MALICIOUS
146
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 JavaScript
T1204.002 Malicious File
The PDF file contains XFA form elements and triggers a heap spray exploit via JavaScript, as indicated by the critical PDF_XFA_HEAP_SPRAY heuristic. The unescape() function and String.fromCharCode() are used, suggesting obfuscated JavaScript is present. The ML classifier also flagged the PDF as malicious. The embedded URL is likely part of the exploit chain.
Machine Learning
- Nyx PDF Classifier malicious score 0.9154
Heuristics 5
-
XFA JavaScript heap-spray exploit code critical PDF_XFA_HEAP_SPRAYPDF contains XFA script content with heap-spray or shellcode-like JavaScript markers such as large encoded word sequences, util.pack, large arrays, or spray variable names. This is a weaponised Adobe Reader exploit pattern, not a normal interactive form.
-
unescape() call high PDF_UNESCAPEunescape() found — often used to decode shellcode in PDF JS exploits
-
XFA form low PDF_XFAPDF uses XML Forms Architecture — can contain script logic
-
String.fromCharCode low PDF_FROMCHARCODEString.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.xfa.org/schema/xfa-template/2.5/
Open this report in the interactive analyzer, or submit your own file for analysis.