Malicious PDF — malware analysis report

Static analysis result for SHA-256 a0cb29f3065660c6…

MALICIOUS

PDF

72.9 KB Created: à µ»2¾€Ut|ä}yHØ ®€5yEê Authoring application: ðõèçhåÄC-8 >sQÇLô\›s*¤FcöêP_@J
MD5: 972604c3bec33d209098aa805add2250 SHA-1: 9b99abade9c7a5b7a40297be584053a8b4404960 SHA-256: a0cb29f3065660c6e6eeac8f0210b4fe28cd1775c731382ef20f082d29d89a43
66 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by multiple PDF_JAVASCRIPT and PDF_JS heuristic firings. The PDF_ENCRYPTED_WITH_JS heuristic suggests that the JavaScript is used to obscure the malicious payload, making static analysis difficult. The presence of JavaScript actions and encrypted content points towards a delivery mechanism designed to evade detection and execute further malicious code. No specific IOCs were extracted from the JavaScript itself.

Machine Learning

  • Nyx PDF Classifier clean score 0.0962

Heuristics 5

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0039_000.js
4558303bcb7cf02e5f0f7a0cb864336c422d75f28117c54dd29bc1c45d803a64		 pdf-javascript-stream PDF /JS object 39 at offset 0x6EBA 105 bytes
javascript_obj0080_001.js
f350d3e6f6cb82b1e666b1ebf83595f6d55df09aa70503eec2e2197dd3751ae6		 pdf-javascript-stream PDF /JS object 80 at offset 0x9690 105 bytes
javascript_obj0099_002.js
7baff75ea0cdafee24ebc87d906f470de7638f6bd9cac9db3818ed0c88049ff0		 pdf-javascript-stream PDF /JS object 99 at offset 0xC3EA 105 bytes
javascript_obj0104_003.js
8d0627188bb795f09718aa78202b5420931794db13d473b36205201de8d6a226		 pdf-javascript-stream PDF /JS object 104 at offset 0xC737 38 bytes
javascript_obj0105_004.js
6fdac041dcf5bb09e25cb7b3bf65df5ce92710c9a6beb1d6a0b380e5bd4bc946		 pdf-javascript-stream PDF /JS object 105 at offset 0xC78E 41 bytes
javascript_obj0116_005.js
a145cb36fbf4cd06123bbd6f7d7c6fab821b7e68b157236aa6948af2909ff0c7		 pdf-javascript-stream PDF /JS object 116 at offset 0xCFC6 38 bytes
javascript_obj0117_006.js
450e8db271fb4c6cf9a3ddd191a383da5425690895314601b2f964f486de71c7		 pdf-javascript-stream PDF /JS object 117 at offset 0xD01D 41 bytes
javascript_obj0131_007.js
606ed1824daf2a62d8a993617741db092ce74925f83be9b93b65afa6380deafa		 pdf-javascript-stream PDF /JS object 131 at offset 0xDAF9 38 bytes
javascript_obj0132_008.js
1ea9a3ba6fc9d8c81213dc6a4619999beeecc5fcba354df661460d39a78f0432		 pdf-javascript-stream PDF /JS object 132 at offset 0xDB52 41 bytes
javascript_obj0139_009.js
0e5fa839970a1df17d9db7d63a6c22c22fbb5119b253df900203c3062b4aebdb		 pdf-javascript-stream PDF /JS object 139 at offset 0xE2F1 105 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.