Malicious PDF — malware analysis report

Static analysis result for SHA-256 b9013de0c019b45f…

MALICIOUS

PDF

35.0 KB Created: Ëԕa§ŒÄÞE&§¤ðÑic¯}çî Authoring application: q§–ÎôŒtu–^—¬à, (via q§–Îô†tp–_— à;HF)
MD5: c8ea58bb994f0a825f81b6e63a43304f SHA-1: bcbdb9f079cd9dbe6a0939840f4c8720d4707a51 SHA-256: b9013de0c019b45f04ebf91b5817dd16f15e4d7bf4ae8261866698c00a862026
64 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript/JScript

The PDF file is encrypted and contains JavaScript, a common technique to obfuscate malicious content. The embedded JavaScript stream, named 'javascript_obj0009_000.js', is likely responsible for executing the malicious payload. The presence of PDF_ENCRYPTED_WITH_JS and PDF_JS heuristics indicates a deliberate attempt to hide the attack's true nature, likely for phishing or credential harvesting.

Heuristics 4

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0009_000.js
4badda012dbd8ee2f1c6e3293ba40848818dba1e609d820cb3c0302ca14741b3		 pdf-javascript-stream PDF /JS object 9 at offset 0x3DB 33094 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.