Malicious PDF — malware analysis report

Static analysis result for SHA-256 c01583f070837663…

MALICIOUS

PDF

172.0 KB Created: [Ô²¤1ǖãʇ]Û§‡ Authoring application: ^DíöbƒŽ•›Å[„úÒ|ˆK& áI¸1ÀX²Ø4‘Þ
MD5: 2f47e482b3f7a40eded4c3401dde6ff0 SHA-1: 407c01a1ceeedcb850baed2bb6387e18cc43ce5b SHA-256: c01583f07083766381f2f91a17429b26fed0f27d0991671b279e2c9bff5372a5
112 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file exhibits multiple indicators of malicious intent, including embedded JavaScript and encryption that hides the payload. The presence of JavaScript actions and streams, combined with the ML classifier's high confidence score, strongly suggests that the script is designed to download and execute a second-stage payload. The PDF is also flagged as being encrypted with JavaScript, further obscuring the malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9451

Heuristics 7

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Additional-actions dictionary low PDF_AA
    PDF defines /AA (Additional Actions) that references an executable action (JS/JavaScript/Launch/SubmitForm) — can auto-trigger on document or widget events. Form-field calc/format/validate/keystroke handlers in legitimate interactive forms commonly fire this, so it is reported as a low-weight signal; weaponised auto-execution is flagged by stronger rules (PDF_OPENACTION, encrypted-with-JS, etc.)
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 1 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0084_000.js
7f8e12f231c4f813ffe34d7f2d43b520e41add3f6064874b39cc5d2eba31ec79		 pdf-javascript-stream PDF /JS object 84 at offset 0xD66 38 bytes
javascript_obj0084_001.js
66f5f1e5b6d0be3b4f69db63fc0dff9be1aa061eee74ec5d998002d8d73665e1		 pdf-javascript-stream PDF /JS object 84 at offset 0xD66 37 bytes
javascript_obj0084_002.js
8ed62bf2da058a7782901f621aaf52719d38b2a419b33059c9956c7d3422fa30		 pdf-javascript-stream PDF /JS object 84 at offset 0xD66 34 bytes
javascript_obj0085_003.js
ca614ffa2f291f63a8d28ca5bc58af8f0a7d4c72f6f9f85016305c58197015be		 pdf-javascript-stream PDF /JS object 85 at offset 0xEFA 41 bytes
javascript_obj0085_004.js
eb2da184cf1a8bfdb3725b305d9e2aefc6c695ce2b3ca8d7be120054d0b35c11		 pdf-javascript-stream PDF /JS object 85 at offset 0xEFA 40 bytes
javascript_obj0085_005.js
68d5e4532a33767658e61396545a8b0befc6671a883989aa5b104e9bf644b1a0		 pdf-javascript-stream PDF /JS object 85 at offset 0xEFA 37 bytes
javascript_obj0086_006.js
9b43345551570f6d32f137dd7815e74b9f70b94ed682966067e87941289011fc		 pdf-javascript-stream PDF /JS object 86 at offset 0x109D 37 bytes
javascript_obj0086_007.js
d23931565a06d77d9febb5d97eaa7b6c21e4f97a836bba760875c7f8337ac30f		 pdf-javascript-stream PDF /JS object 86 at offset 0x109D 36 bytes
javascript_obj0086_008.js
69d2174eb7180ecf40a6c080aff81d6b34e9034d0e5b3d72c9c8c4611fa6d610		 pdf-javascript-stream PDF /JS object 86 at offset 0x109D 33 bytes
javascript_obj0087_009.js
7891449df143504cdfc13dc39d2cf8ca295a99809fa9ce53e0e6ddd7ae7a28fc		 pdf-javascript-stream PDF /JS object 87 at offset 0x122E 37 bytes
javascript_obj0087_010.js
be3d6397579de51626aa58b24496d482fb536e907d889ed79fc9173c3f55b872		 pdf-javascript-stream PDF /JS object 87 at offset 0x122E 34 bytes
javascript_obj0087_011.js
