Txt.Downloader.Nemucod-6769573-0 PDF malware analysis — malicious · f4017ec7ead0c47b

MALICIOUS

PDF

46.7 KB Authoring application: PyPDF2

MD5: e7308072fc930ed512b8f43d064b6a82 SHA-1: 84677e0f24bdfa9c5c0bdc032b7b289cb5a4f060 SHA-256: f4017ec7ead0c47bb2eb11e23cb3eef8ea52062510ad65fab0215b4da9734f94

228 Risk Score

Malware Insights

Txt.Downloader.Nemucod-6769573-0 · confidence 95%

MITRE ATT&CK

T1059.001 PowerShell T1105 Ingress Tool Transfer

The PDF file contains embedded JavaScript, flagged by multiple heuristics including PDF_JAVASCRIPT, PDF_JS, and PDF_EVAL. The ML classifier and ClamAV detection strongly indicate maliciousness, identifying it as Txt.Downloader.Nemucod-6769573-0. The extracted JavaScript artifacts, javascript_obj0011_000.js and javascript_obj0011_001.js, show signs of obfuscation and are likely responsible for downloading and executing a second-stage payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9915

Heuristics 6

ClamAV: Txt.Downloader.Nemucod-6769573-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Txt.Downloader.Nemucod-6769573-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `b975f75e6812f7c2c1aba83ce69bb0a9160cbf745136e524c664f2fe3768adb5`	pdf-javascript-stream	PDF /JS object 11 at offset 0x510	17197 bytes
Detection ClamAV: Txt.Downloader.Nemucod-6769573-0 Obfuscation or payload: likely Carved artifact contains 48 eval/decoder/string-building token(s). Carved artifact contains 2 long hex-escaped blob(s).
`javascript_obj0011_001.js` `c3a8faf9f57d19bb601a12af5f2648353f50ef98c20c1e43389116412c8e24b7`	pdf-javascript-stream	PDF /JS object 11 at offset 0x510	232 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.