Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7520519cfe04b3f…

MALICIOUS

PDF

1.4 KB
MD5: 371b1c4af5855cc0a63c89c0e8be3ffa SHA-1: 0b13c74a2ae83ab1a6dde7795fe2e862eb019f4b SHA-256: c7520519cfe04b3fc2acd887b90ead31163b2298156d400f068c003def3a06c0
76 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: Malicious File

This PDF sample was flagged as malicious by an ML classifier with high confidence. Static analysis revealed embedded JavaScript and a potential Flash object, indicated by the 'xQetldvH.swf' string. The presence of ASCIIHexDecode filters with exploit indicators further suggests an attempt to obfuscate malicious content. The embedded JavaScript and potential Flash object are likely used to deliver a secondary payload or exploit a vulnerability.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.