PDF malware analysis — malicious · dc780c666adb6b9c

MALICIOUS

PDF

4.5 KB Created: 2010-04-23 06:59:32 Authoring application: Dakmiyfomimaba

MD5: 98644389b19a136288dafb17842013ef SHA-1: ee4ae6c96b47ef37f944be5852bc529218e4c5bd SHA-256: dc780c666adb6b9c4164d0f4afd495eb1bea5e51b9b33ebb7429a7fd6728253e

86 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains embedded JavaScript, flagged by multiple heuristics as a stager for executing obfuscated code. The ML classifier strongly indicates maliciousness. While the specific payload is not immediately clear due to obfuscation, the presence of JavaScript execution within a PDF is a common technique for delivering further malicious content. The document body text appears to be largely garbled or encoded, offering no clear user-facing lure.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER

PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0010_000.js` `77692aa6eee912f470430c71119e8b9c8ba346a577cd63ae147470c7ef4ca3c3`	pdf-javascript-stream	PDF /JS object 10 at offset 0xC9D	896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.