PDF malware analysis — malicious · 9f3c0bd24a765d11

MALICIOUS

PDF

2.02 MB Authoring application: Python PDF Library 055 http072057057pybrary056net057pyPdf057

MD5: db0c660008ccd4e48fda47f08df8da40 SHA-1: ba865a8f3ca40f6a1e8ac50553f1dc86266884e0 SHA-256: 9f3c0bd24a765d11736910145908e7d7ef7813a8e31947cd943b6dbd6d1fde5f

154 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 JavaScript/JScript T1559.001 Component Object Model Hijacking

The PDF contains multiple indicators of malicious intent, including embedded JavaScript, a RichMedia (Flash) object, and a secondary embedded PDF. The ML classifier strongly flags this PDF as malicious. The secondary PDF, identified as 'polyglot_child_pdf_off002038bd.pdf', also exhibits suspicious static findings, including JavaScript and embedded files, suggesting it is the primary vector for exploitation or further payload delivery. The presence of a Flash object further supports a multi-stage attack.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 6

Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
RichMedia (Flash) high PDF_RICHMEDIA

PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://adobe.com/AS3/2006/builtin

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`pushpro.swf` `f30a754153ec4fca6ea9fb770704c65d16bb94933b633b8d6ec5725c761d79c6`	pdf-embedded-file	PDF EmbeddedFile object 7 at offset 0xB4F	772 bytes
`polyglot_child_pdf_off002038bd.pdf` `870ecdac38615ef806589623760c44202a66dd9582f35efa3d51151483eb38d0`	polyglot-child-pdf	Secondary PDF body inside pdf container at offset 0x2038BD	6297 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.