PDF malware analysis — malicious · ee062ed4f919a239

MALICIOUS

PDF

2.6 KB

MD5: 71b9de48932045dd9857560d6a1d15e0 SHA-1: 7d58c79ffc958aaaa047af2339f6ebbebd175d00 SHA-256: ee062ed4f919a2396abaa77eefb9b10c0ed1cb20e4ddebc61aa72018504764dd

156 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File Execution: Malicious JavaScript

The PDF contains embedded JavaScript, flagged as malicious by multiple heuristics including an ML classifier. The JavaScript is likely responsible for downloading and executing a second-stage payload, as indicated by the 'generic stage recovery' heuristic. The scan was incomplete due to JavaScript deobfuscation worker failure, suggesting obfuscation was used to hinder analysis.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 6

Correlated malicious PDF JavaScript signals critical PDF_CORRELATED_MALICIOUS_JS

PDF JavaScript or auto-action content is corroborated by exploit staging, ML, or suspicious extracted-artifact findings. This correlation promotes old exploit-kit PDFs that otherwise remain in the suspicious band because each individual signal is intentionally weighted conservatively.
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
syncAnnotScan annotation-staging primitive low PDF_FOXIT_SYNCANNOTSCAN

PDF JavaScript calls syncAnnotScan() — a no-op annotation-enumeration primitive used by exploit-kit JavaScript to stage payload reads from annotation /Subject fields before eval(). Not a vulnerable sink itself; rarely seen in legitimate PDFs. (matched in decompressed stream)
Scan did not complete info SCAN_INCOMPLETE

PDF JavaScript deobfuscation worker failed (worker exit 1); obfuscated JavaScript was not fully inspected.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0005_000.js` `a3319192cac6d4dc4eeb6af2d736b0ffec979b23116a003bc7c23382761c32a5`	pdf-javascript-stream	PDF /JS object 5 at offset 0x148	733 bytes
`deobfuscated.js` `90bd0e2013fe0260ae191822cf93d2c269e76ae583d76acaf1b908252b99288e`	deobfuscated-js	PDF JavaScript deobfuscation pass	2642 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.