MALICIOUS
236
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File: Malicious File
T1071.001 Application Layer Protocol: Web Protocols
The PDF file contains embedded JavaScript that exploits a prototype pollution vulnerability (CVE-2026-34621 related). The `app.launchURL` heuristic indicates the script attempts to launch an external resource, likely a second-stage payload. The presence of obfuscated JavaScript and suspicious extracted artifacts further supports this attack pattern. The exact family is unknown due to the generic nature of the exploit.
Heuristics 7
-
Acrobat prototype-pollution PoC/exploit pattern — CVE-2026-34621 related critical CVE likely CVE_2026_3461_RELATEDPDF JavaScript combines Acrobat prototype pollution targeting privileged state with an execution or sensitive file-read primitive. This matches the likely CVE-2026-34621 PoC/exploit cluster without asserting the exact internal Adobe API chain.
-
Prototype-pollution JavaScript pattern high PDF_JS_PROTOTYPE_POLLUTIONPDF JavaScript mutates object prototypes while also referencing privileged or sensitive PDF APIs. This tracks a modern PDF exploit technique family without assigning an unverified CVE.
-
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOADPDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or HTML script tags. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.URL https://www.example.com
-
app.launchURL with file/cmd/UNC target high PDF_FOXIT_LAUNCHURLPDF JavaScript invokes app.launchURL() with a file://, cmd:, or UNC target — Foxit and Adobe handle these schemes inconsistently and they have been used for code execution and NTLM credential theft. (matched in decompressed stream)URL https://www.example.com
-
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.URL https://www.example.com
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Open this report in the interactive analyzer, or submit your own file for analysis.