Malicious PDF — malware analysis report

Static analysis result for SHA-256 a48291fc016f1cc4…

MALICIOUS

PDF

40.1 KB Created: “ÆP!«^s Ó'õkð^l萧£ä Authoring application: )Ûô#énPAùácÇ1 (via )Ûô0énZAüábÇ=Â5.)
MD5: 818f8d6f6a6735f5f358bcdf414f5763 SHA-1: 27afe52cc0964f949ce58bd767d90d39c09c70d2 SHA-256: a48291fc016f1cc4c7fa033d6a4eae6ba1dddd2dd891eb98b6ebb42edddc7172
64 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

The PDF file is encrypted and contains JavaScript, indicating an attempt to obfuscate malicious content. The embedded JavaScript stream, 'javascript_obj0009_000.js', is likely responsible for executing the hidden payload. The presence of JavaScript actions within an encrypted PDF strongly suggests a multi-stage attack designed to bypass static analysis and deliver a malicious payload, potentially for phishing or financial fraud.

Heuristics 4

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0009_000.js
ed5ad195acc854a814023cde1253c3498eb0baad7fa786a3b179dddf4cb267bc		 pdf-javascript-stream PDF /JS object 9 at offset 0x3BC 38294 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.