PDF malware analysis — malicious · aa055a1d97e16893

MALICIOUS

PDF

211.8 KB Authoring application: PyPDF2

MD5: f3827db93ec3bc9296d9fed795465622 SHA-1: c9f55cc1557e03f398186a6c3dd23744b1cc8adc SHA-256: aa055a1d97e168933dff28246da995de0b1ff9e5e19d9e2dd4a54001cd51d78e

114 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment T1071.001 Web Protocols

The PDF contains embedded JavaScript, flagged by multiple heuristics including 'PDF_JAVASCRIPT', 'PDF_JS', and 'PDF_EVAL'. The ML classifier also strongly indicates maliciousness. The presence of 'eval()' suggests code execution, and the extracted URI 'http://www.irs.gov/form1120s' is likely a lure. The embedded JavaScript files, particularly 'new_array_token_stage_000.js', are suspicious and likely responsible for downloading and executing a second-stage payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9895

Heuristics 5

eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI low PDF_URI

PDF contains an external URL action

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js` `7c26acb957b8e694c968ea169caf0b5f8dcf86ce87b7b7bf4bbcea3bd77ab65f`	pdf-javascript-stream	PDF /JS object 7 at offset 0x597	91847 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
`javascript_obj0007_001.js` `f7b8da7eea31ea959aba5bf50841e7575b08d6e632b91384cbd402a4e5cae0d9`	pdf-javascript-stream	PDF /JS object 7 at offset 0x597	90479 bytes
`new_array_token_stage_000.js` `d06bc22e4e316870babf7df2b3d8a058f85aac8c0d8a489a11c75bffdfe36bac`	deobfuscated-js	new-array token-map decoded JavaScript object 7 at offset 0x59F	16536 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.