Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b6987318924bc35…

MALICIOUS

PDF

207.1 KB Created: WQÝtrî*¥:0·3…å( JÃQ« First seen: 2026-05-08
MD5: 31a5215d834510d0dc26d9971d236a57 SHA-1: b178e14fcc8c2c3f58e4704782e68088570e2b1e SHA-256: 9b6987318924bc35ac45cef4ad643a1bf102b7f5293571f6cf10e7ddf3c12026
224 Risk Score

Malware Insights

MITRE ATT&CK
T1553.005 Mark-of-the-Web Bypass T1204.002 Malicious File

The PDF contains an embedded file, indicated by the PDF_EMBEDDED heuristic. Additionally, a remote GoTo action suggests an attempt to redirect the user to malicious content. The ML classifier strongly flagged this PDF as malicious. The document body was unreadable, but the combination of heuristics points to a malicious PDF designed to deliver a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9782

Heuristics 8

  • Adobe Reader XFA oneOfChild exploit - CVE-2013-0640 critical CVE likely CVE_2013_0640
    PDF contains the CVE-2013-0640 XFA trigger shape: JavaScript retains an XFA choiceList object, mutates keep.previous to contentArea, then reattaches the object through oneOfChild after a timer-driven heap setup.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Remote GoTo action medium PDF_GOTO_REMOTE
    PDF references a remote or embedded document via GoToR/GoToE with an extension-less or unresolved target
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Encrypted PDF (string and stream contents are opaque to static scan) info PDF_ENCRYPTED
    PDF declares /Encrypt — string objects and stream contents are encrypted with the standard security handler (RC4 or AES). On its own this is informational; legitimate encrypted documents include signed contracts, billing statements, and rights-managed material. Static heuristics cannot inspect encrypted payload bytes.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://crl.adobe.com/prodSvce.crl0 Referenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/3.0/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.8/In PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_000_off0006d90c.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6D90C 289498 bytes
SHA-256: dcefc16710d335e69f60cdd8a0e174d43939d02eaa8dd4c6d7ce4ca63f06495b
Detail pdf-embedded-file PDF EmbeddedFile object 8 at offset 0xF18 828745 bytes
SHA-256: 6d1fa3e1107bf35f7e81df62beaab9b56771526f7ed70c15b60922d761fa7f44
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).
-m pdf-embedded-file-undecodable PDF EmbeddedFile object 1 at offset 0x519; filter decode failed 207203 bytes
SHA-256: fc3a1fe36f406ecc39f98081151a05256d825c1f32697a2e4a3f62fb5965d733
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 8.00, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.