Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a10821b50aabe64…

MALICIOUS

PDF

10.2 KB First seen: 2026-06-14
MD5: f7fd504c2c067391af2bcc62796aedae SHA-1: ee6fc5b1189aefaca5644656d2fe44f2c077efd1 SHA-256: 2a10821b50aabe64bc0aaa227eaf05ea9da1ae15870925f1e31e376e0351dfc4
276 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-1540415 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-1540415
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • exportDataObject + nLaunch — embedded-file launch-on-open dropper critical PDF_JS_EXPORT_LAUNCH_DROPPER
    PDF JavaScript calls exportDataObject() with nLaunch set, which extracts the document's embedded file and launches it in its default application. This is a launch-on-open dropper: the embedded file is the payload. No benign workflow auto-launches an extracted PDF attachment.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
eicar-dropper.doc pdf-embedded-file PDF EmbeddedFile object 8 at offset 0x3E0 31744 bytes
SHA-256: eb0ae2d1cd318dc1adb970352e84361f9b194ff14f45b0186e4ed6696900394a
Detection
ClamAV: Doc.Dropper.Agent-1540415
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.
javascript_obj0009_000.js pdf-javascript-stream PDF /JS object 9 at offset 0x26EF 66 bytes
SHA-256: a5be9c6113e4547c52c62b50fbcf707b392d0560f3f2c1b6e486be27b1dd0020
Preview script
First 1,000 lines of the extracted script
this.exportDataObject({ cName: "eicar-dropper.doc", nLaunch: 2 });
javascript_obj0009_001.js pdf-javascript-stream PDF /JS object 9 at offset 0x26EF 64 bytes
SHA-256: 009d97c59a3a7a22f7c36e7823c3119416d2c20b70ad3559b2c4678dffe73039
Preview script
First 1,000 lines of the extracted script
this.exportDataObject({ cName: "eicar-dropper.doc", nLaunch: 2 }
combined_document_js_000.js deobfuscated-js combined document JavaScript streams at offset 0x26EF 131 bytes
SHA-256: 5d8953bc4649c23802d326b41f68676eb412c9d671c73f753d394c915d96e2f5
Preview script
First 1,000 lines of the extracted script
this.exportDataObject({ cName: "eicar-dropper.doc", nLaunch: 2 });
this.exportDataObject({ cName: "eicar-dropper.doc", nLaunch: 2 }

Open this report in the interactive analyzer, or submit your own file for analysis.