PDF malware analysis — malicious · c5b2e5783495f296

MALICIOUS

PDF

13.2 KB

MD5: e0b66474e0d4ca312d58884ac7e51416 SHA-1: ea63cfa0149ee18f7aef833dfe9a96e5015462ac SHA-256: c5b2e5783495f2969bbf5bae37ed6ad313061a2520b2bd4349865d1cafca4a15

148 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF contains embedded JavaScript, flagged by multiple heuristics including 'PDF_METADATA_EVAL_STAGER'. This JavaScript is likely responsible for executing a stager, as indicated by the 'ML_NYX_PDF_MALICIOUS' and 'CLAMAV_DETECTION' firings. The stager's purpose is presumed to be downloading and executing a second-stage payload, a common technique for malicious PDFs.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

ClamAV: Pdf.Exploit.Dropped-94 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Dropped-94
PDF metadata JavaScript eval stager high PDF_METADATA_EVAL_STAGER

PDF JavaScript reads document metadata fields such as title, subject, or producer, decodes character data with parseInt/String.fromCharCode style helpers, and evals the recovered stage. This is a high-signal exploit-kit staging pattern.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0076_000.js` `9bea823b1d86b27397ccfa5537e1cef0ff1c110f1a42df14c6cf8c8bc32dd971`	pdf-javascript-stream	PDF /JS object 76 at offset 0x32C8	331 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.