Malicious PDF — malware analysis report

Static analysis result for SHA-256 4153dab66028a8ad…

MALICIOUS

PDF

639.0 KB Created: A  bg÷Z(KîÎ 3Ï¢{zêdFÚû°·4(‹<þ–ñKWÕC(ßcƒ ì  ³8 Authoring application: ”°?ÝV_˜Ýk­þ.§Ë£h”<$oƘ-=}ŽN‡®y‡ G•"¤œ*š (via 5nD³Aõì?Oó¿¥Èѯ&/ZVœµŒ¼õýÚ³]¨«°Bëð;ÑzUf) First seen: 2026-05-09
MD5: c7c5611cccb2f3ec8c632cf5545f3fd7 SHA-1: 995927d7f981403f7af48722a1752dd7993400fd SHA-256: 4153dab66028a8ad9c7993f036a6c25902b53f925d3650f527ef8cd712c4f24d
244 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript/JScript

The PDF was flagged as malicious by a machine learning classifier and exhibits several high-severity heuristic firings, including PDF_ENCRYPTED_WITH_JS and ML_NYX_PDF_MALICIOUS. The presence of JavaScript actions and embedded JS streams, combined with encryption, indicates an attempt to conceal malicious code execution. The document body is unreadable, suggesting the content is obfuscated or dynamically generated by the script.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9979

Heuristics 9

  • Adobe Reader CoolType SING font exploit — CVE-2010-2883 critical CVE likely CVE_2010_2883
    PDF embeds a TrueType/OpenType font with an actual SING table and pairs it with JavaScript heap-spray shellcode. This matches the public Adobe Reader CoolType SING exploit shape for CVE-2010-2883.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Obfuscated multi-stage PDF JavaScript heap-spray exploit critical CVE related PDF_JS_OBFUSCATED_MULTISTAGE_HEAPSPRAY
    PDF JavaScript hidden behind nested stream filters and/or a custom in-JS decoder (rolling-XOR stager) decodes to a heap-spray / ROP chain. The spray is only visible after unwinding those layers, which is why the raw heap-spray rules miss it. This is an obfuscated multi-stage Adobe Reader JavaScript exploit; the dropped Windows payload (often named Win.Trojan.Agent by signature AV) is the second stage, not the delivery mechanism.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cgi.adobe.com/special/acrobat/update Referenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/1.0/In PDF document text
    • http://www.xfa.org/schema/xci/2.8/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.4/In PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In PDF document text
    • http://ns.adobe.com/xtd/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xfdf/In PDF document text
    • http://www.xfa.org/schema/xfa-form/2.8/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 23

