PDF malware analysis — malicious · d8e4552e9f05dad4

MALICIOUS

PDF

51.6 KB Created: 2009-11-07 00:56:24 +03:00 Authoring application: manyTypeAre (via be100b06aa2c4c5164f9f1c4a4fe2781)

MD5: 0aac4376f184e195a769761ee5514c9d SHA-1: 924f4543bf8e4d380a4a28042a62d3aa4d13e9a8 SHA-256: d8e4552e9f05dad40e2aab7298b86194e6fdb5dc7391eafca2b6df7f878bfa53

94 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 JavaScript/Shell Script Execution: JavaScript T1204.002 Malicious File: Malicious JavaScript

The PDF contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. A high-confidence heuristic, PDF_EVAL, specifically flags the use of eval(), which is commonly used to deobfuscate and execute malicious code. The ML classifier also strongly indicates maliciousness. The embedded JavaScript likely downloads and executes a second-stage payload, though the exact URL or payload could not be reconstructed due to obfuscation or truncation.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 4

eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0021_000.js` `afe7e1c31982e5550806bca597003867226473058b1c2608d8fc964f87b4cee6`	pdf-javascript-stream	PDF /JS object 21 at offset 0x3516	4096 bytes
`javascript_obj0022_001.js` `4061395a9a7901377cb0a869e5a91f402ce18a6b4f371d9dbdd0e17c35619249`	pdf-javascript-stream	PDF /JS object 22 at offset 0xC7BB	40 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.