PDF malware analysis — malicious · 9ff9d947e77438a9

MALICIOUS

PDF

4.5 KB Authoring application: Vabameuaki

MD5: d9fcc7c27f6f9082b5e908e7ba4081fa SHA-1: 016344c1684a0246b80188b03abe3f8ce80a31bd SHA-256: 9ff9d947e77438a9368e2eba7edaa8f3ce9f5dac2b1931d72e16b62f0a61d18f

86 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains embedded JavaScript, identified by multiple heuristics as a stager. This script is highly obfuscated but appears to be designed to execute further malicious code. The ML classifier strongly indicates maliciousness. The primary IOC is the file hash itself, as the specific payload and delivery mechanism are not fully discernible from the provided evidence.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER

PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `1ec398366107a5fedd9bcf18a57f32d68d58e87986c8ad1c876f457b209e2152`	pdf-javascript-stream	PDF /JS object 11 at offset 0xCA2	815 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.