MALICIOUS
66
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious File
T1059.007 JavaScript
The PDF file contains embedded Flash content (QhKUfNpkR.swf) and a JavaScript stream, both flagged as suspicious. The presence of these embedded objects suggests an attempt to execute malicious code or exploit vulnerabilities within the PDF viewer or associated plugins. The JavaScript, while not fully analyzed due to its nature, is likely involved in the execution chain.
Heuristics 5
-
RichMedia (Flash) high PDF_RICHMEDIAPDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
QhKUfNpkR.swf54da439aa1b6c2cd82f5c9dd3b62f089f70963a649386e5cbf1c1f8076517727 |
pdf-embedded-file | PDF EmbeddedFile object 16 at offset 0xBAD | 26993 bytes |
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.
|
|||
javascript_obj0006_000.jsd0c093358729cb4f1565d1ddb92d5a232c51deb449ec65f9a68fe98ab7137e1d |
pdf-javascript-stream | PDF /JS object 6 at offset 0xF9 | 1896 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.