PDF malware analysis — malicious · b9a419ef7b330aad

MALICIOUS

PDF

9.8 KB

MD5: f2a715df14d5422d0a3aefc90b8e655b SHA-1: 81262db603a541bfb859dd7137679d356aa26074 SHA-256: b9a419ef7b330aade9a2c4b2fafb704b96d4a89722f054776aa70e4b2d60670b

74 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF sample contains embedded JavaScript and utilizes ASCIIHexDecode and ASCII85Decode filters, which are common indicators of exploit code within PDF documents. The ML classifier strongly flagged this PDF as malicious. The embedded JavaScript is likely responsible for downloading and executing a second-stage payload, although its exact function is obscured by the PDF structure.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 4

ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85

ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0012_000.js` `dc1246f85512b56b28285b7a1a621e59f5ffc5290c67289a19c5b401093c8dc7`	pdf-javascript-stream	PDF /JS object 12 at offset 0x3B0	8620 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.