Score
Malware Insights
MITRE ATT&CK
T1059.007 JavaScript
T1203 Exploitation for Client Execution
T1566.001 Spearphishing Attachment
This PDF file contains obfuscated JavaScript code, flagged by multiple heuristics including ML and ClamAV detection. The JavaScript attempts to deobfuscate and execute further code, likely to download and run a secondary payload. The specific exploit and payload are not fully discernible due to obfuscation, but the overall pattern suggests a malicious document delivered via spearphishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9989
Heuristics 4
-
Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECTA PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
-
ClamAV: Pdf.Exploit.Agent-36142 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Exploit.Agent-36142
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0010_000.jsd4dce4f95f7146e3b127d68edf45ceb045483a205d9e9a2a53d6e6b80d83b663 |
pdf-javascript-stream | PDF /JS object 10 at offset 0x1230 | 1728 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.