PDF malware analysis — malicious · c5b67b7fd5a13aa7

MALICIOUS

PDF

712.6 KB

MD5: 86ccfcba11c55ff4afef5307289bd162 SHA-1: 64df495daadb386dd174529218bd313a058e70e5 SHA-256: c5b67b7fd5a13aa7c4b5aa00aa2d5d68ef2533e205f9821163af64a6c427caf5

198 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1059.003 Windows Command Shell

The PDF file contains embedded JavaScript and a launch action targeting cmd.exe. The script appears to be constructing a VBScript file named 'vbs1.vbs' which is then likely executed. This indicates a multi-stage attack where the PDF serves as a dropper for further malicious activity. The specific script content is heavily obfuscated, but the presence of cmd.exe and the construction of a VBScript strongly suggest payload execution.

Heuristics 7

Launch action critical PDF_LAUNCH

PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
/Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND

PDF /Launch action specifies an executable target with parameters '/c echo Dim BinaryStream > vbs1.vbs && echo Set BinaryStream = CreateObject("ADODB.Stream"' — references a known-dangerous executable (cmd, PowerShell, etc.).
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSEOF. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0008_000.js` `e5c5f5cdeab6edb0028c849695552ddf4173dc84756cef5a59bf58fa31a0fbe4`	pdf-javascript-stream	PDF /JS object 8 at offset 0x1FC	19259 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`embedded_pdf_script_00004ed9.bin` `5a416642544ad153500cfec7da164e7558db12c8f03b3096391df00a8b809cdc`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x4ED9	729700 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s). Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.