Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb059cce696e7706…

MALICIOUS

PDF

461.9 KB
MD5: 5c6459dd0e67a6953bc4b4e0aef77080 SHA-1: b622bd084e7b9e03e26da069189ac192a5b99473 SHA-256: cb059cce696e7706a6524cebd80e05115f71dc6b95bac59f578dfe5356051df7
114 Risk Score

Malware Insights

MITRE ATT&CK
T1553.005 Mark-of-the-Web Bypass T1140 Deobfuscate/Decode Files or Information T1027 Obfuscated Files or Information T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a hidden ZIP archive with an executable file named SDA5678000987655600.exe. This indicates a delivery mechanism where a malicious executable is concealed within a PDF document. The presence of JavaScript actions and embedded JS streams suggests an attempt to further obfuscate or automate the execution of the payload. The ML classifier strongly flagged this PDF as malicious, supporting the conclusion that it is designed to deliver a harmful executable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Hidden ZIP payload with executable entries inside PDF stream critical PDF_HIDDEN_ZIP_EXECUTABLE_PAYLOAD
    PDF stream bytes contain an embedded ZIP archive whose local headers name executable payload files. This is not a normal PDF attachment (/EmbeddedFile); it hides Windows payloads inside an ordinary stream, a strong malware-loader or smuggling pattern.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
SDA5678000987655600.uue
99f8669a5ab1de2019e07d9c1ac1e6492e2ff6916ff946f41b9874552a8f685a		 pdf-embedded-file PDF EmbeddedFile object 8 at offset 0x65D 470734 bytes
javascript_obj0009_000.js
e53022932bb08f4aff64cf500508abbcd24c80457904a59d0105df1681f3d14b		 pdf-javascript-stream PDF /JS object 9 at offset 0x735D9 72 bytes
javascript_obj0009_001.js
e07945b65e02e5e273a5ff45ae4f17084814ea1a06802da274bff37c18ffd0e7		 pdf-javascript-stream PDF /JS object 9 at offset 0x735D9 70 bytes
hidden_pdf_zip_off00000664.zip
f8f52aa80e3a5607fa85eb5ff8b9723545b068e4edbb0259a1e1dc3f52288079		 pdf-hidden-zip PDF raw stream ZIP payload at offset 0x664 470878 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.