PDF malware analysis — malicious · b15f044c280ff85e

MALICIOUS

PDF

405.6 KB

MD5: d00e4ac94f1e4ff67e0e0dfcf900c1a8 SHA-1: 04b0cac6a574f26fef1ef135b4b1ac604433dee2 SHA-256: b15f044c280ff85ed9145e6614c0ac6ee4eb4ae233faed3543d77d0992cb2480

134 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.007 JavaScript

The PDF contains embedded JavaScript, with high-confidence heuristics indicating the use of eval() and unescape() for obfuscation. The ML classifier strongly suggests malicious intent. The JavaScript is likely responsible for downloading and executing a second-stage payload, as indicated by the presence of obfuscated code and the IP address '10.0.1.434' which may be a command and control server or download source.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 5

eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0001_000.js` `dbf2b563944354536cd472733310ee3c9e5780686e4e5cd639764efd7ba740c1`	pdf-javascript-stream	PDF /JS object 1 at offset 0xA	67070 bytes
`stream_000_off00047995.js` `dcefc16710d335e69f60cdd8a0e174d43939d02eaa8dd4c6d7ce4ca63f06495b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x47995	289498 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.