Malicious PDF — malware analysis report

Static analysis result for SHA-256 a01df16605f89e78…

MALICIOUS

PDF

42.0 KB Created: 2006-05-11 09:45:30 +03:00 Authoring application: Adobe Acrobat 7.0 (via Adobe Acrobat 7.0 Image Conversion Plug-in)
MD5: f8384b0ec64f5f8d6a8ff1b9cceaefd1 SHA-1: 5b8b0535ccf6a6df609f25a13d08dbede61846d4 SHA-256: a01df16605f89e789f15ac0e09d73e49ccf57e97a203f72ba0ac0f2f17e8b3eb
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document is identified as malicious by an ML classifier and exhibits characteristics of a phishing lure, including being image-heavy with a clickable action. The presence of JBIG2 decoding and a launch action suggests an attempt to exploit PDF vulnerabilities or deliver a payload. The document body is heavily obfuscated, preventing a clear understanding of its specific content, but the overall structure points to a user-interaction-based attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7645

Heuristics 6

  • JBIG2Decode filter medium PDF_JBIG2
    JBIG2 image decoder present — historically used in zero-click exploits
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 42 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Launch action low PDF_LAUNCH
    PDF contains a /Launch action; all filespec targets are document files (cross-PDF navigation pattern, common in multi-part document bundles)
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
jbig2_00_off00000666.bin
14fd8cb829b3093dc8dc363f2c9a8a5df3987ef3626bcb64eb47353b79ec441e		 pdf-jbig2-stream PDF JBIG2 stream at offset 0x666 7023 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.97, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.