Malicious PDF — malware analysis report

Static analysis result for SHA-256 8dbaf15dac1dbe1f…

MALICIOUS

PDF

293.0 KB
MD5: 9926c4f6f4034edb7b8c7046b92892c0 SHA-1: 97727db69f2550e010a0a3f995545ff1e11aa3eb SHA-256: 8dbaf15dac1dbe1f9feeccd3853a01920df7511517645c77587756cc899284a3
104 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

This PDF file contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT and PDF_JS. The ML classifier strongly flagged it as malicious. The embedded JavaScript stream, named 'javascript_obj0006_000.js', is highly suspicious and likely responsible for the malicious behavior. The document body contains heavily obfuscated code, suggesting an attempt to hide malicious actions such as exploiting vulnerabilities or downloading further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 7

  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • String.fromCharCode low PDF_FROMCHARCODE
    String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/3.0/
    • http://www.xfa.org/schema/xfa-template/2.8/
    • http://www.xfa.org/schema/xfa-data/1.0/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js
ee6a4f355cbbe0324548c9ee130a8d913bf3b9d071aac063a48d7c3b70054b0f		 pdf-javascript-stream PDF /JS object 6 at offset 0x46D96 9527 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.