PDF malware analysis — malicious · ecae45737997d8fd

MALICIOUS

PDF

1.40 MB

MD5: be723e3c4616e09c57803898ae99b0bb SHA-1: 4e1a6ee3d432b124ec1b9a7ede6b96da40139050 SHA-256: ecae45737997d8fd9bdc845c0791dc802ed4d373514deb060670c5988071429a

126 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

This PDF file exhibits malicious behavior through the use of XFA forms and embedded JavaScript. The embedded JavaScript stream, particularly 'stream_002_off00000504.js', contains eval() calls and prototype pollution patterns, indicating it's designed to deobfuscate and execute further malicious code. This strongly suggests the document's primary purpose is to act as a downloader for a second-stage payload, leveraging the embedded scripts to achieve this. The presence of multiple heuristic firings related to JavaScript and embedded payloads supports this assessment.

Heuristics 8

Prototype-pollution JavaScript pattern high CVE related PDF_JS_PROTOTYPE_POLLUTION

PDF JavaScript mutates object prototypes while also referencing privileged or sensitive PDF APIs. This tracks a modern PDF exploit technique family without assigning an unverified CVE.
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/mm/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xfa/promoted-desc/

Extracted artifacts 19

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_001_off00000126.js` `a3df82428e2800391b244eab74ddd0a0d790898d8469f9b0f1e42a9a71a0f1bd`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x126	2429 bytes
`stream_002_off00000504.js` `e4d612c928dc365787907f541f8dad02689a87929c98ab2ad8699e8e0ed67511`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x504	1019081 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 eval/decoder/string-building token(s). Carved artifact contains 4 long base64-like blob(s).
`stream_003_off000361d4.bin` `b16a77f36a1dbb10b68158d5bc3bc5894c1696984d4fcfb18db002aa5ca6cb65`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x361D4	5711 bytes
`stream_004_off0003664f.bin` `cac9c34aeab80f505296f22cac62dc239a5cea1ffae6361d1991c279d415fadb`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x3664F	47559 bytes
`stream_005_off00037614.bin` `8ed9cdaaef2aa769579a4ba835e39256b1c3971f55aa85f7b7c268d675cc53f7`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x37614	8178 bytes
`stream_006_off00037d70.bin` `82883b1c356644ec1217b1e20b594e85f02d0657b4324c7bfe032e52e5e13b8e`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x37D70	374 bytes
`stream_008_off00039d5c.bin` `04d0c9976d81c8ac08186397a6e1b0eda7a6896713d9d7591343b1b07999ec47`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x39D5C	895200 bytes
`stream_016_off0008c2d7.bin` `b2a50460b1fc66b7680230c728241859435e1af538bd15e880282e123198de62`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x8C2D7	102219 bytes
`stream_017_off0009dc50.bin` `f13c106e4ee427254e92d68485d1420403c9e874eee0f33787ff10fe62f8018f`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x9DC50	188972 bytes
`stream_018_off000bd89f.bin` `55cb4b903a99e15bba7a1da6ca466776cafcadab161604e20e685e4472952dcf`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xBD89F	196605 bytes
`stream_019_off000dea3d.bin` `b8e2518b116c26bab0e9f8c1672daf405dedad561157502b657e9005be2029aa`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xDEA3D	367087 bytes
`stream_021_off001300e2.bin` `1e8564d3d89047875dccaa98279599de9d7ddf77240906041f1156ba8edf3315`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1300E2	352198 bytes
`stream_023_off00163e8b.js` `f8721569904600df33f536ddc9f4942717077f9d6c3c4253a8f4de5650fc6531`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x163E8B	1367 bytes
`stream_024_off00164074.js` `91ea259764c68d27b8981a339c02d8ea92224ae5c0d0cd0a7c8f3d645d599090`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x164074	902 bytes
`objstm_0024_00.bin` `e2a3d05f1d0df61c6cbe50ca6bcc777ed2035cb0b7207d78d7b94e30244959e4`	pdf-objstm-decoded	PDF /ObjStm 24 0 obj (inflated)	23672 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 long base64-like blob(s).
`font_00_sfnt_off00048bf5.bin` `c29e5b1537bee8c88b3ffca56c5f24a45ec8da374cf9d4c0b4a78d04fc230949`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x48BF5	95975 bytes
`font_01_sfnt_off00058edf.bin` `4f8a962143becce891b0f8d40b5315e54e2a298ba661302850ebd34e48af909a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x58EDF	99778 bytes
`font_02_sfnt_off0006a19f.bin` `b1260c85fef77007b5f19c1c6f3552e1c6ade6c959082cf86dd6971951ed119c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6A19F	102071 bytes
`font_03_sfnt_off0007bbbc.bin` `926d8eb5abd4c74e46a419aaf25a490564d389c7a250d2392b198a342df65b8a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7BBBC	97320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.