Malicious PDF — malware analysis report

Static analysis result for SHA-256 1dc6ffc5cbf60659…

MALICIOUS

PDF

322.7 KB First seen: 2026-05-04
MD5: 443308ae5543877789153a4922b8fba7 SHA-1: c25d8e21090bd226171bd7fc17ee0d0703e078da SHA-256: 1dc6ffc5cbf60659a9b06be21b3397bed60881ad9888920d709bef7babedec95
196 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

This PDF file was flagged as malicious by an ML classifier and contains multiple JavaScript-related heuristics, including an eval() call. The embedded JavaScript streams, particularly the large decompressed one, are highly suspicious and likely responsible for downloading and executing a secondary payload. The exact functionality of the script is obscured, but its presence and the eval() call strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 6

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    }
pRESSURA = eval(pERMANENDO(sHOGG('_es_ca______peun_',1289,409)));
function cORNUTE(s) {
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PHP webshell / backdoor source high WEBSHELL_PHP
    The file contains PHP server-side code with the signature of a webshell/backdoor (feature-rich command/code-exec sink cluster). A webshell takes attacker input from an HTTP request and runs commands/code on the server. Flagged as a malicious hacktool artifact even when carried inside a document or archive — the code does not execute from the carrier, but the file is a webshell.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/ Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xci/3.0/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.8/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/'/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0001_000.js pdf-javascript-stream PDF /JS object 1 at offset 0xA 49 bytes
SHA-256: 17a4bb5ff0cf21511ba4b0451b455174dd57deb1427385b26eb2296ec48ec9cb
Preview script
First 1,000 lines of the extracted script
0 >> 0 >> 0 >> 0 >> 0 >> 0;
function sHOGG(c,d,e
stream_000_off0004f08a.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4F08A 289498 bytes
SHA-256: dcefc16710d335e69f60cdd8a0e174d43939d02eaa8dd4c6d7ce4ca63f06495b

Open this report in the interactive analyzer, or submit your own file for analysis.