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0012.bin pdf-embedded-file PDF EmbeddedFile object 12 at offset 0x18D1 86 bytes
SHA-256: f7ee3ef2f8f35d669a6c2b8b0b0ee89655bbc3d04b107a8d22531830f6fc28a1
embedded_file_obj0013.bin pdf-embedded-file PDF EmbeddedFile object 13 at offset 0x1985 1500 bytes
SHA-256: 8aa38aa66bbb66c238f2b2056e2706e71575fe988694258f17d2bf9e80eb10af
embedded_file_obj0014.bin pdf-embedded-file PDF EmbeddedFile object 14 at offset 0x1C59 7249 bytes
SHA-256: 742512912da916ed05162ec3e4d245ac05b5310121e973ea4cc4bebeeaa6cc67
embedded_file_obj0015.bin pdf-embedded-file PDF EmbeddedFile object 15 at offset 0x26B1 159 bytes
SHA-256: da19a956510de42d8522c11b25445b3efa52056541ed94d34b6ccf27c6a9ff47
embedded_file_obj0016.bin pdf-embedded-file PDF EmbeddedFile object 16 at offset 0x2784 3023 bytes
SHA-256: 7a3baf6cd7005199e771f5fac95d2162e961b145b52976bfa7d0f32a10c9758d
embedded_file_obj0017.bin pdf-embedded-file PDF EmbeddedFile object 17 at offset 0x2B15 200 bytes
SHA-256: 4cb349134bdb5f1a1c03281df9b53128ebe947f235398a912a4f0a9f638b24d5
embedded_file_obj0018.bin pdf-embedded-file PDF EmbeddedFile object 18 at offset 0x2C09 1223 bytes
SHA-256: 94561903baadce077f2e3349478a5382a04b3be500869799a4aabc53a7a9fcb6
embedded_file_obj0019.bin pdf-embedded-file PDF EmbeddedFile object 19 at offset 0x2E5D 80 bytes
SHA-256: 2ebdd7efeaa1190ff6bad8cbd649b313e3969564018f204e7385b97c2fab1e19
embedded_file_obj0020.bin pdf-embedded-file PDF EmbeddedFile object 20 at offset 0x2F07 56 bytes
SHA-256: 4a60a9864cdf7382475d51051a03fdc43b32c31eb508893ccfccece34957f9f1
eflow.jpg pdf-embedded-file PDF EmbeddedFile object 38 at offset 0x391C 24941 bytes
SHA-256: b896ad20af385e6ee63aeb6ebcda5a42e2c90c77769c31440b7389c81d3ac992
javascript_obj0040_000.js pdf-javascript-stream PDF /JS object 40 at offset 0x9B6CE 2844 bytes
SHA-256: bb2fe1c0b366bd3a48235c04e822305ef3ab04e575e155f93e34004f56cc10ec
Preview script
First 1,000 lines of the extracted script
�� i f   ( t y p e o f ( t h i s . A D B E )   = =   " u n d e f i n e d " ) 
       t h i s . A D B E   =   n e w   O b j e c t ( ) ; 
 A D B E . L A N G U A G E   =   " E N U " ; 
 A D B E . V i e w e r _ s t r i n g _ T i t l e   =   " A d o b e   A c r o b a t " ; 
 A D B E . V i e w e r _ s t r i n g _ U p d a t e _ D e s c   =   " A d o b e  N�N��hSUf�e� " ; 
 A D B E . V i e w e r _ s t r i n g _ U p d a t e _ R e a d e r _ D e s c   =   " A d o b e   R e a d e r   7 . 0 . 5 " ; 
 A D B E . R e a d e r _ s t r i n g _ N e e d _ N e w _ V e r s i o n _ M s g   =   "kd   P D F  e�N���lBf���rHg,v�   A d o b e   R e a d e r0 ��c	  xn[�  geN �}g e�rHg,� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ R e a d e r _ 6 0 1   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   R e a d e r0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 ��c	  xn[�  T/R�W(~�f�e�� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ R e a d e r _ O l d e r   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   R e a d e r0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 c	  xn[�  ��S�W(~�N �}O�`o� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ V i e w e r _ 6 0 1   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 ��c	  xn[�  T/R�W(~�f�e�� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ V i e w e r _ 6 0   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 ��Y
R6N�N  QW@�  W i n d o w s�  C T R L + C�  M a c�  C o m m a n d + C�	� q6T |��4R0`�v�mO��VhN-N僷S֋�~�O�`o� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ V i e w e r _ O l d e r   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 ��Y
R6�� QW@� q6T |�^ R0`�v�mO��VhN-� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ R e a d e r _ 5 x   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   R e a d e r0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 Y�g� Q~�S�u(� ��SUQ�  xn[�  bS_ mO��Vh� ��c���SS�g e�rHg,v� Q�u0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ R e a d e r _ 6 _ 7 x   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   R e a d e r0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 Y�g� Q~�S�u(� ��SUQ�  xn[�  N �}^v[���g e�v�rHg,0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ V i e w e r   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 Y�g�l�g	f���v�rHg,� \={�kd�hSUS�N�f>y:� OFS��e�l�kc^8]�O\0 � g�N��hSUQC} u ��h9g,N
f>y:0 Y�g�S�N��c�R0   I n t e r n e t� SUQ�  xn[�  S�N �}^v[���g e�rHg,0  " ;
javascript_obj0041_001.js pdf-javascript-stream PDF /JS object 41 at offset 0x9BA1A 870 bytes
SHA-256: 4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 7.0)
{
   ADBE.Reader_Need_Version = 7.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 7.0)
{
   ADBE.Viewer_Need_Version = 7.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
javascript_obj0042_002.js pdf-javascript-stream PDF /JS object 42 at offset 0x9BB72 1532 bytes
SHA-256: f574e4d51594d1a8fd22e125b109b827c437aa898edc78babb62dbb93f8744f8
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.1)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 6.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_5x, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.viewerVersion < 7.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
               app.findComponent({cType:"App", cName:"Reader7", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
               app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
         else if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
stream_012_off000943a4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x943A4 32400 bytes
SHA-256: 0601c4b533d97a420b6c976136126d6e4d79c0f357e07bcf80adaf2c57144440
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.74, consistent with packed or encrypted content.
font_00_sfnt_off0009c6f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9C6F4 71524 bytes
SHA-256: 426fc31e492fe224eea571b50d4b8a8539f1b24595527e3932236df755edd36a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: heap spray 0x41 (A)
embedded_file_obj0001_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 1 at offset 0x58; filter decode failed 112 bytes
SHA-256: d12f574c4af4fbfe357eddcef4540ac06e22a46a777fb5f3fbffd5006c36f404
embedded_file_obj0002_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 2 at offset 0x124; filter decode failed 656 bytes
SHA-256: 3968f01ae58b043d0ea847d683a6f98e25a311e0ba408dbfed2195cb6626f0f1
embedded_file_obj0003_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 3 at offset 0x411; filter decode failed 2656 bytes
SHA-256: fd9115b1f5f40cc016ea65d01a5f475b49a0454db0378209cdfebd912599017a
embedded_file_obj0004_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 4 at offset 0xECD; filter decode failed 144 bytes
SHA-256: f260041106da585936bd16590c632358ecf5430824ac7381dca09f793bab9447
embedded_file_obj0005_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 5 at offset 0xFB9; filter decode failed 848 bytes
SHA-256: ee10786e0c3045ac53b2bd9977c0f8e483c36a53a596f39af03587a986a6def8
embedded_file_obj0006_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 6 at offset 0x1365; filter decode failed 176 bytes
SHA-256: 860f460aec2bd75afe01cf4102e29ddabdbf1e22b46a86b83e231ec4333d8930
embedded_file_obj0007_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 7 at offset 0x1471; filter decode failed 528 bytes
SHA-256: 389be9ba4eb3360467918fadd28193066b4e17a4bc176b73558af08ccb48d5f2
embedded_file_obj0008_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 8 at offset 0x16DD; filter decode failed 112 bytes
SHA-256: ac0d25b31d93e1359fdef189b63b289b7cc9e794827fab6ea25ad9e9b5d74b37

Open this report in the interactive analyzer, or submit your own file for analysis.