PDF malware analysis — malicious · e7a93d57be151863

MALICIOUS

PDF

6.1 KB Created: 2010-11-12 16:05:24 +08:00

MD5: 0dc3cfeeb618cf9ec21a6e78f2804976 SHA-1: ce85da5fd85d5891fd27ba9dc3088a44a46acd97 SHA-256: e7a93d57be1518637dcdd2221cb99b66676be48a114756f48c0891d813239598

98 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript and a RichMedia (Flash) object, both flagged as suspicious. The ML classifier also strongly indicates maliciousness. The presence of these elements suggests an attempt to exploit a PDF vulnerability to execute arbitrary code, likely to download and run a secondary payload. No specific family could be identified.

Machine Learning

Nyx PDF Classifier malicious score 0.9691

Heuristics 6

RichMedia (Flash) high PDF_RICHMEDIA

PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload (matched inside decoded stream)
PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE

PDF has 1 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSEOF. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objstm_0027_00.bin` `667b2c75ccf7ac530ab7ab1335ed88701c878c9bd33ce7626a853b18be32e7d1`	pdf-objstm-decoded	PDF /ObjStm 27 0 obj (inflated)	1170 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.