PDF malware analysis — malicious · f8d43545812d24f1

MALICIOUS

PDF

625.5 KB Created: 2010-09-11 23:35:31 Authoring application: Advanced PDF Repair at http://www.datanumen.com/apdfr/

MD5: ff1dd6e8f33db7af7b754314fdaa9081 SHA-1: faa74f3a1e52b1a7fd73addb4dd39ab4e30870a3 SHA-256: f8d43545812d24f1442a14b50fb7b26513d63164c7e406dbfcfd910b8cd0aa1c

124 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file was flagged by a machine learning classifier as malicious and contains embedded JavaScript. The JavaScript stream, identified as 'javascript_obj0040_000.js', is likely responsible for downloading and executing a second-stage payload, as indicated by the 'PDF_JAVASCRIPT' and 'ML_NYX_PDF_MALICIOUS' heuristics. The presence of multiple 'PDF_FILTER_CHAIN_UNDECODABLE' rules suggests obfuscation techniques were employed.

Machine Learning

Nyx PDF Classifier malicious score 0.9988

Heuristics 7

Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
AcroForm button with action trigger low PDF_ACROFORM_BUTTON

PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.datanumen.com/apdfr/

Extracted artifacts 8

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0040_000.js` `ce454257c70ecbbb156c048a07aba64cfe105043b9191077b106828759ced4b1`	pdf-javascript-stream	PDF /JS object 40 at offset 0x20DA	12401 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
`stream_001_off00000aef.bin` `0f910ffeec733940f6ba1ae41dc6770eab5d615c05bccc95197878b62c8dc45f`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xAEF	2928 bytes
`stream_002_off00000e4d.bin` `29cf1edfedd4f27f3c450646c5dc2510e6bf9e63eee1cd436ac517a465a2e1bf`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xE4D	1650 bytes
`stream_003_off000011bc.js` `672d461752be4a970c8e9721164ce074d252b55d09d46cc09259d2ce4fc09f7f`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x11BC	1546 bytes
`stream_010_off00005a6c.bin` `fe122a09d8a0444608fdc5a6f4981a2dbd469f5bbfacb4bdd327c28ccc343e13`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x5A6C	149 bytes
`stream_011_off00005b20.bin` `4a60a9864cdf7382475d51051a03fdc43b32c31eb508893ccfccece34957f9f1`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x5B20	56 bytes
`font_00_cff_off000083e8.bin` `ea8f409c7366ed46eeb553aa7b404f04641f482ba88463fbe253da60be5787e5`	pdf-font-stream	PDF embedded font (cff) at offset 0x83E8	1138 bytes
`polyglot_child_pdf_off0003c00f.pdf` `b35d9ed4a72a7e450d3eff58aa2eb9f307eae7ffed9e256d7e8a37be38dc435f`	polyglot-child-pdf	Secondary PDF body inside pdf container at offset 0x3C00F	394779 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.