PDF malware analysis — malicious · ba7c7b3be2065eb1

MALICIOUS

PDF

1.95 MB Created: 2011-72-51 03:25:00

MD5: 88cc89752d83ce5be6e991514e5136a4 SHA-1: 90161709245cf71c96c507c4f34733c061c3a91a SHA-256: ba7c7b3be2065eb181ff03c96c3b96e15656e182de52aa3c22c0f19e959aae66

98 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF contains embedded JavaScript, including streams that utilize eval() calls. A secondary embedded PDF was also found with similar suspicious JavaScript findings. The obfuscated nature of the JavaScript suggests it is designed to download and execute a second-stage payload. The specific techniques used point towards a generic PDF-based exploit delivery mechanism.

Heuristics 5

eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
Secondary embedded PDF body has suspicious static findings high POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0001_000.js` `476d4d184f8e8eb57b57029068294715004a88fd2a88eda096b3d76cd904f1bc`	pdf-javascript-stream	PDF /JS object 1 at offset 0x618F	540 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
`javascript_obj0001_000_1.js` `be820ffc559c3dd36720813e2a2ee7138cc2d214e03a7d51db58182c86f76945`	pdf-javascript-stream	PDF /JS object 1 at offset 0x61B0	543 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
`polyglot_child_pdf_off00006489.pdf` `1fdac4d074f034f3816effbbf1258d1fc598772337c4d931681e1fef38d0dc5d`	polyglot-child-pdf	Secondary PDF body inside pdf container at offset 0x6489	2022263 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.