PDF malware analysis — malicious · 025444b46795a87e

MALICIOUS

PDF

6.1 KB

MD5: f4e90d226806c9b15375f001485b0640 SHA-1: ed7be531459d0bfa7c426385285d1463ee309fde SHA-256: 025444b46795a87e1dd10fc6b2f54ce4060e2d7c4d4f79d17be00925aa3e97d5

318 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.001 PowerShell

The PDF file contains embedded JavaScript that exploits a prototype pollution vulnerability (CVE-2026-34621) to achieve code execution. The script attempts to launch cmd.exe and utilizes a PowerShell download cradle to fetch and execute a payload from the URL http://192.168.1.100/payload.exe. This indicates a clear intent to download and run a second-stage malicious executable.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 9

Acrobat prototype-pollution PoC/exploit pattern — CVE-2026-34621 related critical CVE likely CVE_2026_3461_RELATED

PDF JavaScript combines Acrobat prototype pollution targeting privileged state with an execution or sensitive file-read primitive. This matches the likely CVE-2026-34621 PoC/exploit cluster without asserting the exact internal Adobe API chain.
Prototype-pollution JavaScript pattern high CVE related PDF_JS_PROTOTYPE_POLLUTION

PDF JavaScript mutates object prototypes while also referencing privileged or sensitive PDF APIs. This tracks a modern PDF exploit technique family without assigning an unverified CVE.
PowerShell download cradle in PDF action body critical PDF_PS_DOWNLOAD_CRADLE

PDF contains a PowerShell download-and-execute cradle (IEX/Invoke-Expression of a remote payload, [Net.WebClient]/[Net.ServicePointManager], or `-ep Bypass -enc <base64>`). These strings are rare in benign PDFs and are strong evidence of payload staging in an attack chain (MITRE T1059.001 + T1105).
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
app.launchURL with file/cmd/UNC target high PDF_FOXIT_LAUNCHURL

PDF JavaScript invokes app.launchURL() with a file://, cmd:, or UNC target — Foxit and Adobe handle these schemes inconsistently and they have been used for code execution and NTLM credential theft. (matched in decompressed stream)
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://192.168.1.100/payload.exe
- https://www.example.com

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0006_000.js` `1ea364fe1291866865b37c7b2ead5bf7c7f3c3fb1cc895028439ff12033b15d4`	pdf-javascript-stream	PDF /JS object 6 at offset 0x15	5320 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 12 shell/COM execution token(s). Carved artifact contains 1 long base64-like blob(s).
`javascript_obj0006_001.js` `7d14a1fae8e4e14cd2c4e6502c410e161e7935444fdddac8ba483111f2098d46`	pdf-javascript-stream	PDF /JS object 6 at offset 0x15	5501 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 12 shell/COM execution token(s). Carved artifact contains 1 long base64-like blob(s).
`embedded_pdf_script_000007d1.bin` `5ed707464b9fc35c86a199059bcdb3e6f813d7a6301ef89aa8b808d7d81a6ca6`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x7D1	4090 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 12 shell/COM execution token(s). Carved artifact contains 1 long base64-like blob(s).
`combined_document_js_000.js` `4a52a0e792027f48916bc3e850b30b5805168fe81766a514505e7e9784056dd5`	deobfuscated-js	combined document JavaScript streams at offset 0x15	10822 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 24 shell/COM execution token(s). Carved artifact contains 2 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.