Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1fa74bc6ada06c2…

MALICIOUS

PDF

1.2 KB
MD5: bf3377be22176f20ef0f717bbd5391ab SHA-1: 10590c2b3a449e20b0a47532b1f5d5b1efa042f1 SHA-256: b1fa74bc6ada06c24c9fe7c2e0f916424bdd3b9175f18d294014c012ccb2f3b7
84 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: Malicious File

The PDF contains embedded JavaScript and RichMedia (Flash) content, indicated by heuristic firings. The presence of ASCIIHexDecode filter with exploit indicators suggests an attempt to obfuscate malicious code. The embedded file name 'WGuAULiUrCKU.swf' is also suspicious. These elements combined point to a likely exploit delivery mechanism within the PDF.

Heuristics 5

  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload