Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c5393b81f845056…

MALICIOUS

PDF

65.4 KB Created: ´®ïãó}E&(B [ ÿ õÈ"ØÅ Authoring application: ¶æ¼¾¦||Yò (via ±÷¯¼¡.7]JU«RQªØ +ØÕ^߶Ðq!ÙZrTY±) First seen: 2026-05-08
MD5: 5b15a5b1982612424c5659cf1a5e5bbb SHA-1: 09f32507ed494f5f928ac3ce5687b2000b521127 SHA-256: 9c5393b81f84505610abc3a0f68dc0cd4831b313ba98d5982bb563863ebeb98f
72 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

This PDF file exhibits multiple indicators of malicious intent, including JavaScript actions and an encrypted payload hidden via an OpenAction. The presence of embedded JavaScript streams, combined with PDF-specific heuristics like ASCII85Decode filters and AcroForm button actions, suggests an attempt to obscure and deliver a malicious payload. The exact nature of the payload is not discernible due to obfuscation and encryption, but the overall pattern points towards a phishing or exploit delivery mechanism.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3106

Heuristics 5

  • Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0038_000.js pdf-javascript-stream PDF /JS object 38 at offset 0x2509 38 bytes
SHA-256: 6f4ebd4f520911136751e3878ad4b37118b4c12f3bcf22c8ada375ca49290802
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 3, 0, 0, "", true);
javascript_obj0039_001.js pdf-javascript-stream PDF /JS object 39 at offset 0x255D 41 bytes
SHA-256: 969138dc842bacdbedfeaf4aaf6e3a512fdc0a2d7ed5d6a300c5a280fccb3bd0
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 3, 0, 0, "", true);
javascript_obj0042_004.js pdf-javascript-stream PDF /JS object 42 at offset 0x2647 38 bytes
SHA-256: 729ca6264168a99bb97c0658554d5b34491e18c8ba65c8fc35d432391343ef33
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 0, 0, 0, "", true);
javascript_obj0043_005.js pdf-javascript-stream PDF /JS object 43 at offset 0x269B 41 bytes
SHA-256: a011daa0ff2a361a79751d1cef42de9f50cfaaf7fc839fe5b5e485c7248b809d
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 0, 0, 0, "", true);
font_00_sfnt_off00005a71.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5A71 39968 bytes
SHA-256: 6fc721a600afb86aa549e1bd0ee3114efcd64127b8ad32563635639a6dc07be0
javascript_obj0080_003.js pdf-javascript-stream PDF /JS object 80 at offset 0x5351 41 bytes
SHA-256: c6c136ca50e34cc48ae1e6d55fa3aa33c733ff715cd70fa3e9740c4e74a30365
Preview script
First 1,000 lines of the extracted script
U�j�I:P� �� m�� �N�V�q$���rşl� � � 
i)[
javascript_obj0081_004.js pdf-javascript-stream PDF /JS object 81 at offset 0x53AB 38 bytes
SHA-256: c06e67cabc4246d36d247c24490975e4cfec6d90e3d4cc0ada79d6e9e52015a1
Preview script
First 1,000 lines of the extracted script
�� =ʗY��RS���]B� B���m?L�Eh�eR�0�����
javascript_obj0084_006.js pdf-javascript-stream PDF /JS object 84 at offset 0xF0B3 38 bytes
SHA-256: cd5f039af054c84e40a61d94ae2e5ca8fc108ecbb6410df497f03d343b1bb1f9
Preview script
First 1,000 lines of the extracted script
�8C�_9 �qx� 2� �w�S��� Y� ����9   �\
javascript_obj0087_009.js pdf-javascript-stream PDF /JS object 87 at offset 0xF19F 41 bytes
SHA-256: 6b8f55c7641a7cd3afe1a9213adddf23a53ac6da8cb872e5b8b8622f11b30d4f
Preview script
First 1,000 lines of the extracted script
�N K��ӈ��^�b 5 �O��^�.=�|�� � �� �  k �

Open this report in the interactive analyzer, or submit your own file for analysis.