PDF / .PHP malware analysis — malicious · 9452a74e0f32bbb4

MALICIOUS

PDF / .PHP

33.8 KB Created: ü}·%º¶^Y®¸ëd}sëO* Authoring application: F¸Þø ³Ã.R¡ (via F¸Íø³ Â.^¶OÐ)

MD5: 191e3cb3604de02b0bde0b87ceff0898 SHA-1: dcc7075b9fc0c3a71129b77adab46bc740a020c2 SHA-256: 9452a74e0f32bbb4665ee5a1ee5cbe3bf88399073b81ebef91a2050d4caf663b

64 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

This PDF file is flagged as malicious due to the presence of encrypted JavaScript, which is a common technique to obfuscate malicious content. The embedded JavaScript stream, named 'javascript_obj0009_000.js', is likely responsible for executing the malicious payload. The obfuscation suggests an attempt to evade static analysis and deliver a phishing or credential harvesting lure.

Heuristics 4

Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS

PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0009_000.js` `cc438764a836a9eac2aca73c7d1ee502a2315edbbae49a226f703ec7191f1cb9`	pdf-javascript-stream	PDF /JS object 9 at offset 0x3BE	31988 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.