79d8f465db2fdc291d1748f187cbb363e323e00381a5afbbf6f7ac4d5f97f731		 pdf-javascript-stream PDF /JS object 87 at offset 0x122E 36 bytes
javascript_obj0087_012.js
0661ba73c1466430a49f66884e21360c48f2f3cf815c84be7332afeea48a4e00		 pdf-javascript-stream PDF /JS object 87 at offset 0x122E 33 bytes
javascript_obj0088_013.js
689984587283bb39c312b3e46fdc1a7477485b8fa8a50c44328d8c14a28d9e00		 pdf-javascript-stream PDF /JS object 88 at offset 0x1407 35 bytes
javascript_obj0088_014.js
8e1f7a035bbb5ddede474c8d4292d844ecf7f2b37ff0b07612805ea0a11293bd		 pdf-javascript-stream PDF /JS object 88 at offset 0x1407 34 bytes
javascript_obj0089_016.js
d918b15289c1ad137971f9f88ee25e4c296554f973f86dc1392ed2fde8425bc7		 pdf-javascript-stream PDF /JS object 89 at offset 0x1594 39 bytes
javascript_obj0089_017.js
c2c0d349ff9675e1ba6d5130abf2b8cffbe9854421277957dfa4357951698397		 pdf-javascript-stream PDF /JS object 89 at offset 0x1594 38 bytes
javascript_obj0089_018.js
36c2fb1b20168977f7e006c2975920db7c8695b303632e7545d65bde16c5e921		 pdf-javascript-stream PDF /JS object 89 at offset 0x1594 35 bytes
javascript_obj0090_019.js
2b86c1ec0177d03b16712edcc0820856bd3d9fb62b5b54053e0fdbe522b827de		 pdf-javascript-stream PDF /JS object 90 at offset 0x172D 35 bytes
javascript_obj0090_020.js
e75ae0d69457596f3a4dd2c4ec89c4db32c2f5fb74fb345e0c7943fea0417a59		 pdf-javascript-stream PDF /JS object 90 at offset 0x172D 34 bytes
javascript_obj0097_022.js
c6ade5eb415f5a225416a9530c97fd098a9498694b04de56f24a3e1065dfe404		 pdf-javascript-stream PDF /JS object 97 at offset 0x1DDD 41 bytes
javascript_obj0097_023.js
119d4df0b5f09743f9ea7ead77125317544fbb6ca7b742ea3b0b1eaab5a9b2e2		 pdf-javascript-stream PDF /JS object 97 at offset 0x1DDD 40 bytes
javascript_obj0097_024.js
868c1a80621a646c5159c889da3f417659d5578334ab91d2a92af04f5b5c363e		 pdf-javascript-stream PDF /JS object 97 at offset 0x1DDD 37 bytes
javascript_obj0098_025.js
ce234ed5003bdda53b8784c7d61b4a614a358699074d0fd9005fbe116a507f29		 pdf-javascript-stream PDF /JS object 98 at offset 0x1F81 42 bytes
javascript_obj0098_026.js
4df6fa9f3fc382a588903d5623f01b808309abccb8d09800116cb4b5d71f41f9		 pdf-javascript-stream PDF /JS object 98 at offset 0x1F81 41 bytes
javascript_obj0098_027.js
3316ae2ff1e535e3c4f9be6b76bf35cf28aa711b4f2749ca0200bdb5dc91681d		 pdf-javascript-stream PDF /JS object 98 at offset 0x1F81 38 bytes
javascript_obj0099_028.js
783b773ad647cc1812ba1324c9b387f30b1b8edd63f3c9fc2f96604a4f9af14b		 pdf-javascript-stream PDF /JS object 99 at offset 0x212A 42 bytes
javascript_obj0099_029.js
0d9d7c024c0d802cd235531e7a1fa3e1d4988b367996945114756f3951a984eb		 pdf-javascript-stream PDF /JS object 99 at offset 0x212A 41 bytes
javascript_obj0099_030.js
9a95b302415399263cc3653aabd34158851076b5628f1b66f9732be0c653df5b		 pdf-javascript-stream PDF /JS object 99 at offset 0x212A 38 bytes
javascript_obj0100_031.js
c9c3538f3b260d6ef2b66554c61fbff7b82bfb435a9694c94e0cf3ad3cdcfda8		 pdf-javascript-stream PDF /JS object 100 at offset 0x22D0 43 bytes
javascript_obj0100_032.js
d90e84d97c03a06bcc5b06a2aee0981bcb96fb813a2bf18224ea59b45992f137		 pdf-javascript-stream PDF /JS object 100 at offset 0x22D0 40 bytes
javascript_obj0100_033.js
e42e352140ae6cd01409cf70bbf624155076e62b5ff7043ebed5be7bae48128f		 pdf-javascript-stream PDF /JS object 100 at offset 0x22D0 42 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.