PDF malware analysis — malicious · d7cbcd5d52e8418a

MALICIOUS

PDF

76.7 KB

MD5: 9d8e53129d7ab10fafb77185a3a9002c SHA-1: 7a641659d2e194b80fdb6fe55868c982589e2f4f SHA-256: d7cbcd5d52e8418af591a6c0550c8d86e7311df6e8c794d10cd8157fb9de1a6c

184 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The PDF_JS_EXPLOIT_CLUSTER and PDF_CORRELATED_MALICIOUS_JS firings, along with the ML_NYX_PDF_MALICIOUS score, strongly suggest this JavaScript is malicious and exploits a vulnerability. The presence of XFA forms (PDF_XFA) is often correlated with such exploits. No specific IOCs like URLs or hashes were extracted, but the attack pattern is clear.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 7

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
Correlated malicious PDF JavaScript signals critical PDF_CORRELATED_MALICIOUS_JS

PDF JavaScript or auto-action content is corroborated by exploit staging, ML, or suspicious extracted-artifact findings. This correlation promotes old exploit-kit PDFs that otherwise remain in the suspicious band because each individual signal is intentionally weighted conservatively.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
AcroForm button with action trigger low PDF_ACROFORM_BUTTON

PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.

Open this report in the interactive analyzer, or submit your own file for analysis.