Malicious PDF — malware analysis report

Static analysis result for SHA-256 a0cb29f3065660c6…

MALICIOUS

PDF

72.9 KB Created: à µ»2¾€Ut|ä}yHØ ®€5yEê Authoring application: ðõèçhåÄC-8 >sQÇLô\›s*¤FcöêP_@J First seen: 2015-09-30
MD5: 972604c3bec33d209098aa805add2250 SHA-1: 9b99abade9c7a5b7a40297be584053a8b4404960 SHA-256: a0cb29f3065660c6e6eeac8f0210b4fe28cd1775c731382ef20f082d29d89a43
64 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by multiple PDF_JAVASCRIPT and PDF_JS heuristic firings. The PDF_ENCRYPTED_WITH_JS heuristic suggests that the JavaScript is used to obscure the malicious payload, making static analysis difficult. The presence of JavaScript actions and encrypted content points towards a delivery mechanism designed to evade detection and execute further malicious code. No specific IOCs were extracted from the JavaScript itself.

Machine Learning

  • Nyx PDF Classifier clean score 0.0962

Heuristics 4

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 16

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0117_000.js pdf-javascript-stream PDF /JS object 117 at offset 0xCA09 105 bytes
SHA-256: 78a57907cd9a76229fa42a10c7d89341686261472e3b3d455fcb809dfbef1e8c
Preview script
First 1,000 lines of the extracted script
var MyField = this.getField("tcURL");
this.submitForm({ cURL: MyField.value, cSubmitAs: "HTML" });
javascript_obj0138_001.js pdf-javascript-stream PDF /JS object 138 at offset 0xEE5D 38 bytes
SHA-256: ae95d6581723cae0c2c1e3044a60f6c91e032264799b53449cd6269e6993d7bc
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 0, 0, 0, "", true);
javascript_obj0139_002.js pdf-javascript-stream PDF /JS object 139 at offset 0xEEB2 41 bytes
SHA-256: 617ef4da07d9bc9d4e06a2320fe0d4cbacd3d6c2cc82039cf4e79e7facf7545f
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 0, 0, 0, "", true);
javascript_obj0104_003.js pdf-javascript-stream PDF /JS object 104 at offset 0x7750 328 bytes
SHA-256: 05944e897f71d2b0aa107c08e58fca7c3e4e97b044d6390e2758042d2565fada
Preview script
First 1,000 lines of the extracted script
var f;var c = this.getField('cmdHideBorders');c.display = display.hidden;c = this.getField('cmdShowBorders');c.display = display.noPrint;for (var i=0; i<this.numFields; i++) {f = this.getField(this.getNthFieldName(i));if (f.display!=display.noPrint && f.display!=display.hidden && !f.readonly)f.strokeColor = color.transparent;}
javascript_obj0116_004.js pdf-javascript-stream PDF /JS object 116 at offset 0xC8D9 391 bytes
SHA-256: e59e793300727c4e9f0188d3a4db914a851809288aa5b0b79decea8284bdc0f1
Preview script
First 1,000 lines of the extracted script
var f;var c = this.getField('cmdShowBorders');c.display = display.hidden;c = this.getField('cmdHideBorders');c.display = display.noPrint;for (var i=0; i<this.numFields; i++) {f=this.getField(this.getNthFieldName(i));if (f.display!=display.noPrint && f.display!=display.hidden && !f.readonly)f.strokeColor = color.ltGray;}app.alert('Be sure to hide borders before printing the document.', 3);
javascript_obj0144_005.js pdf-javascript-stream PDF /JS object 144 at offset 0xF064 292 bytes
SHA-256: 22761cc73fff8b1e5226b696694a1e6dbdbe795f946b1cd45f1389a5750e1234
Preview script
First 1,000 lines of the extracted script
