Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1e5daa3d77e4eb1…

MALICIOUS

PDF

264.8 KB Created: ¨¼E³z»?J¾3Œî³a¦œuå’6 Authoring application: ¼Õñ#ÿ{Uëo؍ã$þÅ(Aõ—?0 (via ­åì(î{ ?æpÀS·ê3ÿŒråŒ$"‰Èz›b+êd¢)
MD5: a62ae1864438d48409b8940f69b8df87 SHA-1: bd981b261a446e9a4eb6c37c202048a54038492a SHA-256: a1e5daa3d77e4eb1ba50b852ddeebf6b74814edd91e20931a52862e20482d26e
86 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

The PDF file contains multiple embedded JavaScript streams and is encrypted with JavaScript, indicating an attempt to obfuscate its true content and behavior. The presence of a Remote GoTo action and an AcroForm button with an action trigger further suggests malicious intent, likely to download and execute a second-stage payload. The document body is unreadable, reinforcing the idea that the malicious functionality is hidden within the scripts.

Heuristics 6

  • Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Remote GoTo action medium PDF_GOTO_REMOTE
    PDF references a remote or embedded document via GoToR/GoToE with an extension-less or unresolved target
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 1 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0235_000.js
21ff1985ca90afd3f26954f4cf8120c7a8faba8d0646acba6f2aab8c44418540		 pdf-javascript-stream PDF /JS object 235 at offset 0x2E269 48 bytes
javascript_obj0237_002.js
e4b2636d843d10bb85a952d7a6926edc7b7e2d33407d68d1b8a2adbec8b77df2		 pdf-javascript-stream PDF /JS object 237 at offset 0x2E2F0 48 bytes
javascript_obj0239_004.js
8d99df05ff1c2d688ef99b8899f2475b1daaab24dbdf9b27553a70beb7b5f94f		 pdf-javascript-stream PDF /JS object 239 at offset 0x2E376 48 bytes
javascript_obj0241_006.js
757d394d283147510f6978f809b49774d0f0a7367b28da3955dde3686e999670		 pdf-javascript-stream PDF /JS object 241 at offset 0x2E3FC 48 bytes
javascript_obj0243_008.js
3869f2f79db728b7a18f30153fcf7e1faf28f350d9de1466aed92646301771f6		 pdf-javascript-stream PDF /JS object 243 at offset 0x2E481 48 bytes
javascript_obj0245_010.js
2bcdb9752056d32e6ea4373a2a0642e801aaaa571215822012686a2df5d1b619		 pdf-javascript-stream PDF /JS object 245 at offset 0x2E50A 48 bytes
javascript_obj0247_012.js
0c905efcc91c49e9c0f08932319e99f500233fcf35a72bc064c03ff344ad9db1		 pdf-javascript-stream PDF /JS object 247 at offset 0x2E591 48 bytes
javascript_obj0249_014.js
f7725e52426110de0868f78e3b278f0c8b1570465b8470793053813d77aba461		 pdf-javascript-stream PDF /JS object 249 at offset 0x2E616 48 bytes
javascript_obj0251_016.js
1926e32070e39de8b8dbf2ff69d9ccc2cda6dbdbf7f514a6bc5a2c2deb87843d		 pdf-javascript-stream PDF /JS object 251 at offset 0x2E69B 48 bytes
javascript_obj0253_018.js
c3780615c892942c8f7f7ad1e75c2501080fdbb28a89c65f84a7f174df9d0a5c		 pdf-javascript-stream PDF /JS object 253 at offset 0x2E721 48 bytes
javascript_obj0255_020.js
2f90bfb9be192677b18c06097d8324b46d8b278a1ed57e288aafcd20e425dde7		 pdf-javascript-stream PDF /JS object 255 at offset 0x2E7A7 48 bytes
javascript_obj0257_022.js
93af495348f5fd7d3ad7f56a2115160732dd8e5e11e6397e5d7c3b81fd85faa2		 pdf-javascript-stream PDF /JS object 257 at offset 0x2E82D 48 bytes
javascript_obj0259_024.js
