Malicious PDF — malware analysis report

Static analysis result for SHA-256 b8cfcccd3bc7b15d…

MALICIOUS

PDF

5.8 KB
MD5: 70ab973d0e6e94fb47c512772360ba6a SHA-1: 57788eb2ecd72bad2e5b8181d8f348b7eda9d18f SHA-256: b8cfcccd3bc7b15d129d02dea02df598fe1c7a4dd9767988f55098d8ad53c4a5
106 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript/Shell Script Execution

The PDF was flagged as malicious by a machine learning classifier and exhibits multiple heuristic firings related to embedded JavaScript. The presence of PDF_JAVASCRIPT and PDF_JS rules indicates that the document contains and executes JavaScript, which is a common technique for delivering malicious payloads. The ML_NYX_PDF_MALICIOUS score of 0.999939 strongly supports the malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Correlated malicious PDF JavaScript signals critical PDF_CORRELATED_MALICIOUS_JS
    PDF JavaScript or auto-action content is corroborated by exploit staging, ML, or suspicious extracted-artifact findings. This correlation promotes old exploit-kit PDFs that otherwise remain in the suspicious band because each individual signal is intentionally weighted conservatively.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.