Malicious PDF — malware analysis report

Static analysis result for SHA-256 e39fa4f39d2ff915…

MALICIOUS

PDF

2.2 KB
MD5: 8bd69ac8dd97fcdf24ffdeb72d0a6218 SHA-1: a10a9deb3f1ae635d449e56158b029ced15ea798 SHA-256: e39fa4f39d2ff915c7569cab6e595fec45d22932c18ffd7782d79a6687a6f9c1
70 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains heuristics indicating a generic JavaScript exploit stage recovery, suggesting it's designed to download and execute a second-stage payload. The ML classifier strongly flags this PDF as malicious. While the exact payload URL is obfuscated within the JavaScript, the presence of multiple deobfuscated JavaScript files points to a multi-stage attack. The primary function appears to be the delivery of further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 1

  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
generic_stage_recovery_000.js
5a3d618cc83fec1f8003eb2530912f02e653c5baeb1d26e88be81e583830516a		 deobfuscated-js generic stage recovery percent-decode from decompressed stream at 0x68 at offset 0x68 1966 bytes
generic_stage_recovery_001.js
345e044131a08dd1ac7b741746371cfb4c09687390f7933c077c708a4212a1db		 deobfuscated-js generic stage recovery percent-decode -> percent-decode from decompressed stream at 0x68 at offset 0x68 1896 bytes
legacy_pdfkit_stage_000.js
82e437a34ffd7a5adea747c29400e59651eeab351c671fa9b3baf778b23b0fa0		 deobfuscated-js repeated-marker hex decoded JavaScript at offset 0x68 155 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.