Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ab67ac9bc49bb4f…

MALICIOUS

PDF

1.6 KB First seen: 2026-05-10
MD5: 873bba43da1a0e837bb8178ed384b806 SHA-1: 998a6f54a55beccca59dc76297fc86d98a1d3d1f SHA-256: 6ab67ac9bc49bb4f99fd04207a45049f2b5d61edfe819e8b257bf0258c9818b2
98 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains obfuscated JavaScript, indicated by the 'PDF_JS' and 'PDF_OBFUSCATED_NAME_OBJECT' heuristics. The ML classifier also flagged it as malicious. The JavaScript appears to be designed to execute arbitrary code, likely to download and run a second-stage payload. The presence of obfuscated JavaScript and the malicious classification strongly suggest a spearphishing attachment attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8339

Heuristics 2

  • Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECT
    A PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Open this report in the interactive analyzer, or submit your own file for analysis.