PDF malware analysis — malicious · dac4330082a8d3ef

MALICIOUS

PDF

40.1 KB Created: 2010-06-04 14:12:00 +08:00

MD5: 7e995317688ef2bf831e28d4d9c645db SHA-1: 6ca947314b2dab66edcc622d3c4e92cb51be0a6a SHA-256: dac4330082a8d3ef644a2e9d1a7fba0250f4acd4a1a9a6c791298a514a04a63a

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.007 JavaScript

The PDF file contains embedded JavaScript and a RichMedia (Flash) object, both flagged as suspicious. The JavaScript stream, specifically noted for using unescape(), suggests obfuscation and a potential attempt to execute malicious code. The presence of these elements indicates the file is likely designed to deliver a secondary payload or exploit a vulnerability upon opening.

Heuristics 6

RichMedia (Flash) high PDF_RICHMEDIA

PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector (matched inside decoded stream)
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload (matched inside decoded stream)
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_005_off000080ba.bin` `082e3faa926a58fd1bf727d4b8f9b0ee51f4d4a3c3b720448063d0b484e52ffe`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x80BA	5430 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
`objstm_0018_00.bin` `2ed22d124fa58bcb135a03b6d344468625d3d5717e378bde1a7cb824778f1cb3`	pdf-objstm-decoded	PDF /ObjStm 18 0 obj (inflated)	6056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.