MALICIOUS
146
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
This PDF was flagged as malicious by ClamAV with the signature Js.Exploit.Shellcode-18, indicating it contains JavaScript-based exploit code. The presence of PDF_ENCRYPTED_WITH_JS and PDF_JAVASCRIPT heuristics confirms that JavaScript is used to obfuscate and execute the payload. The ML classifier also strongly indicated maliciousness. The exact nature of the JavaScript payload could not be determined due to obfuscation, but it is highly probable that it downloads and executes a second-stage payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 5
-
ClamAV: Js.Exploit.Shellcode-18 critical CLAMAV_DETECTIONClamAV detected this file as malware: Js.Exploit.Shellcode-18
-
Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JSPDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/pdfx/1.3/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/mm/
Open this report in the interactive analyzer, or submit your own file for analysis.