PDF malware analysis — malicious · d7f723d6e56d5ad3

MALICIOUS

PDF

40.3 KB Created: [»ÿíJl¹Ðo lP!YïqEê¥Õ Authoring application: (Ü\ä+]g^ (via (Ü\î+]f^ Ä3)

MD5: e2089583d0c69b2e47df9d87676e5883 SHA-1: b2266aceaf03ba31b4d8f6e158760c890ab3f323 SHA-256: d7f723d6e56d5ad3bf596828c58073beafd209df99df16684f2a8ec8bf2ed91e

94 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains embedded JavaScript, which is used to obscure its content and likely execute malicious actions. The ML classifier strongly indicates maliciousness. The presence of JavaScript within an encrypted PDF suggests an attempt to bypass static analysis and deliver a payload. The exact nature of the payload is not discernible due to obfuscation.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 4

Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS

PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0009_000.js` `6ba0767be03b18e23e63d5dd7d5bb7b238448d928325ab2fe405b29b9ba94f08`	pdf-javascript-stream	PDF /JS object 9 at offset 0x3CE	38480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.