PDF malware analysis — malicious · b5ad99015dca2402

MALICIOUS

PDF

239.8 KB Created: 2014-05-30 04:25:25 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 2.5.000_PHP4 (http://www.tcpdf.org))

MD5: b46d09378e26794b861031a1692020e6 SHA-1: f00a29180614dfec8aa8358129688d66d048acac SHA-256: b5ad99015dca24024d1b5ba4962bb657dcf128b8099aff5bcdfdc70f1647e51a

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF was flagged by multiple heuristics as malicious, including ML classification and detection of embedded JavaScript. The presence of obfuscated JavaScript within a PDF stream strongly suggests an attempt to deliver a malicious payload. The ML classifier output of 0.955 indicates a high likelihood of maliciousness. The primary attack pattern involves leveraging the PDF format to hide and execute malicious scripts, likely for downloading further stages.

Machine Learning

Nyx PDF Classifier malicious score 0.9551

Heuristics 3

Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_002_off0000bb3a.bin` `a5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xBB3A	264072 bytes
`embedded_pdf_script_0003adc4.bin` `60fc108b1a2efa12ee34647232ad55690065f90125eaa0aecca042424b855153`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x3ADC4	245576 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.