PDF malware analysis — malicious · b6998a371092b8c2

MALICIOUS

PDF

4.4 KB Created: 2008-09-07 22:47:39 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12)

MD5: 1d516e88a68257e8dc62e315ee1b6ddf SHA-1: 1a57123cb4b66b21155f733a328ec0a14993d970 SHA-256: b6998a371092b8c2d5022844e0310479f7d907057ce6ac0aa260edd3a7351978

88 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.007 JavaScript

The PDF file contains embedded JavaScript streams, with one heuristic firing indicating an eval() call, suggesting code execution. The ML classifier strongly flags this PDF as malicious. The presence of obfuscated JavaScript, indicated by the extracted file names and heuristic signals, points towards an attempt to download and execute a secondary payload. The specific JavaScript content is heavily obfuscated, making it difficult to determine the exact payload or destination, but the overall pattern is consistent with a malicious dropper.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0013_001.js` `2ee8508e51061f9368a4a35c244f9dce3180dda3d940109d2c4a1d229573c022`	pdf-javascript-stream	PDF /JS object 13 at offset 0x38E	2981 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
`javascript_obj0013_002.js` `d5fd4b60144b8a08475235ecae7d72a766d63ed997310656edf5769f6e58b4a7`	pdf-javascript-stream	PDF /JS object 13 at offset 0x3B0	3578 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.