MALICIOUS
296
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1204.002 Malicious File
The PDF file contains JavaScript that exploits a prototype pollution vulnerability (CVE-2026-34621 related). This script is designed to act as a download cradle for a PowerShell payload, indicated by the heuristic 'PDF_PS_DOWNLOAD_CRADLE' and the use of `app.launchURL`. The PowerShell script is likely responsible for downloading and executing the final malicious payload.
Heuristics 8
-
Acrobat prototype-pollution PoC/exploit pattern — CVE-2026-34621 related critical CVE likely CVE_2026_3461_RELATEDPDF JavaScript combines Acrobat prototype pollution targeting privileged state with an execution or sensitive file-read primitive. This matches the likely CVE-2026-34621 PoC/exploit cluster without asserting the exact internal Adobe API chain.
-
Prototype-pollution JavaScript pattern high PDF_JS_PROTOTYPE_POLLUTIONPDF JavaScript mutates object prototypes while also referencing privileged or sensitive PDF APIs. This tracks a modern PDF exploit technique family without assigning an unverified CVE.
-
PowerShell download cradle in PDF action body critical PDF_PS_DOWNLOAD_CRADLEPDF contains a PowerShell download-and-execute cradle (IEX/Invoke-Expression of a remote payload, [Net.WebClient]/[Net.ServicePointManager], or `-ep Bypass -enc <base64>`). These strings are rare in benign PDFs and are strong evidence of payload staging in an attack chain (MITRE T1059.001 + T1105).URL http://10.0.0.5/shell.ps1
- https://www.example.com
-
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOADPDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or HTML script tags. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.URL http://10.0.0.5/shell.ps1
- https://www.example.com
-
app.launchURL with file/cmd/UNC target high PDF_FOXIT_LAUNCHURLPDF JavaScript invokes app.launchURL() with a file://, cmd:, or UNC target — Foxit and Adobe handle these schemes inconsistently and they have been used for code execution and NTLM credential theft. (matched in decompressed stream)URL http://10.0.0.5/shell.ps1
- https://www.example.com
-
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.URL http://10.0.0.5/shell.ps1
- https://www.example.com
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Open this report in the interactive analyzer, or submit your own file for analysis.