PDF malware analysis — malicious · c63f6fdd954e2d33

MALICIOUS

PDF

12.3 KB

MD5: 4152ee6d5cd0ce6857202a8b05a15a0b SHA-1: dcead10ee6a43a201d507bfc5f79e514606fef34 SHA-256: c63f6fdd954e2d33ac55ea8610cd83aea35c6162314db257e95eae0887c62060

64 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The presence of a PDF_EVAL heuristic firing suggests the script uses eval() to execute obfuscated code. This is a common technique for downloading and executing further malicious payloads. No specific family could be identified, and the document body was unreadable.

Heuristics 5

eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
String.fromCharCode low PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules. (matched inside decoded stream)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/mm/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off000004b5.bin` `4447bc3bf2370788a868beaf4e818cbde6061d04686c8a8695d700584551fe2b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4B5	4794 bytes
`objstm_0013_00.bin` `3ec841b01a1bb1aa700b49a4f383b3c25444c501028558ea845e84b840f95f4d`	pdf-objstm-decoded	PDF /ObjStm 13 0 obj (inflated)	171 bytes
`objstm_0022_00.bin` `a92747d747f22f515169556b020ee478e8bc8240eb1b1c812ec6d5c4463ac2ec`	pdf-objstm-decoded	PDF /ObjStm 22 0 obj (inflated)	32 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.