Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6b9d22ad3089d69…

MALICIOUS

PDF

116.2 KB Created: 2023-01-06 08:07:17 -08:00
MD5: 259bd72847441e0c28dc7e7a8fb1a1ec SHA-1: 24a1f809669613df3dc41287bff662427ad53bc1 SHA-256: f6b9d22ad3089d6918597ea0dbc728b7bb26e8cabe5d9c7bc8e835847ed5a612
68 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT and PDF_JS. The ML classifier strongly flagged this PDF as malicious. The embedded JavaScript likely downloads and executes a second-stage payload from the URL https://www.mediafire.com/file/mx1xx5w6a4nkhdb/jod.js/file, which is a common technique for delivering malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9876

Heuristics 8

  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.mediafire.com/file/mx1xx5w6a4nkhdb/jod.js/file
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
1.png
caa4906c92adda1c13c6d3c6167e42d8d01eb7d9b994e7c1a28b769c20f382b7		 pdf-embedded-file PDF EmbeddedFile object 50 at offset 0x19002 2495 bytes
javascript_obj0047_000.js
6b3147ffb790fae42281ebea708978940e69eb971fce00c82cbb392fb814c192		 pdf-javascript-stream PDF /JS object 47 at offset 0x17AA5 1396 bytes
stream_000_off0000005e.js
501379cb0b1d880041ae0eb80bf7d2f050b6887d8d8262310f91ef999067dde4		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5E 7982 bytes
stream_001_off00000a37.js
a9ed3a373bff158cabc1b5965b5e9870bcb6bad714a4cc4b300a01d62738ae9c		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA37 87 bytes
stream_008_off00002111.bin
1eda1e460cdd74b9b91f48213e2ed19bbbe67d02eaf5c032e985171c17c65da5		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2111 4103 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.42, consistent with packed or encrypted content.
stream_023_off0001ccb0.js
ad9a836d53bd89dc15f33bdb5692548356b24f17accf3604a6395d0e948ca914		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1CCB0 228 bytes
objstm_0056_00.bin
67ec71025662adae140f3f565421d8d6bc384c06fc2de5da1fe621dc03b682f4		 pdf-objstm-decoded PDF /ObjStm 56 0 obj (inflated) 254 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.