PDF malware analysis — malicious · d1c83c98d80823c2

MALICIOUS

PDF

521.9 KB Created: 2010-04-14 17:12:23 Authoring application: Scribus 1.3.3.14 (via Scribus PDF Library 1.3.3.14)

MD5: 1e2ad618d80e70aa5b39483ef1d94bd1 SHA-1: 71ea62b931128c0a02db70eaa9736df0bba9554a SHA-256: d1c83c98d80823c2b67a4ff42a39c750dd85f102e1f7565f16f306e5682c9437

88 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The PDF_UNESCAPE heuristic suggests obfuscation, and the ML classifier strongly flags it as malicious. The embedded JavaScript file 'javascript_obj0055_001.js' is likely responsible for executing the malicious payload, potentially downloading and running further stages.

Machine Learning

Nyx PDF Classifier malicious score 0.9214

Heuristics 4

unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0055_001.js` `010992f011307af659e1ffd148e873c75aa77a54b28734c4720c8bf89a249e8e`	pdf-javascript-stream	PDF /JS object 55 at offset 0x81F4A	1303 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
`stream_000_off00000782.bin` `fcb479a00bdf7c05a68b91ba89a8ea3dd2be027dcca112f1f26270c081dc3502`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x782	409280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.