545bb7ca931885bcf3a7a2e990cebd2d142360afec5b616200022f461a9ce754		 pdf-javascript-stream PDF /JS object 259 at offset 0x2E8B5 48 bytes
javascript_obj0261_026.js
01866a6da4a539eb59e5910a64c483fca22c937e0d6bf2b6ae35e01b48137ae8		 pdf-javascript-stream PDF /JS object 261 at offset 0x2E93D 48 bytes
javascript_obj0263_028.js
ea556fc7765e1a53c0ee33b42e53a7254831d32727ab84338177fccf118bd973		 pdf-javascript-stream PDF /JS object 263 at offset 0x2E9C2 48 bytes
javascript_obj0265_030.js
814f32f5f0e82fdab7e284e9c7c1b9624618e9700c199e7b725a07d352d47e5a		 pdf-javascript-stream PDF /JS object 265 at offset 0x2EA48 48 bytes
javascript_obj0267_032.js
54224b5b94ddacb96bd881f785769554f65f7a889c9efad102d21f0239d68927		 pdf-javascript-stream PDF /JS object 267 at offset 0x2EACD 48 bytes
javascript_obj0269_034.js
ba5d3a82d7a6186de10c4d8df5ad080cc7dd714ea2403d6ee947247990356108		 pdf-javascript-stream PDF /JS object 269 at offset 0x2EB53 48 bytes
javascript_obj0271_036.js
d7e8242080d0ac9b9b1f75d01e05900c95dc62c525fa87f6511fb330ac3363de		 pdf-javascript-stream PDF /JS object 271 at offset 0x2EBD8 48 bytes
javascript_obj0273_038.js
55c161afaf1e7b3e948bd85962216eb6565cf6fd1dc5af856ed1fe592370573c		 pdf-javascript-stream PDF /JS object 273 at offset 0x2EC5D 48 bytes
javascript_obj0275_040.js
2795965cb371004cfc08c8d3bd656a65bba6575b7d097b31ff8b3917e47e9fbf		 pdf-javascript-stream PDF /JS object 275 at offset 0x2ECE2 48 bytes
javascript_obj0277_042.js
d08eb8699f8ac32b53575979590f673609f7b561ed76837ee6b875a779bca6ec		 pdf-javascript-stream PDF /JS object 277 at offset 0x2ED67 48 bytes
javascript_obj0279_044.js
cb9d339a9ca06d7588b05cd7fa364ce3d12e139cf1925f29771ea5d61d367709		 pdf-javascript-stream PDF /JS object 279 at offset 0x2EDED 48 bytes
javascript_obj0281_046.js
5b0213eee8e86e2b20cd35d8d96dd8775bcec20e67356dd43200b2cb9d3679d5		 pdf-javascript-stream PDF /JS object 281 at offset 0x2EE73 48 bytes
javascript_obj0283_048.js
b7f458649103eaa9f85607a36fe54ed860f81ef8c575f6041a2ac96832128639		 pdf-javascript-stream PDF /JS object 283 at offset 0x2EEF8 48 bytes
javascript_obj0285_050.js
be7d7d4693efec757511062873cfdecce0186033aa59c8d9b729a25ef0b45867		 pdf-javascript-stream PDF /JS object 285 at offset 0x2EF7D 48 bytes
javascript_obj0287_052.js
e7603c7c2f7f718bfcd1b707b43448289d940daa028dc833966d75661daf9cbd		 pdf-javascript-stream PDF /JS object 287 at offset 0x2F002 48 bytes
javascript_obj0289_054.js
4155493170964917cc7e3414c8a376442d24e281d7cc1d87976e89ee0aaafb0c		 pdf-javascript-stream PDF /JS object 289 at offset 0x2F088 48 bytes
javascript_obj0291_056.js
c06c76b5eafd368103fa7d7b151a588ad09414c989067124ce24d8e99a262079		 pdf-javascript-stream PDF /JS object 291 at offset 0x2F10D 48 bytes
javascript_obj0293_058.js
d72d08ac02cc7a4521ac07f82ea7f1b9bcaa1b6ae3eea6a8d5c89bd6ec9d8771		 pdf-javascript-stream PDF /JS object 293 at offset 0x2F194 48 bytes
javascript_obj0295_060.js
30b6d8ed47281de3a5da548e8481be8aeb1c61dcba533df0dac4f5d23d28cb40		 pdf-javascript-stream PDF /JS object 295 at offset 0x2F219 131 bytes
javascript_obj0296_061.js
16b94ac9aa99954150d74b9b45b0bf7dc0bda5290d04d19475082568a2446634		 pdf-javascript-stream PDF /JS object 296 at offset 0x2F2C5 38 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.