Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1e31c216b41dfeb…

MALICIOUS

PDF

205.9 KB
MD5: e395791e8d8cc8bd6daf042c682c9730 SHA-1: ed56de7dd19abf896042f063b5f154aa254c2305 SHA-256: a1e31c216b41dfeb9722d5ec1dbcd103726617bd08cae2d1f60ad887811004a8
130 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by multiple PDF_JAVASCRIPT and PDF_JS heuristics. A high-confidence PDF_EVAL heuristic firing suggests that the JavaScript is being executed, and the PDF_JS_PROTOTYPE_POLLUTION firing points to a specific JavaScript exploitation technique. The presence of a large embedded script payload (stream_009_off000012b6.js) further supports this. The script likely downloads and executes a second-stage payload. The URL http://www.irs.gov/efile was found, but it is confirmed benign and likely used as a lure.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3804

Heuristics 9

  • Prototype-pollution JavaScript pattern high CVE related PDF_JS_PROTOTYPE_POLLUTION
    PDF JavaScript mutates object prototypes while also referencing privileged or sensitive PDF APIs. This tracks a modern PDF exploit technique family without assigning an unverified CVE.
  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.xfa.org/schema/xfa-form/2.8/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xfa/promoted-desc/
    • http://www.irs.gov/efile

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00000386.js
529357503ec67b623d2a12816cdeea62bd639f2b4ff4e568b01c96cc3f5bfc6f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x386 1363 bytes
stream_003_off00000563.js
e985b5df65c8c3cf732a9074b575fbc594c1c7f0bccc0994182ec7e5c0f7308a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x563 902 bytes
stream_008_off00000ef8.js
352c05d8bb10578bb0560e207b459b5d7c52c916d056a0a48879aae99356c291		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEF8 2216 bytes
stream_009_off000012b6.js
dadd71ed7ba6754a38269d8c244f4a254ede7a281174391cc4ae9d4bb9632483		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x12B6 981480 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s). Carved artifact contains 6 long base64-like blob(s).
stream_010_off0002c8bc.bin
66d744562f32240bf6bbcadd526d2ea3224217fe335fcfa6bb50d71b548be872		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2C8BC 5694 bytes
stream_011_off0002cc4a.bin
1077dc2166d3af98a257cd27a25f6ec6334bfdd4b7e12a6ea1c9ed2f28f65990		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2CC4A 348 bytes
stream_012_off0002cd85.bin
fdb0bd2accba123a1340c33bfc1c2ab7cdea24aa635eba1fa49f8e718009100e		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2CD85 12814 bytes
objstm_0053_00.bin
9b69ee277c16dffbcfd62d1e7ca04a23c7188dcd40258e21ce7b5161ef4505a6		 pdf-objstm-decoded PDF /ObjStm 53 0 obj (inflated) 790 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.