Malicious PDF — malware analysis report

Static analysis result for SHA-256 cfcb051a8a70c7a8…

MALICIOUS

PDF

29.3 KB Created: G1ÍDLiV:o‘;"z—9¾\@ @ Authoring application: ýôÿ7}+7 8¡}$§x (via ýôÿ$}+7 =¡|(§o•)
MD5: c0df799265de21417566d068736f436c SHA-1: d242f764952e4804d1fefce7ace20c0351784146 SHA-256: cfcb051a8a70c7a89f7061a3bef2a53eea2825db730c0a46d01ae56f5d0f9092
64 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment

The PDF file is encrypted and contains embedded JavaScript, a common technique to hide malicious payloads from static analysis. The JavaScript action is likely responsible for decrypting and executing the hidden content. This points to a delivery mechanism for a secondary payload, likely involving obfuscated code execution.

Heuristics 4

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0009_000.js
92d8f64c3b2f6b871a7e49670680fefcf8712c307f4f3a57f9998ea92ba3f0c6		 pdf-javascript-stream PDF /JS object 9 at offset 0x3CE 27458 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.