Malicious PDF / .TMP — malware analysis report

Static analysis result for SHA-256 fca22555bcfdbfcd…

MALICIOUS

PDF / .TMP

1.95 MB
MD5: 9bc7605cb1e49280ca8457f3fbd81524 SHA-1: 6c32ed268764fc7a394d6e1a07d3e5032f5463b3 SHA-256: fca22555bcfdbfcd478b016167acee0282762d529538ee945a375dbbdfeb78ca
138 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript and an OpenAction trigger, indicating an attempt to automatically execute code when the document is opened. A secondary embedded PDF was also detected with similar suspicious findings. The primary function appears to be the execution of embedded JavaScript, likely to download and execute a second-stage payload.

Heuristics 6

  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • OpenAction trigger high PDF_OPENACTION
    PDF has an /OpenAction that launches, submits, or opens an external target
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
polyglot_child_pdf_off000043cf.pdf
b48170ac0d86f490f889e803c196a8eaa4df4b7d32154bcaf9730059235dabe3		 polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x43CF 2030641 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.