PDF malware analysis — malicious · a18c361e89d803b8

MALICIOUS

PDF

30.9 KB

MD5: fc9948b7908448266f0be236fba9237a SHA-1: 6bea7a0be66d8ff9eb74ece13757708e1fe37660 SHA-256: a18c361e89d803b85877a3687fce50af37af98ab200d3cb1df0910a0f9f2504a

136 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file exhibits multiple high-severity heuristic firings related to JavaScript execution and embedded rich media content, specifically a Flash object named 'GhouDiky.swf'. The presence of embedded JavaScript, including an 'eval()' call, and the ML classifier's strong indication of maliciousness suggest an attempt to execute arbitrary code. The embedded Flash file and JavaScript stream are likely components of a exploit or downloader chain.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 6

RichMedia (Flash) high PDF_RICHMEDIA

PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`GhouDiky.swf` `767382813fc770c9716554c3266b22eee1636037ca964af05acf6ff66db4a27d`	pdf-embedded-file	PDF EmbeddedFile object 16 at offset 0x1080	26993 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.98, consistent with packed or encrypted content.
`javascript_obj0006_000.js` `4b870e71212ad5638fbd079681a6688e5a32abb251adfde0fe9bc86529d66380`	pdf-javascript-stream	PDF /JS object 6 at offset 0xF9	3133 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.