Malicious PDF — malware analysis report

Static analysis result for SHA-256 fbe3d26f9245f561…

MALICIOUS

PDF

142.2 KB
MD5: 4b7111cb74d9723e3264dabbe0cdfd49 SHA-1: 963ea9c47fc463b9f4117df50320e549478e0f01 SHA-256: fbe3d26f9245f561e5247c4fe01187aef85c26e3b2dbd151dc4b9c586d4bb8f3
66 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by PDF_JAVASCRIPT and PDF_JS heuristics. The JavaScript stream, specifically at offset 0x352A, utilizes eval() and String.fromCharCode, suggesting obfuscation and dynamic code execution. This script is likely responsible for downloading and executing a second-stage payload from one of the embedded URLs. The presence of obfuscated JavaScript and the use of eval() are common techniques for malware delivery.

Heuristics 6

  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • String.fromCharCode low PDF_FROMCHARCODE
    String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules. (matched inside decoded stream)
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.masterfile.com
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/photoshop/1.0/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://www.npes.org/pdfx/ns/id/
    • http://ns.adobe.com/pdfx/1.3/
    • http://ns.adobe.com/xap/1.0/bj/
    • http://ns.adobe.com/xap/1.0/sType/Job#
    • http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000352a.js
0a36e20b7f2237697f7b513c36cc416fed51db7b88e33e2990e0bd040606059a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x352A 3908 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
objstm_0184_00.bin
2ddd5c39f1e31bac86656cfbd60f65130103ce20abd26c2c3e165d80633870e2		 pdf-objstm-decoded PDF /ObjStm 184 0 obj (inflated) 2585 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
objstm_0061_00.bin
cd465b4d6056601e20deb3628b40cef49c2d7a581f634a4f67ab89d310eaa355		 pdf-objstm-decoded PDF /ObjStm 61 0 obj (inflated) 15860 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 long base64-like blob(s).
objstm_0208_00.bin
0457d16ede138ba452dcac838ac207f75e1fd6997799de696b494485f114b3ec		 pdf-objstm-decoded PDF /ObjStm 208 0 obj (inflated) 3250 bytes
font_00_cff_off000054e2.bin
87480e94852d68d5a89e6bcf96ae86fa0bbf35627edc7eba1b7d789dcb6670d9		 pdf-font-stream PDF embedded font (cff) at offset 0x54E2 7060 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.47, consistent with packed or encrypted content.
font_01_cff_off00006f20.bin
0ff13b2f43b02c71fa99fc0e9f82d7b3290d488147db8ab7f8f944f03ec210eb		 pdf-font-stream PDF embedded font (cff) at offset 0x6F20 3417 bytes
font_02_cff_off0001ba21.bin
edc95c2f48c12e5f6a9c63547df44a065c93a61597738e9b151b08d05840fea5		 pdf-font-stream PDF embedded font (cff) at offset 0x1BA21 5768 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.