Malicious PDF — malware analysis report

Static analysis result for SHA-256 571c599ee7fef675…

MALICIOUS

PDF

147.2 KB First seen: 2026-05-08
MD5: 286e2ebde6280c5def4c5c98f5da2c7d SHA-1: 256f72efbb9ec4583a26c98a4eebdcf040f5126a SHA-256: 571c599ee7fef6754d734e0495be63b254c32b3924487b9310000c4859cf64d5
116 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains multiple embedded JavaScript streams, with one particularly large stream (stream_002_off00000536.js) flagged as a suspicious payload. The presence of XFA forms and JavaScript actions indicates an attempt to leverage PDF features for code execution. The JavaScript is likely responsible for downloading and executing a second-stage payload, though its obfuscation prevents a more detailed analysis of its specific actions.

Machine Learning

  • Nyx PDF Classifier clean score 0.1455

Heuristics 7

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
       if (randomNumber < NUMBERS) {
    code += String.fromCharCode(randomNumber + NUMBER_POS);
   } else {
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.adobe.com/go/reader_download In PDF document text
    • http://www.adobe.com/go/acrreaderIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/In PDF document text
    • http://www.xfa.org/schema/xfa-template/3.0/Referenced by PDF JavaScript
    • http://www.w3.org/1999/xhtmlReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.8/Referenced by PDF JavaScript
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xci/3.0/In PDF document text
    • http://www.xfa.org/schema/xfa-connection-set/2.8/In PDF document text
    • http://ns.adobe.com/data-description/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00000122.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x122 2699 bytes
SHA-256: bdbe441b3bdf9cbb44f0212af8e8cc3303398da2a2c4d94e5af31d040fe15004
stream_002_off00000536.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x536 541924 bytes
SHA-256: dedf2d44caf50d10114a84a03b9ed0b84f251765f77d7cd88a1ef6ec49cad545
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
stream_003_off0001f23d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1F23D 301 bytes
SHA-256: eca01acb535a251a495a853fa7fd4b01105efef2c21849fa2ec2c9f7983e615a
stream_004_off0001f35d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1F35D 5962 bytes
SHA-256: 4a9344b7cb6eb6566454834b9a5e433dcdeb47a014d3d701f4a3716e3b5f3895
stream_007_off0001fca7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1FCA7 2893 bytes
SHA-256: 984e33597cee6a139b4eb9668deb8ae3fd023cb2f29b1dac2e77dd6be0d9a93d
stream_009_off00021baf.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x21BAF 1363 bytes
SHA-256: 529357503ec67b623d2a12816cdeea62bd639f2b4ff4e568b01c96cc3f5bfc6f
stream_010_off00021d8d.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x21D8D 902 bytes
SHA-256: e985b5df65c8c3cf732a9074b575fbc594c1c7f0bccc0994182ec7e5c0f7308a
objstm_0010_00.bin pdf-objstm-decoded PDF /ObjStm 10 0 obj (inflated) 12558 bytes
SHA-256: c49e811899dcf48e3fff07a817873b1702329be12c2de0ec545954c7679b9b2e

Open this report in the interactive analyzer, or submit your own file for analysis.