PDF malware analysis — malicious · b746587749fe43b3

MALICIOUS

PDF

5.3 KB Created: 2010-08-07 09:35:52 Authoring application: Wojifajameru (via fc705Jecomoqizeqixovo)

MD5: ca3e3337823f63d2cfcc27f983420ffc SHA-1: 74f78ff6adc9803b1e7a1652dca3dd12bd0b5563 SHA-256: b746587749fe43b3ec5afb61563403a7168519abf2764ffe4ed46007733919fc

136 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains high-severity heuristic firings indicating an embedded script payload and a JavaScript eval stager. The extracted JavaScript file, 'javascript_obj0011_000.js', is likely responsible for downloading and executing a second-stage payload. The obfuscated nature of the script and the presence of a payload suggest a downloader or droppper functionality.

Heuristics 5

Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER

PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `1e67d6d2c5d97afa0e6512e1bcf867e23c4d4211ffa93bd8a051e8be9ce5d2e9`	pdf-javascript-stream	PDF /JS object 11 at offset 0xE84	1461 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s). Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.