Malicious PDF — malware analysis report

Static analysis result for SHA-256 b845d8f2eacc1e58…

MALICIOUS

PDF

767.5 KB Created: —ã ,”xÏò7ªåVkí)UR Authoring application: ’ºJsÆ-‹áBó¦3²q z£Ò©™æ† 'Ê7 ‡
MD5: ab8d1075a9e1e12aae2db3c600724788 SHA-1: 899dcab300b64b5cd50102c29587e4c89165a9fd SHA-256: b845d8f2eacc1e586a8ad83fa5778dc23684c662fd5c6f3fc14e22b7c1c06ded
66 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

This PDF file is flagged as malicious due to the presence of JavaScript actions and encrypted content, indicating an attempt to conceal a payload. The PDF is image-only, suggesting a lure to trick the user into interacting with the document. The embedded JavaScript streams are likely responsible for executing the malicious payload, potentially for phishing or malware distribution.

Heuristics 5

  • Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj1118_000.js
e016fc476308fdb5799f559643e52f45c4f7742d7059e687580ba46528308afc		 pdf-javascript-stream PDF /JS object 1118 at offset 0x189E9 46 bytes
javascript_obj1120_002.js
d2222a67bcee00ba661101b6fa795da63183f51f95e8ef097f2f576550974336		 pdf-javascript-stream PDF /JS object 1120 at offset 0x18A88 46 bytes
javascript_obj1125_003.js
200047cca0a407e0852a15241b8c1a966a14b1f5d535f265b4748af16b706827		 pdf-javascript-stream PDF /JS object 1125 at offset 0x1999F 62 bytes
javascript_obj1126_004.js
50a1a1cca453fcb7187fca212fc3a88fbe66e052783a2b88aecd848915a54bdf		 pdf-javascript-stream PDF /JS object 1126 at offset 0x19A11 52 bytes
javascript_obj1127_005.js
8d3197bcf2f9db94b43f5fbd6ad289743eff60862c6d9d1693d05bcb0a513995		 pdf-javascript-stream PDF /JS object 1127 at offset 0x19A76 62 bytes
javascript_obj1128_006.js
e18746e1919cb7594476a800ada4c2bb6a1c2df48f099a26ce122ed35f9f47e4		 pdf-javascript-stream PDF /JS object 1128 at offset 0x19AE6 62 bytes
javascript_obj1129_007.js
fed978374ce3886ae08becc597faf67ed4535cb82942603b90b401a185724f55		 pdf-javascript-stream PDF /JS object 1129 at offset 0x19B56 62 bytes
javascript_obj1130_008.js
26537af935ffe0feb73b933a227db49402a5b6e5f72d34e5095ec235d789daee		 pdf-javascript-stream PDF /JS object 1130 at offset 0x19BC8 62 bytes
javascript_obj1131_009.js
06db6fb7ba4d90b359b1e848668f132439dccaf1fda4a290c22d27c3659ec517		 pdf-javascript-stream PDF /JS object 1131 at offset 0x19C39 52 bytes
javascript_obj1135_010.js
0b774c1859392c4c233103beefab4e5aa06f95789bc65642ae081686d9610d54		 pdf-javascript-stream PDF /JS object 1135 at offset 0x19DF0 52 bytes
javascript_obj1186_011.js
38365001ac2679acddb6488d1633d7f29f8161439d945df2c8e540cc3446a786		 pdf-javascript-stream PDF /JS object 1186 at offset 0x1B09F 83 bytes
javascript_obj1187_012.js
cf7a4feeb5ad6927d28d2c80ff0c60d6371b13332710bc587527ae5f8a546eed		 pdf-javascript-stream PDF /JS object 1187 at offset 0x1B128 86 bytes
javascript_obj1188_013.js
34bc3e3aff4907a07cea1c18e8cc2f29405bd4dcfcb2c9ee1de87db6effb5551		 pdf-javascript-stream PDF /JS object 1188 at offset 0x1B1B3 86 bytes
javascript_obj1195_014.js
