Malicious PDF — malware analysis report

Static analysis result for SHA-256 ccb2a411e86325e8…

MALICIOUS

PDF

5.5 KB Created: Ì_Æ«Œ»³$qN/G%x Authoring application: Û\ŸùEÏ£³9rX-[%x (via Û\ŸùEÏ£ÒSVRv8ÐÄ|ß±pÇîx‰R)
MD5: 11f39065a89495cdc8a48682a4590caf SHA-1: 8ae210efed7bbbe1e942ff4bed0339c9a844e582 SHA-256: ccb2a411e86325e8aa69d6f27f7bae639fd5cb9d6e4e7ac8ff394f800eaf83c1
86 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

This PDF file was flagged as malicious by an ML classifier with a high confidence score. It contains embedded JavaScript, and the PDF is encrypted with JavaScript, indicating that the malicious payload is hidden and executed via script. The presence of JavaScript actions and embedded JS streams suggests an attempt to download and execute a secondary payload, a common technique for malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.