Malicious PDF — malware analysis report

Static analysis result for SHA-256 f90315be28a8443d…

MALICIOUS

PDF

64.8 KB Created: æÔAþë)KÍåˆPg{\N Authoring application: ¿”¬ºlZv‘§Ë <#fÁk"XΝ¬¤ã‘3¼±hÑ2
MD5: 9d11d3787c2953287852fe79ecf03f2d SHA-1: 37fcefa9df8592ac9dd42a5e484a6dd1e27b1013 SHA-256: f90315be28a8443dc7fc15b648334b7f1b03f54386419d87bce05900ed34db0d
64 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file is flagged as malicious due to embedded JavaScript actions and an encrypted structure that hides its payload. The presence of multiple JavaScript streams indicates an attempt to execute code upon opening. This pattern is commonly used to download and execute further stages of malware. The obfuscated nature of the PDF and the lack of clear document body text prevent a more specific analysis of the lure.

Heuristics 4

  • Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0025_000.js
47c3edc7d1e9495adcf85ee757d5c7a12cef4a65d51e19808ae5ccc8d6a5b6d8		 pdf-javascript-stream PDF /JS object 25 at offset 0x18AB 222 bytes
javascript_obj0026_001.js
8f72fd0af4ec5b0402f7c2fc3b347861b2a7320437864b9293fa82d9186becf3		 pdf-javascript-stream PDF /JS object 26 at offset 0x19B1 136 bytes
javascript_obj0155_003.js
9171b352f327754bf28e8a145df6a9f2b12e23bd8592f48b7204cef4140b9a5f		 pdf-javascript-stream PDF /JS object 155 at offset 0xD60B 38 bytes
javascript_obj0156_004.js
3554ca2cc02572e44b9a815ec325e33f017b251c17321d0b57ab4e74134340e5		 pdf-javascript-stream PDF /JS object 156 at offset 0xD658 41 bytes
javascript_obj0157_005.js
2c86f0989e0fe7e1596b73f0b232311d323001dc84df9492226646d973e5025e		 pdf-javascript-stream PDF /JS object 157 at offset 0xD6A8 87 bytes
javascript_obj0158_006.js
21b29e4db7036e1dee69172246fc80c08c05a09af245da103f973749b7f79259		 pdf-javascript-stream PDF /JS object 158 at offset 0xD728 38 bytes
javascript_obj0159_007.js
d8b62cae85fe6f4ef79c82305c93500cb20a09cb08fabea3a568883de244ffef		 pdf-javascript-stream PDF /JS object 159 at offset 0xD777 41 bytes
javascript_obj0161_008.js
bf07a20eececf6fd25461478ac96a079a6b57ef308d6493f96106acafdcd1272		 pdf-javascript-stream PDF /JS object 161 at offset 0xD7F5 38 bytes
javascript_obj0162_009.js
3d039144cf8adcedba03438afbba5ebb76bd8d1369c447d2c03584cab53b4699		 pdf-javascript-stream PDF /JS object 162 at offset 0xD842 41 bytes
javascript_obj0165_011.js
c8ed4c93220f6140027141000355aa8975bb5b81e622ac0f1fbd54cb8a7f75ec		 pdf-javascript-stream PDF /JS object 165 at offset 0xDA26 55 bytes
javascript_obj0166_012.js
cab53c9e77aaf73d6b1d028fb3448f926424d3aaafef3aa1eefcf40cefff5058		 pdf-javascript-stream PDF /JS object 166 at offset 0xDA85 41 bytes
javascript_obj0172_015.js
16cd5bb77e923b3b45cd7dce3ee111c6004aa245cb259ddf5ee769c0726d7c8a		 pdf-javascript-stream PDF /JS object 172 at offset 0xDBD8 32 bytes
javascript_obj0173_016.js
0120cb5111001d85e69493feaffc029d48b9fbab3df51e43fb6ddac361ef406f		 pdf-javascript-stream PDF /JS object 173 at offset 0xDC20 38 bytes
javascript_obj0174_017.js
