Malicious PDF — malware analysis report

Static analysis result for SHA-256 b8bff4480649a345…

MALICIOUS

PDF

10.0 KB
MD5: 6cb1a94a752e43b58209bc7a4b3ed244 SHA-1: 1b22b3b08b4eda4d6be62fbe94ca3d83c663b614 SHA-256: b8bff4480649a34599466e4e00daa533f1780e65a25c91c5f86071de4d689c67
106 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT, PDF_JS, and PDF_CORRELATED_MALICIOUS_JS. The ML classifier also flagged the PDF as malicious with a high probability. The presence of JavaScript suggests an attempt to execute code, likely to download and run a secondary payload, which is a common technique for initial access or further system compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Correlated malicious PDF JavaScript signals critical PDF_CORRELATED_MALICIOUS_JS
    PDF JavaScript or auto-action content is corroborated by exploit staging, ML, or suspicious extracted-artifact findings. This correlation promotes old exploit-kit PDFs that otherwise remain in the suspicious band because each individual signal is intentionally weighted conservatively.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.