Malicious PDF — malware analysis report

Static analysis result for SHA-256 a13edec167ecef9a…

MALICIOUS

PDF

1.31 MB First seen: 2026-05-10
MD5: 0bbe414aa9f2631da37f9ce6ee1f8e95 SHA-1: 6dcc56d9096c3c757d960e9aa9fe21854e8a9cf2 SHA-256: a13edec167ecef9aa0eae2b38dc11f87d35d148afdeba8b65f0feddf279f160c
278 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.003 Windows Command and Shell

The PDF file contains multiple JavaScript streams, one of which (offset 0x4EB) exhibits prototype pollution patterns and uses eval() calls, indicating obfuscated code execution. This script is likely designed to download and execute a secondary payload. The presence of XFA forms and embedded scripts further supports this malicious intent. No specific family could be confidently identified.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6791

Heuristics 9

  • JavaScript action low 4 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Prototype-pollution JavaScript pattern high CVE related PDF_JS_PROTOTYPE_POLLUTION
    PDF JavaScript mutates object prototypes while also referencing privileged or sensitive PDF APIs. This tracks a modern PDF exploit technique family without assigning an unverified CVE.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
       var node = list.item(i);
   el.addItem(eval(node[label]).value, eval(node[val]).value);
  }
  • exportDataObject + nLaunch — embedded-file launch-on-open dropper critical PDF_JS_EXPORT_LAUNCH_DROPPER
    PDF JavaScript calls exportDataObject() with nLaunch set, which extracts the document's embedded file and launches it in its default application. This is a launch-on-open dropper: the embedded file is the payload. No benign workflow auto-launches an extracted PDF attachment. (identified after nested-decoder de-obfuscation)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://s-eacea-web1dev.net1.cec.eu.int/WSXMLReceiverAx1/services/WSXMLReceiverAx1 Referenced by PDF JavaScript
    • http://ocsp.verisign.com0Referenced by PDF JavaScript
    • http://www.monotype.comMonotypeReferenced by PDF JavaScript
    • http://wlsdev2.cc.cec.eu.int:7021/xmlgate/services/XmlgateServiceIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/Referenced by PDF JavaScript
    • http://ns.adobe.com/pdf/1.3/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/mm/Referenced by PDF JavaScript
    • http://purl.org/dc/elements/1.1/Referenced by PDF JavaScript
    • http://ns.adobe.com/xfa/promoted-desc/Referenced by PDF JavaScript
    • http://ns.adobe.com/xdp/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xci/2.8/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.8/Referenced by PDF JavaScript
    • http://www.w3.org/1999/xhtmlReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript
    • http://eacea.ec.europa.euReferenced by PDF JavaScript
    • http://eacea.ec.europa.eu/eforms/index_en.phpReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-locale-set/2.7/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-locale-set/2.6/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-form/2.8/Referenced by PDF JavaScript
    • http://ns.adobe.com/data-description/Referenced by PDF JavaScript
    • http://eacea.ec.europa.eu/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-connection-set/2.8/Referenced by PDF JavaScript
    • http://eacea.ec.europa.eu/WSXMLReceiverAx1P/services/WSXMLReceiverAx1Referenced by PDF JavaScript
    • http://www.w3.org/2000/01/rdf-schema#Referenced by PDF JavaScript
    • https://sanco.ec.europa.eu/RDF/Referenced by PDF JavaScript
    • https://sanco.ec.europa.eu/RDF/Country/ATReferenced by PDF JavaScript
    • https://sanco.ec.europa.eu/RDF/Country/BEReferenced by PDF JavaScript
    • https://sanco.ec.europa.eu/RDF/Country/BGReferenced by PDF JavaScript
    • https://sanco.ec.europa.eu/RDF/Country/CYReferenced by PDF JavaScript
    • https://sanco.ec.europa.eu/RDF/Country/CZReferenced by PDF JavaScript
    • https://sanco.ec.europa.eu/RDF/Country/DKReferenced by PDF JavaScript
    • https://sanco.ec.europa.eu/RDF/Country/EEReferenced by PDF JavaScript
    • http://crl.verisign.com/tss-ca.crl0Referenced by PDF JavaScript
    • http://crl.verisign.com/ThawteTimestampingCA.crl0Referenced by PDF JavaScript
    • https://www.verisign.com/rpaReferenced by PDF JavaScript
    • https://www.verisign.com/rpa01Referenced by PDF JavaScript
    • http://crl.verisign.com/pca3.crl0Referenced by PDF JavaScript
    • http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0DReferenced by PDF JavaScript
    • https://www.verisign.com/rpa0Referenced by PDF JavaScript
    • http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0Referenced by PDF JavaScript
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlReferenced by PDF JavaScript
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlMyriadReferenced by PDF JavaScript
    • https://www.verisign.com/repository/CPSReferenced by PDF JavaScript
    • https://www.verisign.comReferenced by PDF JavaScript
    • https://www.verisign.com/repository/verisignlogo.gif0Referenced by PDF JavaScript
    • https://www.verisign.com/CPS0bReferenced by PDF JavaScript
    • http://www.microsoft.com/truetype/0Referenced by PDF JavaScript
    • http://ocsp.verisign.com/ocsp/status0Referenced by PDF JavaScript
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0Referenced by PDF JavaScript
    +31 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 18

