PDF malware analysis — malicious · d0c40d1c12948975

MALICIOUS

PDF

3.2 KB Created: ÑdÀáYTîútìiµ5 Authoring application: $³ÎMïãuðp·> (via $³ÎMþi7ä~ÎT«ÿÉ«XÌ)

MD5: 46e08eb29bf271ad2b956267420fca88 SHA-1: 5545e21c6589a69593b4fd674aefa02d8cbad990 SHA-256: d0c40d1c129489754ef33228bcc988cdc281aaa914a32ea766fcf8bd0f8dbaee

86 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 JavaScript/JScript

This PDF sample was flagged as malicious by an ML classifier with high confidence. Static analysis revealed embedded JavaScript and an encrypted document body, indicating an attempt to hide malicious content. The presence of JavaScript actions and embedded JS streams suggests the script is used to de-obfuscate or execute a payload, likely for delivering malware.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS

PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Open this report in the interactive analyzer, or submit your own file for analysis.