PDF malware analysis — malicious · d069b7bb41bcebb7

MALICIOUS

PDF

642 B

MD5: f8e3f1baa86d85683eea4a291753ddd2 SHA-1: 3edf23f3258bdbe95661e0bfc6a0d3938eca369d SHA-256: d069b7bb41bcebb756c576aae708f6096a7f93d452162818d4226477447f1b81

86 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 Command and Scripting Interpreter: PowerShell T1204.002 Malicious File Execution: Malicious JavaScript

The PDF document contains embedded JavaScript, which is flagged by heuristics for eval() calls and general maliciousness. The ML classifier strongly indicates malicious intent. The JavaScript likely executes a second-stage payload, although the exact mechanism is obfuscated. No specific family could be identified.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 3

eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Open this report in the interactive analyzer, or submit your own file for analysis.