PDF malware analysis — malicious · c9a6ed97e9d2680c

MALICIOUS

PDF

281.4 KB Created: 2009-08-28 16:39:02 UTC Authoring application: PScript5.dll Version 5.2 (via FDFMerge 5.0.4 Linux 7 SPDF_1096+ May 3 2004)

MD5: 665885d9258e752763f35ca30e97dca4 SHA-1: 0f11aedae1f37b99cc4fc4579af116142b6d1323 SHA-256: c9a6ed97e9d2680c6c2cab1c041bd98cc2b1f6065ca72bdd8bcdc7087cea95ff

82 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

This PDF file contains multiple embedded JavaScript streams, with one particularly large stream (javascript_obj0002_007.js) indicating complex malicious activity. The presence of `eval()` calls and `String.fromCharCode` suggests obfuscation and dynamic code execution. The primary intent appears to be downloading and executing a second-stage payload, as is common in PDF-based malware delivery. The heuristics strongly suggest JavaScript execution, and the large size of one script points to a significant malicious function.

Heuristics 8

eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
String.fromCharCode low PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules. (matched inside decoded stream)
ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85

ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
AcroForm button with action trigger low PDF_ACROFORM_BUTTON

PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/iX/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://purl.org/dc/elements/1.1/

Extracted artifacts 14

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0150_000.js` `9ce8e999a7f077bf80b8be89d07d5ff68632cae2aa595a4d7844509360f837e2`	pdf-javascript-stream	PDF /JS object 150 at offset 0x3FBF2	55 bytes
`javascript_obj0153_001.js` `73e83df5dcb45dc9bd4e213fc19b421b9a63f7a9ed1ee55ff111dd894f4547b0`	pdf-javascript-stream	PDF /JS object 153 at offset 0x3FF44	72 bytes
`javascript_obj0171_005.js` `b49875e7a786cc7d62191be88c49afc7a7f53551d4ec30ddf24c3fd7583d7233`	pdf-javascript-stream	PDF /JS object 171 at offset 0x40E56	33 bytes
`javascript_obj0001_006.js` `a329c02e51ed2c88c23915aa912ef005f6205779f51c139a980159fe260f8eaa`	pdf-javascript-stream	PDF /JS object 1 at offset 0xF	1503 bytes
`javascript_obj0002_007.js` `6abc4c5550dec40d1da8de2c198df13eac3d88b9c48c398e37004a22ecb1f6b9`	pdf-javascript-stream	PDF /JS object 2 at offset 0x296	5017 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 10 eval/decoder/string-building token(s).
`stream_029_off0002c889.bin` `f8b5634482dabaf0040161953b708d7648a1dc1459beb6e63bf997bafb4818f7`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x2C889	107773 bytes
`icc_00_off0001918d.icc` `2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e`	pdf-icc-profile	PDF ICC profile at offset 0x1918D	3144 bytes
`font_00_sfnt_off0000ea1d.bin` `d220ef06c71b1bea1873bf89d3e4782cf9a36d1677a5f5b8416bbb1590df8cb7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEA1D	21820 bytes
`font_01_cff_off00011a78.bin` `5842780533d393c79b836801e1fa5692025ec7ba6acfac9c7fff644e81c86201`	pdf-font-stream	PDF embedded font (cff) at offset 0x11A78	1045 bytes
`font_02_cff_off00011f76.bin` `fd2d4e4625182a34c985ba8a651bf93965ca5a29207bf37b7387d3287579a1c3`	pdf-font-stream	PDF embedded font (cff) at offset 0x11F76	1068 bytes
`font_03_cff_off0001248d.bin` `75bdd0cd032deaa9286ca6d15559083bdafa7016831affa3621f8da8f1286aa6`	pdf-font-stream	PDF embedded font (cff) at offset 0x1248D	912 bytes
`font_04_sfnt_off00012a6b.bin` `9509ed15773b8c618db9011b3c2fc780557d61feb2ec9f0028cde1666c493be3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12A6B	35760 bytes
`font_05_sfnt_off000174bf.bin` `5278f40bfcbfea0ace1261f08a59c32d38ec43f3557bc96a395b55ffbbcd1e08`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x174BF	20508 bytes
`font_06_sfnt_off0001d691.bin` `8822adae4140ddd67ff121d14aa9d6068c461576cb57ed1ec4f496a4560f2fc7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1D691	77789 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.