PDF malware analysis — malicious · b50c2f9327a0deed

MALICIOUS

PDF

47.3 KB Authoring application: PyPDF2

MD5: 0dc0b623ca7a60b68ba27e17b7e9822a SHA-1: 06bbf0d796cb11fef9293a9be3f5b0b26d700a97 SHA-256: b50c2f9327a0deed9d1ce6f2e5bedd18e3b2a579a6404240a7b0f102dd4cda35

244 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF contains obfuscated JavaScript, flagged as a PDF JavaScript exploit cluster and an ActiveX downloader. The script attempts to download a second-stage payload, indicated by the 'deobfuscated.js' artifact and the 'PDF_JS_ACTIVEX_DOWNLOADER' heuristic. The embedded URL, while benign, is likely a lure. The ML classifier strongly indicates maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.9856

Heuristics 9

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
PDF JavaScript ActiveX downloader high PDF_JS_ACTIVEX_DOWNLOADER

Decoded PDF JavaScript instantiates Windows ActiveX/COM objects to download a payload over HTTP, write it through ADODB.Stream, and execute it through WScript.Shell/rundll32-style process launch. This is commodity downloader behavior rather than a specific Acrobat CVE trigger.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
String.fromCharCode low PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.
External URI low PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.irs.gov/privacy/article/0,,id=122989,00.html

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0010_000.js` `b54d2017d9d357cbefd15a394d30cf10b3f185f90a797f4072a00e5cbeae770e`	pdf-javascript-stream	PDF /JS object 10 at offset 0x84D	24779 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s). Carved artifact contains 3 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
`embedded_pdf_script_000012b4.bin` `98ae9c8f421bba53946a88fdba8d70409dac5a193a9d0a83c96823ac60060422`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x12B4	48466 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s). Carved artifact contains 3 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
`deobfuscated.js` `f6bad5e9aa4e43b84e8bffd9ba4d5e5d0149ca16939ad821cff867f8d6a3d10a`	deobfuscated-js	PDF JavaScript deobfuscation pass	75424 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s). Carved artifact contains 6 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.