PDF malware analysis — malicious · ced718bb8ed60b6d

MALICIOUS

PDF

2.6 KB

MD5: 31e654c1d8bdae30caa5c99571f4c3d7 SHA-1: 8cba38884ae96d2d75a18eae4216f8261d4bfde5 SHA-256: ced718bb8ed60b6d51ab6078bad7bc5fa0eacf53d6d972692bdf2039fa70a290

156 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

This PDF file was flagged as malicious by an ML classifier and exhibits multiple JavaScript-related heuristics, including embedded JS streams and generic exploit stage recovery. The presence of 'syncAnnotScan' suggests a specific PDF primitive was leveraged. While the JavaScript deobfuscation was incomplete, the overall indicators point to a malicious PDF designed to execute an exploit via embedded JavaScript. The exact payload and delivery mechanism could not be fully determined due to incomplete deobfuscation.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 6

Correlated malicious PDF JavaScript signals critical PDF_CORRELATED_MALICIOUS_JS

PDF JavaScript or auto-action content is corroborated by exploit staging, ML, or suspicious extracted-artifact findings. This correlation promotes old exploit-kit PDFs that otherwise remain in the suspicious band because each individual signal is intentionally weighted conservatively.
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
syncAnnotScan annotation-staging primitive low PDF_FOXIT_SYNCANNOTSCAN

PDF JavaScript calls syncAnnotScan() — a no-op annotation-enumeration primitive used by exploit-kit JavaScript to stage payload reads from annotation /Subject fields before eval(). Not a vulnerable sink itself; rarely seen in legitimate PDFs. (matched in decompressed stream)
Scan did not complete info SCAN_INCOMPLETE

PDF JavaScript deobfuscation worker failed (worker exit 1); obfuscated JavaScript was not fully inspected.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0005_000.js` `a3319192cac6d4dc4eeb6af2d736b0ffec979b23116a003bc7c23382761c32a5`	pdf-javascript-stream	PDF /JS object 5 at offset 0x148	733 bytes
`deobfuscated.js` `2efa4e75044f865209ea8be30b057e8ba876615fde39b64103e8d3238d643c55`	deobfuscated-js	PDF JavaScript deobfuscation pass	2852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.