var MyField = this.getField("ID");
if (MyField.value.substr(0,5) ==
   "temp;")
{
 for (var i=0; i<this.numFields; i++)  {f=this.getField(this.getNthFieldName(i));
  if (f.display!=display.noPrint &&       f.display!=display.hidden &&       !f.readonly)
  { f.strokeColor =color.ltGray;}
 }
}
javascript_obj0039_000.js pdf-javascript-stream PDF /JS object 39 at offset 0x6EBA 105 bytes
SHA-256: 4558303bcb7cf02e5f0f7a0cb864336c422d75f28117c54dd29bc1c45d803a64
Preview script
First 1,000 lines of the extracted script
1  �� A� qv1 ҫ�3ꁈD\�a%�해��
 R�AI�Hl ^�l�k$p���E� ���ު�� h7>~ �X�s%�
�pl � ��h�F��:HGo^M'�J�\�ݫ�u
javascript_obj0080_001.js pdf-javascript-stream PDF /JS object 80 at offset 0x9690 105 bytes
SHA-256: f350d3e6f6cb82b1e666b1ebf83595f6d55df09aa70503eec2e2197dd3751ae6
Preview script
First 1,000 lines of the extracted script
�D�  �,�� (~�� �zԙ	��
 �E|O�
��L�\�Y� �S,�	���]W�Ki)?iV��� ��/���   J�$N� 8 w� > s ��� X˄�*�!�,)��B�
javascript_obj0099_002.js pdf-javascript-stream PDF /JS object 99 at offset 0xC3EA 105 bytes
SHA-256: 7baff75ea0cdafee24ebc87d906f470de7638f6bd9cac9db3818ed0c88049ff0
Preview script
First 1,000 lines of the extracted script
�ƾZ�dG��\ �R��*�:��N����{_#b}��V & ��C��j ~�  �0��W� ���S�@ ބ?��� ���`v� � .4e{��ߐ���j  �ћ�	�4I\;|
javascript_obj0104_003_1.js pdf-javascript-stream PDF /JS object 104 at offset 0xC737 38 bytes
SHA-256: 8d0627188bb795f09718aa78202b5420931794db13d473b36205201de8d6a226
Preview script
First 1,000 lines of the extracted script
?�X��R����5�~e�i�@,  /  $vMx�Q�K  ̀.
javascript_obj0105_004.js pdf-javascript-stream PDF /JS object 105 at offset 0xC78E 41 bytes
SHA-256: 6fdac041dcf5bb09e25cb7b3bf65df5ce92710c9a6beb1d6a0b380e5bd4bc946
Preview script
First 1,000 lines of the extracted script
� �tu���e����8_�����yՉ� 1;h8�~ߴ�{;��{��
javascript_obj0116_005.js pdf-javascript-stream PDF /JS object 116 at offset 0xCFC6 38 bytes
SHA-256: a145cb36fbf4cd06123bbd6f7d7c6fab821b7e68b157236aa6948af2909ff0c7
Preview script
First 1,000 lines of the extracted script
�N�>W���6p6��g��:���3���QJ  ��p��' b
javascript_obj0117_006.js pdf-javascript-stream PDF /JS object 117 at offset 0xD01D 41 bytes
SHA-256: 450e8db271fb4c6cf9a3ddd191a383da5425690895314601b2f964f486de71c7
Preview script
First 1,000 lines of the extracted script
'+ ���  ��GY.��)��܌o2�O^w����~8� ��t�c��
javascript_obj0131_007.js pdf-javascript-stream PDF /JS object 131 at offset 0xDAF9 38 bytes
SHA-256: 606ed1824daf2a62d8a993617741db092ce74925f83be9b93b65afa6380deafa
Preview script
First 1,000 lines of the extracted script
Q ����{��Q
�  �� qC�N��
� �o?׿t�a�3dO
javascript_obj0132_008.js pdf-javascript-stream PDF /JS object 132 at offset 0xDB52 41 bytes
SHA-256: 1ea9a3ba6fc9d8c81213dc6a4619999beeecc5fcba354df661460d39a78f0432
Preview script
First 1,000 lines of the extracted script
��p
�Y�e�az�'�Y� �ڽ�Ͳ%�2�o6%��[�D�A/��
javascript_obj0139_009.js pdf-javascript-stream PDF /JS object 139 at offset 0xE2F1 105 bytes
SHA-256: 0e5fa839970a1df17d9db7d63a6c22c22fbb5119b253df900203c3062b4aebdb
Preview script
First 1,000 lines of the extracted script
|�F2%� J �W�y�� �:i\�j�l�j��)9��g`pG<" ��Q >|�����P˝��1�h�h�,LIS��F��k��w����� �s���� ��5� �zY�� ��ߔ

Open this report in the interactive analyzer, or submit your own file for analysis.