e9992d80dd4f4f82a2a62d7089243f05f27d81480dc30ad3d62941459f04856e		 pdf-javascript-stream PDF /JS object 1195 at offset 0x1B702 83 bytes
javascript_obj1196_015.js
604405d95b0c109ec33198e3440e07a32505d37750f5d8ee8ff93bf1a689124b		 pdf-javascript-stream PDF /JS object 1196 at offset 0x1B78C 83 bytes
javascript_obj1197_016.js
22c0387aafeda28016b5e826653d42f0accc655ad4868ebff89ef68f2bd7985e		 pdf-javascript-stream PDF /JS object 1197 at offset 0x1B813 54 bytes
javascript_obj1198_017.js
d5ca1bc92dc98c81bac4f48db308b1ede2e7ecbc4d0a605835bc6b055a8d898a		 pdf-javascript-stream PDF /JS object 1198 at offset 0x1B87C 54 bytes
javascript_obj1199_018.js
dfe358a9d9082f12a7b0f668dfaa917d269f47251d5ff21a4b78f19d0888b190		 pdf-javascript-stream PDF /JS object 1199 at offset 0x1B8E3 148 bytes
javascript_obj1200_019.js
dabb68e73bc0c30fd4a9830b5c9fe002be3830df9db00d64335fa7cfda6f3a1d		 pdf-javascript-stream PDF /JS object 1200 at offset 0x1B9B0 148 bytes
javascript_obj1201_020.js
e65d11f117a78b407fa5157950f269d6945bd18cac1c8085d51c7f450ae6060a		 pdf-javascript-stream PDF /JS object 1201 at offset 0x1BA7F 234 bytes
javascript_obj1202_021.js
7e79f635a93f75502a0a5c42b5bfbb3988c93dcce3a1dd6e5b7e14fd1f123a0c		 pdf-javascript-stream PDF /JS object 1202 at offset 0x1BBA5 87 bytes
javascript_obj1203_022.js
553524dcc95b460dbce1924d7647e7b94d73fcff7f6fa9c3b87f0763655a11a8		 pdf-javascript-stream PDF /JS object 1203 at offset 0x1BC31 87 bytes
javascript_obj1204_023.js
7a748a6c6ed83c188cc9d6a6b25ffc23c44b7256683d78768c25d313ef9b2509		 pdf-javascript-stream PDF /JS object 1204 at offset 0x1BCBB 83 bytes
javascript_obj1205_024.js
16ac694ddcb1da0aaa046c305ca0b3bebfd10a3914a6a30ccad0065be3a63e94		 pdf-javascript-stream PDF /JS object 1205 at offset 0x1BD41 148 bytes
javascript_obj1206_025.js
6d24c7310e696232b67267c850dc3b1480f517a1a0aa4333d34a91bc792c1aa9		 pdf-javascript-stream PDF /JS object 1206 at offset 0x1BE0B 87 bytes
javascript_obj1207_026.js
94e8499c8480f7409075fde123c61d32d7643cad79c095cb007bcf6d71ecc024		 pdf-javascript-stream PDF /JS object 1207 at offset 0x1BE97 87 bytes
javascript_obj1208_027.js
5a5ef494115f73a259e82b8e901dad04fab04d3767b95f21c54ac4e7a7419abe		 pdf-javascript-stream PDF /JS object 1208 at offset 0x1BF22 83 bytes
javascript_obj1209_028.js
a9a06f1e155ae0aa9bc9f3f53c02063ef7cffa9474bb448f93fbef7fa0f74e7c		 pdf-javascript-stream PDF /JS object 1209 at offset 0x1BFA9 148 bytes
javascript_obj1210_029.js
5122481ecbd382da4f4420ad007ab1b4a2b450c99815a402704a54688ffdcf1a		 pdf-javascript-stream PDF /JS object 1210 at offset 0x1C075 83 bytes
javascript_obj1211_030.js
8b77b257504f71c72f7b299687af93e597ebb9a543a60a70a54760de7a903b58		 pdf-javascript-stream PDF /JS object 1211 at offset 0x1C0FB 141 bytes
javascript_obj1226_031.js
82ef988bd387dccbd066ff776f0cba5647069bc1a8d1da20572bf9ed063858f8		 pdf-javascript-stream PDF /JS object 1226 at offset 0x1CB37 59 bytes
javascript_obj1231_032.js
e0b786ba99b1c6c9228928ee910a9cf89135a5138f9fa1c677b41dc4c1464445		 pdf-javascript-stream PDF /JS object 1231 at offset 0x1CE97 62 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.