PDF malware analysis — malicious · e9740decc8251b07

MALICIOUS

PDF

13.2 KB Authoring application: Python PDF Library 055 http072057057pybrary056net057pyPdf057

MD5: e16e68b4baf1f80477d055d1da427ec8 SHA-1: 2922bf7ed22071a1bfd33f8be9743de187e62ccc SHA-256: e9740decc8251b076cb3e3ea481d617b4aa750d0aae8dc145afe07f378856c79

94 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: Malicious JavaScript

This PDF file was flagged as malicious by an ML classifier. It contains embedded JavaScript and a RichMedia (Flash) object, indicating an attempt to exploit vulnerabilities. The embedded JavaScript is likely responsible for executing malicious code, potentially leading to further compromise.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 5

RichMedia (Flash) high PDF_RICHMEDIA

PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://adobe.com/AS3/2006/builtin

Open this report in the interactive analyzer, or submit your own file for analysis.