PDF malware analysis — malicious · faad48d89ec8d8ef

MALICIOUS

PDF

40.1 KB Created: Òëiaèß"|l½¬Ü¯h¶¤ Authoring application: h.5Pª¥%{N(V¦é (via h.5 Pª¥%~N)Z¦þ÷í)

MD5: 4627fa12891d75a7ba00e5b3201499c0 SHA-1: 396fd84c6411438e54c577b20be175ba038c7ae3 SHA-256: faad48d89ec8d8ef57c4d8b1102ad988b390163b7b182244de53eeff8ba63176

64 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

The PDF file is encrypted and contains JavaScript, indicating an attempt to obfuscate its malicious content. The embedded JavaScript stream, named 'javascript_obj0009_000.js', is likely responsible for executing the payload. The presence of JavaScript within an encrypted PDF strongly suggests a malicious intent, such as delivering a secondary exploit or initiating a phishing campaign. The obfuscation technique points towards T1027 (Obfuscated Files or Information).

Heuristics 4

Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS

PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0009_000.js` `82bdc2c622a529c8e477ea56cb897cb1d6d9740822efda06806bb0e25400c478`	pdf-javascript-stream	PDF /JS object 9 at offset 0x3D6	38294 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.