Malicious PDF — malware analysis report

Static analysis result for SHA-256 cbc254cbb5e7a6b6…

MALICIOUS

PDF

31.2 KB
MD5: 8de70694dab4f3e703de19695d9588f8 SHA-1: be8f6491249eb14573c178d8ceccfa12ee371198 SHA-256: cbc254cbb5e7a6b684020435b1ba70d234519d4c3b32848d652f3064ab017ed9
66 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript and a RichMedia (Flash) object, indicated by the PDF_JAVASCRIPT, PDF_JS, and PDF_RICHMEDIA heuristics. The embedded artifact 'TyPWoIJRMY.swf' suggests an attempt to leverage Flash vulnerabilities or deliver further malicious content. The presence of JavaScript streams further supports the likelihood of an exploit or payload delivery mechanism. The confidence is moderate due to the lack of specific script content that could be definitively analyzed.

Heuristics 5

  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
TyPWoIJRMY.swf
767382813fc770c9716554c3266b22eee1636037ca964af05acf6ff66db4a27d		 pdf-embedded-file PDF EmbeddedFile object 16 at offset 0x11A0 26993 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.
javascript_obj0006_000.js
0fb39078bc891d059d4516111ee00234595e9f11257ae18de513fc3e1c1a8442		 pdf-javascript-stream PDF /JS object 6 at offset 0xF9 3415 bytes
legacy_pdfkit_stage_000.js
8f600288cb824f5a5b7bd1e362fb0519822e42bf689785e1558eb4bda249f95b		 deobfuscated-js split-join delimiter stripped JavaScript at offset 0xDA7 2085 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.