Malicious PDF — malware analysis report

Static analysis result for SHA-256 e52c53c15977fb32…

MALICIOUS

PDF

411.6 KB Created: 2009-01-12 17:00:55 +08:00 Authoring application: Adobe Acrobat 7.0 (via Adobe Acrobat 7.0 Image Conversion Plug-in) First seen: 2026-05-10
MD5: 37b676facbaafcae5602ba70806bc9ba SHA-1: d7975f2a906ad9d8556ae45eeedc4a2b14800c4f SHA-256: e52c53c15977fb322a01bceb79e59e41e65ff7ebc67f57d22ab16b64cc4703e8
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. This script is likely intended to download and execute a second-stage payload, as suggested by the presence of embedded files and the general nature of such scripts in malicious PDFs. The document body is image-based, suggesting a lure to entice the user to interact with the malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
image.jpg pdf-embedded-file PDF EmbeddedFile object 5 at offset 0x4B86D 103987 bytes
SHA-256: 6c14857d2d612c9a6eca2051392fac48e90cf18c35ebf4fc10550f01bb2fdd63
javascript_obj0015_000.js pdf-javascript-stream PDF /JS object 15 at offset 0x384 1946 bytes
SHA-256: 97e6c8fb70f6fedab160a41095c99dce3c9d53a0086d3a8d4e6d47cbe03dce61
Preview script
First 1,000 lines of the extracted script
�� v a r   v   =   a p p . v i e w e r V e r s i o n ; 
 i f   ( v   <   7 ) 
 { 
 	 v a r   n   =   0 ; 
 	 i f   ( t h i s . d a t a O b j e c t s   ! =   n u l l ) 
 	 	 n   =   t h i s . d a t a O b j e c t s . l e n g t h ; 
 	 i f   ( v   > =   5   & &   v   <   6   & &   n   >   0   & &   ( a p p . v i e w e r V a r i a t i o n   = =   " F u l l "   | |   a p p . v i e w e r V a r i a t i o n   = =   " F i l l - I n " ) ) 
 	 { 
 	 	 i f   ( t h i s . e x t e r n a l ) 
 	 	 	 a p p . a l e r t ( "g,e�hcS T+e�N��DN�0 ��g�w �DN�� ��SUQ�  O�[X  c	��geO�[Xe�hcRog,� q6T W(   A c r o b a t  N-bS_ Rog,� ^v�	b�  e�N�   >  e�hc\^`'   >  ]LQev�epcn[��a  0  " ,   3 ,   0 ) ; 
 	 	 e l s e 
 	 	 	 a p p . a l e r t ( "g,e�hcS T+e�N��DN�0 ���	b�  e�N�   >  e�hc\^`'   >  ]LQev�epcn[��a  geg�w �DN�0  " ,   3 ,   0 ) ; 
 	 } 
 	 e l s e   i f   ( v   > =   6   & &   v   <   7 ) 
 	 { 
 	 	 i f   ( n   = =   0 ) 
 	 	 { 
 	 	 	 v a r   n p   =   t h i s . n u m P a g e s ; 
 	 	 	 s y n c A n n o t S c a n ( ) ; 
 	 	 	 f o r   ( v a r   p   =   0 ;   p   <   n p   & &   n   = =   0 ;   + + p ) 
 	 	 	 { 
 	 	 	 	 v a r   a n n o t s   =   t h i s . g e t A n n o t s ( p ) ; 
 	 	 	 	 i f   ( a n n o t s   ! =   n u l l ) 
 	 	 	 	 { 
 	 	 	 	 	 f o r   ( v a r   i   =   0 ;   i   <   a n n o t s . l e n g t h ;   + + i ) 
 	 	 	 	 	 { 
 	 	 	 	 	 	 i f   ( a n n o t s [ i ] . t y p e   = =   " F i l e A t t a c h m e n t " ) 
 	 	 	 	 	 	 { 
 	 	 	 	 	 	 	 n   =   1 ; 
 	 	 	 	 	 	 	 b r e a k ; 
 	 	 	 	 	 	 } 
 	 	 	 	 	 } 
 	 	 	 	 } 
 	 	 	 } 
 	 	 } 
 	 	 i f   ( n   >   0 ) 
 	 	 { 
 	 	 	 i f   ( t h i s . e x t e r n a l ) 
 	 	 	 	 a p p . a l e r t ( "g,e�hcS T+e�N��DN�0 ��g�w �DN�� ��SUQ�e�hcz�S�W�v�n�R�ga�v��v��тrN	��_b� q6T �	b�  e�N��DN�  0  " ,   3 ,   0 ) ; 
 	 	 	 e l s e 
 	 	 	 	 a p p . a l e r t ( "g,e�hcS T+e�N��DN�0 ���	b�  e�hc   >  e�N��DN�  ��SUgeg�w �DN�0  " ,   3 ,   0 ) ; 
 	 	 } 
 	 } 
 }
stream_002_off00000384.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x384 1336 bytes
SHA-256: 5c1ab2af46eef55b0d162c3a84464633475df9b138b64aa21a36ffaffbdffa88

Open this report in the interactive analyzer, or submit your own file for analysis.