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00000127.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x127 2370 bytes
SHA-256: 7b464e249f91586a383ad4eb0a3511069d529b5964551ddee2766a12903476ff
stream_002_off000004eb.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4EB 890946 bytes
SHA-256: 21094abb199a994107be219074ff96f4e71ad0d6059e50205539940a89d507d0
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 4 long base64-like blob(s).
stream_003_off0002f1e4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2F1E4 5711 bytes
SHA-256: b16a77f36a1dbb10b68158d5bc3bc5894c1696984d4fcfb18db002aa5ca6cb65
stream_004_off0002f65f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2F65F 47559 bytes
SHA-256: cac9c34aeab80f505296f22cac62dc239a5cea1ffae6361d1991c279d415fadb
stream_005_off00030624.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x30624 8079 bytes
SHA-256: aed74f4e238703d36f49c1283dddd71286163ad0a8dfb9f3bd16e0d999508b69
stream_006_off00030d67.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x30D67 364 bytes
SHA-256: 68bfd948fc6de63e3c605a1df613b7ff2c0b9979daeda1c78dd82d3551f0a512
stream_013_off0007499a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7499A 102219 bytes
SHA-256: b2a50460b1fc66b7680230c728241859435e1af538bd15e880282e123198de62
stream_014_off00086313.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x86313 188972 bytes
SHA-256: f13c106e4ee427254e92d68485d1420403c9e874eee0f33787ff10fe62f8018f
stream_015_off000a5f62.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA5F62 196605 bytes
SHA-256: 55cb4b903a99e15bba7a1da6ca466776cafcadab161604e20e685e4472952dcf
stream_016_off000c7100.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xC7100 367087 bytes
SHA-256: b8e2518b116c26bab0e9f8c1672daf405dedad561157502b657e9005be2029aa
stream_018_off001187a5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1187A5 352198 bytes
SHA-256: 1e8564d3d89047875dccaa98279599de9d7ddf77240906041f1156ba8edf3315
stream_020_off0014c545.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x14C545 1367 bytes
SHA-256: f8721569904600df33f536ddc9f4942717077f9d6c3c4253a8f4de5650fc6531
stream_021_off0014c72e.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x14C72E 902 bytes
SHA-256: 91ea259764c68d27b8981a339c02d8ea92224ae5c0d0cd0a7c8f3d645d599090
objstm_0021_00.bin pdf-objstm-decoded PDF /ObjStm 21 0 obj (inflated) 23627 bytes
SHA-256: b3027169be6d7b3d205244c66e82b15ed2ac9cd7b59e4e0d850a9360850b0073
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 long base64-like blob(s).
font_00_sfnt_off000312b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x312B8 95975 bytes
SHA-256: c29e5b1537bee8c88b3ffca56c5f24a45ec8da374cf9d4c0b4a78d04fc230949
font_01_sfnt_off000415a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x415A2 99778 bytes
SHA-256: 4f8a962143becce891b0f8d40b5315e54e2a298ba661302850ebd34e48af909a
font_02_sfnt_off00052862.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x52862 102071 bytes
SHA-256: b1260c85fef77007b5f19c1c6f3552e1c6ade6c959082cf86dd6971951ed119c
font_03_sfnt_off0006427f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6427F 97320 bytes
SHA-256: 926d8eb5abd4c74e46a419aaf25a490564d389c7a250d2392b198a342df65b8a

Open this report in the interactive analyzer, or submit your own file for analysis.