PDF malware analysis — malicious · cf22cb20fddae888

MALICIOUS

PDF

36.1 KB Created: ÌSá°lÝ4Õb§²þ-þ ¦cí Authoring application: ¨ a.?VSÿ´ (via ¨ a.?\Só£)o)

MD5: 7e6f27f07a726c3acf8706c98dec1ca8 SHA-1: 12bfbc97d450206a84099d5d632fecfff630e9c2 SHA-256: cf22cb20fddae888ef76ae15c5e590668b1d6f68ebdfa67c2175c52b07835c13

64 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 JavaScript T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass

The PDF file is encrypted and contains embedded JavaScript, a common technique to obscure malicious payloads from static analysis. The presence of PDF_ENCRYPTED_WITH_JS and PDF_JS heuristics indicates that the JavaScript is likely used to decrypt or execute the hidden content. The embedded JavaScript stream, while large, is likely responsible for downloading and executing a second-stage payload. The confidence is moderate due to the lack of direct script content analysis.

Heuristics 4

Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS

PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0009_000.js` `8f4621e99d293ded8c4d8c544568b3e7adc6e0ee3369f735d8e11240aec132e3`	pdf-javascript-stream	PDF /JS object 9 at offset 0x3B9	34232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.