4dc3d9af44f97fbe3733071fcd84d1d4faf9fc93625f3a3adf982fef92509b1c		 pdf-javascript-stream PDF /JS object 174 at offset 0xDC6D 41 bytes
javascript_obj0175_018.js
43914e0a5378d064c8dd71cbf505f7049de9d09c30143de097de2b881b9d76ce		 pdf-javascript-stream PDF /JS object 175 at offset 0xDCBD 38 bytes
javascript_obj0176_019.js
2d48e89b9f60d80e17272ca8bfcf3cc409794bdf366b47bb810b8d5a7027aa10		 pdf-javascript-stream PDF /JS object 176 at offset 0xDD0B 41 bytes
javascript_obj0177_020.js
8b81004fa25292b3539246d9dad36e85093937747a033bdc783e30efda14d0b2		 pdf-javascript-stream PDF /JS object 177 at offset 0xDD5B 38 bytes
javascript_obj0178_021.js
d112196a7f9c7918837c6fdf2c0655527e93544349994d68b4857f9a06895d05		 pdf-javascript-stream PDF /JS object 178 at offset 0xDDA9 41 bytes
javascript_obj0179_022.js
d51e1fd1e59ca01512dacbe289556fa47b5de46070ef9147e6a15c0cd63f812c		 pdf-javascript-stream PDF /JS object 179 at offset 0xDDFC 38 bytes
javascript_obj0180_023.js
d6d66350c62d817eac10bd0c722dab79cc507a64d9dfd63cd614388f3a0cdfa3		 pdf-javascript-stream PDF /JS object 180 at offset 0xDE49 41 bytes
javascript_obj0181_024.js
c2127d4a732ee3a4668ec5b9ace7b87b9536eb0625207b6f0b08cae0998e1b81		 pdf-javascript-stream PDF /JS object 181 at offset 0xDE9B 38 bytes
javascript_obj0182_025.js
c28b33e4ca4a979a5c13ee0cb4e9fee1e12951d4a0198cafc838a18769e928e8		 pdf-javascript-stream PDF /JS object 182 at offset 0xDEE9 41 bytes
javascript_obj0183_026.js
68c49a5cdc55ce976c02ac43711185bda470272761e9b8bfc09ac10e0ed21570		 pdf-javascript-stream PDF /JS object 183 at offset 0xDF3B 38 bytes
javascript_obj0184_027.js
5bbe05029d25bded368c17b72b1924b87f821bf28e3f5d84acd981febdbd558e		 pdf-javascript-stream PDF /JS object 184 at offset 0xDF88 41 bytes
javascript_obj0185_028.js
c041db8b6a7505496dfe910c337a7a3188dec1a9691d983717a805d0f77782e3		 pdf-javascript-stream PDF /JS object 185 at offset 0xDFD8 38 bytes
javascript_obj0186_029.js
05cbed10f993396bc7ad291eb8356c69cf305232e27ae1ca5ddc9cb61d3b772a		 pdf-javascript-stream PDF /JS object 186 at offset 0xE026 41 bytes
javascript_obj0187_030.js
208df5e172349638a0ce3f06498ebadfc8f09d52b368984b91a8d5ad45c26fb8		 pdf-javascript-stream PDF /JS object 187 at offset 0xE076 38 bytes
javascript_obj0188_031.js
420c27b9b0b26c92e66d29cae94f9fabe203bbf7c419462f561f70bb7fb5e338		 pdf-javascript-stream PDF /JS object 188 at offset 0xE0C3 41 bytes
javascript_obj0189_032.js
b9561727c8fa0c2e789f1b28a456619ba55100dfcef92be4595f6119e9628929		 pdf-javascript-stream PDF /JS object 189 at offset 0xE113 38 bytes
javascript_obj0190_033.js
9b7296636470139d332f95bfc12732ec8497a209240b9032d3438260bb6b4935		 pdf-javascript-stream PDF /JS object 190 at offset 0xE161 41 bytes
javascript_obj0191_034.js
cd4928baea1e4d4f022b1ee304a40c1df6188b5d6dea69253cefc0a8433c2cf1		 pdf-javascript-stream PDF /JS object 191 at offset 0xE1B3 38 bytes
javascript_obj0192_035.js
4654e14c66685d84c0b2b7d97b9c1687ef597bff3a54fd75824897ebcc1c51a1		 pdf-javascript-stream PDF /JS object 192 at offset 0xE201 41 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.