Malicious PDF — malware analysis report

Static analysis result for SHA-256 c29b21c4cdf07328…

MALICIOUS

PDF

636.3 KB
MD5: 43282bc841f521983a37d584b6961980 SHA-1: 05c9149e9f410062e6bd879a478a2cfba3262451 SHA-256: c29b21c4cdf07328c7498a5710d795e5a587316ccb87644864d534330fc81b02
96 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

This PDF file exhibits malicious behavior, primarily through embedded JavaScript. The heuristics indicate the presence of JavaScript actions, embedded JS streams, and a high-confidence eval() call, suggesting code execution. The ML classifier also flagged this PDF as malicious. While no specific URLs were directly associated with malicious activity in the provided evidence, the presence of obfuscated JavaScript streams (javascript_obj0313_001.js, javascript_obj0314_002.js) strongly suggests the intent to download and execute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9737

Heuristics 6

  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • String.fromCharCode low PDF_FROMCHARCODE
    String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules. (matched inside decoded stream)
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/rights/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xmp/InDesign/private
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 18

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0313_001.js
3497c6f508f28f1254445a3a241893853b2ec0586b6775c3a0b0be0d12dc140a		 pdf-javascript-stream PDF /JS object 313 at offset 0x9B5EC 2998 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
javascript_obj0314_002.js
c17dffb65995a924394657ff24079684e82bdb3d4abd82cc6ae74edc0a613080		 pdf-javascript-stream PDF /JS object 314 at offset 0x9BDCE 371 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
icc_00_off000210c0.icc
2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e		 pdf-icc-profile PDF ICC profile at offset 0x210C0 3144 bytes
font_00_cff_off00018d06.bin
38f4ddd32e736897982ced0858b49da07a104e846d0946b9789f4ef370f99eb2		 pdf-font-stream PDF embedded font (cff) at offset 0x18D06 357 bytes
font_01_cff_off000191af.bin
2789af23995f8af33b2dae091e9b962494e0b8b0e898fada623820ee9686b3ca		 pdf-font-stream PDF embedded font (cff) at offset 0x191AF 499 bytes
font_02_cff_off000196dc.bin
755b31802bfcbe5da85fa3b6417005821fa046390579475e59a1b7e221fd17f2		 pdf-font-stream PDF embedded font (cff) at offset 0x196DC 2550 bytes
font_03_cff_off0001a42a.bin
eb7fc9a0f6b5c973d758c18668889ef5241421e8108bf894a9400ecd0930c40c		 pdf-font-stream PDF embedded font (cff) at offset 0x1A42A 3369 bytes
font_04_cff_off0001b3d3.bin
ce12ce1ce9ee146def1a9a0aa879316c8283c74b0dab40de60412666b768231d		 pdf-font-stream PDF embedded font (cff) at offset 0x1B3D3 2951 bytes
font_05_cff_off0001c208.bin
650743b0083f4117eafe6d934f210cd07b94d118b25ed99f041916d1b6f42ac7		 pdf-font-stream PDF embedded font (cff) at offset 0x1C208 5979 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.40, consistent with packed or encrypted content.
font_06_cff_off0001da88.bin
91487fd16b17d83908b1ba219ae597731b7158e968667787a056b1d4df0de59a		 pdf-font-stream PDF embedded font (cff) at offset 0x1DA88 1949 bytes
font_07_cff_off0001e69b.bin
cf4944c56c01f4a65c36b5010c12128ca3ddbe0e6806e8b147a7b04453bfa751		 pdf-font-stream PDF embedded font (cff) at offset 0x1E69B 6612 bytes
font_08_cff_off000202bc.bin
c5675bd2f2b586cbf48ee24f95e1cf91eec1b4928c28c92220efce9ec4db3e29		 pdf-font-stream PDF embedded font (cff) at offset 0x202BC 3996 bytes
font_09_sfnt_off00023941.bin
2722878b19761e7a433e1ca6f32e7f9fe9cccce4136877b3beb9040f23bd4b18		 pdf-font-stream PDF embedded font (sfnt) at offset 0x23941 23432 bytes
font_10_sfnt_off00026f18.bin
80383e85181b7288bd3f68d71356b7e2ef2e1f0ba00d93e81908469c104a18d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x26F18 52108 bytes
font_11_sfnt_off0002f600.bin
336a7a084a76c025a84d5a8cbd6080db9a267cde0e24fe672acabed56b19aa8d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F600 48764 bytes
font_12_cff_off00093853.bin
b7acc2e77938f52ea0e0e99ad276600cacf4c9a68f9966b0cff658984fc5fdfe		 pdf-font-stream PDF embedded font (cff) at offset 0x93853 1390 bytes
font_16_cff_off000986b7.bin
498107d4b463cdfaabb7ecb0de303a1fd3753cd0475826d8151726b62a86cbb1		 pdf-font-stream PDF embedded font (cff) at offset 0x986B7 2026 bytes
font_17_cff_off000991de.bin
6b20e84459271e0cdfae9863860320d5b0fe24a40f52c5aa56fd600bf142e820		 pdf-font-stream PDF embedded font (cff) at offset 0x991DE 1370 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.