PDF malware analysis — malicious · e90dbdf0a24b76e1

MALICIOUS

PDF

152.4 KB Authoring application: Python PDF Library 055 http072057057pybrary056net057pyPdf057

MD5: cea91c0d44ab1964f73e19339cf1a961 SHA-1: 82a70636e856dc0b58c1c0c9f821f16d26a452ec SHA-256: e90dbdf0a24b76e1e37198ff0abd832e8e3cd22ef9bc5625d236f2fcb8cf8382

154 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 JavaScript/JScript T1559.002 Component Object Model Hijacking

The PDF was flagged by multiple heuristics as malicious, including embedded JavaScript, a Flash object, and a secondary embedded PDF. The presence of these elements suggests an attempt to execute malicious code or exploit vulnerabilities. The embedded Flash object and JavaScript are particularly concerning, indicating a potential for drive-by downloads or further exploitation.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 6

Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
RichMedia (Flash) high PDF_RICHMEDIA

PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://adobe.com/AS3/2006/builtin

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`pushpro.swf` `f30a754153ec4fca6ea9fb770704c65d16bb94933b633b8d6ec5725c761d79c6`	pdf-embedded-file	PDF EmbeddedFile object 7 at offset 0xB4F	772 bytes
`polyglot_child_pdf_off000248e2.pdf` `7408b7a8083a3943ec928fd9a857da557803ea0b67dc10466fa0ba90a6ea02fe`	polyglot-child-pdf	Secondary PDF body inside pdf container at offset 0x248E2	6297 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.