PDF malware analysis — malicious · 9894c2e540c57cfe

MALICIOUS

PDF

4.5 KB Authoring application: Vabameuaki

MD5: fc38703b6d62fe8b8d88aec4351f42d4 SHA-1: 589286d7dd697dd55e040756dea3f5fc42534e8f SHA-256: 9894c2e540c57cfef481ffc0f4f4b94c526d23c73848c392b55eb37a3d9cba2c

86 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains embedded JavaScript, flagged by multiple heuristics as malicious. The JavaScript stream is likely responsible for downloading and executing a second-stage payload, as indicated by the 'PDF_PAGE_WORD_XOR_EVAL_STAGER' heuristic. The ML classifier strongly supports the malicious nature of the file. Due to the obfuscated nature of the script, the exact payload and delivery mechanism cannot be definitively determined, leading to an 'unknown family' classification and a moderate confidence score.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER

PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `1ec398366107a5fedd9bcf18a57f32d68d58e87986c8ad1c876f457b209e2152`	pdf-javascript-stream	PDF /JS object 11 at offset 0xCA2	815 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.