PDF malware analysis — malicious · f6ce0750850a3b4a

MALICIOUS

PDF

31.3 KB

MD5: 58a96e2367edc8afb3cb87d0b85233c4 SHA-1: 0a4247095912e443aeebc3b1e486ee8d8dc09d91 SHA-256: f6ce0750850a3b4afd9eab9f14a4143fcd378dd0c3919981546ed21b22e1e47c

86 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF contains embedded JavaScript, indicated by multiple heuristic firings related to PDF JavaScript and `String.fromCharCode`. The ClamAV detection `Js.Trojan.Obfus-48` and the presence of obfuscated JavaScript streams (`javascript_obj0105_000.js`, `javascript_obj0105_001.js`) strongly suggest malicious intent. The JavaScript appears to decode and execute a payload, as evidenced by the `eval(pd)` call and the reconstructed string `app.alert("123", 2, 2);`, likely serving as a downloader for further malicious activity.

Heuristics 5

ClamAV: Js.Trojan.Obfus-48 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Js.Trojan.Obfus-48
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
String.fromCharCode low PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0105_000.js` `f7a9b122559a7471b5eecbdb45eec2e0427dd941aeb84cc993842bb832bad0e0`	pdf-javascript-stream	PDF /JS object 105 at offset 0x6BD3	2139 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 7 eval/decoder/string-building token(s).
`javascript_obj0105_001.js` `0f8872f42c2505e0e6e509b6084884af88d726e7d3da31eb8c29d1d05c9d1c6f`	pdf-javascript-stream	PDF /JS object 105 at offset 0x6BD3	119 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.