Malicious PDF — malware analysis report

Static analysis result for SHA-256 ebd15ee81fe577c3…

MALICIOUS

PDF

206.1 KB
MD5: ec6e3ea9ef14abec8ff0e22f50e85d0a SHA-1: 26a264843697fb1c17da0868ef49f14e7594d357 SHA-256: ebd15ee81fe577c36425ccfa9ee96a376e5da478e522bd63427a21316f56e397
188 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript T1204.002 Malicious File

This PDF contains embedded JavaScript, including calls to eval() and unescape(), which are commonly used to obfuscate malicious code. A secondary PDF was found embedded within the main document, also containing suspicious JavaScript. The presence of these elements strongly suggests the document is designed to exploit PDF vulnerabilities and download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9984

Heuristics 7

  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0052_000.js
45fea71ee6347153ec3719ebc3910509cd6fa568f263c29e7474c694308f5c7d		 pdf-javascript-stream PDF /JS object 52 at offset 0x3F4E 301 bytes
javascript_obj0059_001.js
28d6113dc29ef94de179a1345b6983a9d947da00c945e958d0554de4748a5164		 pdf-javascript-stream PDF /JS object 59 at offset 0x6483 2612 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 3 long base64-like blob(s).
stream_005_off00000b74.bin
e4217c167299ac63f64b8b7e903cc0196f0828693d273431b8b793a12ed0fed3		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xB74 1000 bytes
objstm_0053_00.bin
f9797d0fa28384c30d8bf1da89163104ce539753e417fa1f9c5fd135d1eceb39		 pdf-objstm-decoded PDF /ObjStm 53 0 obj (inflated) 50 bytes
polyglot_child_pdf_off0002cc88.pdf
fb2b52d852722f9b426665a5f60047fc463cd643a8f13b317d15efab7307f861		 polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x2CC88 27574 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.