PDF malware analysis — malicious · b10ab3eada775cbe

MALICIOUS

PDF

15.8 KB Created: 2007-12-35 21:45:26 Authoring application: Adobe

MD5: 13e5c8d01d3a8ab1bbbc5db7e50551bc SHA-1: f480f58fac7c310ae7ea0533a4ba6fb768449878 SHA-256: b10ab3eada775cbeb4ce420389aa26f461b4d95e1506c21e3571f0fab192328d

88 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.007 JavaScript

The PDF contains embedded JavaScript, with heuristics indicating the use of eval() and obfuscation. The ML classifier strongly suggests maliciousness. The embedded JavaScript streams, particularly 'javascript_obj0036_002.js', are the primary indicators of malicious activity, likely serving to download and execute a secondary payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 4

eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0032_000.js` `1439a0291d98cd05658671e864206c3f67722dd54328daff0ca7192304bccb0f`	pdf-javascript-stream	PDF /JS object 32 at offset 0x348	1471587 bytes
`javascript_obj0034_001.js` `443e0cc5892568edc532cb6f6d75959bd74925c28415c789a9b8cdea94fd0a1f`	pdf-javascript-stream	PDF /JS object 34 at offset 0x3CA3	323 bytes
`javascript_obj0036_002.js` `d35666f2e142fa0a781cc810ed457f02794f96867ac25bfac2a189e776337636`	pdf-javascript-stream	PDF /JS object 36 at offset 0x75	416 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.