PDF malware analysis — malicious · b74c95c2d623d6e0

MALICIOUS

PDF

13.3 KB Created: 2010-02-28 12:29:20 +03:00 Authoring application: Acrobat Editor 9.0 (via Adobe Acrobat 9.3.1) First seen: 2026-05-11

MD5: c2b13096c63a9339a1e2105f81b32b89 SHA-1: 51cdcd471af9e5976e711c6657609d6ef90938c7 SHA-256: b74c95c2d623d6e0c4d43da9780565c58296ba245c8b72c1a4cde31652a86d67

152 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains embedded JavaScript with an eval() call, indicating an attempt to execute obfuscated code. This is a common technique for delivering malicious payloads. No specific family could be identified due to the obfuscation and lack of further indicators.

Machine Learning

Nyx PDF Classifier malicious score 0.9951

Heuristics 6

JavaScript action low 2 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
Matched line in script
```
eval(this.getField("Text1").value);
```
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0046_000.js`	pdf-javascript-stream	PDF /JS object 46 at offset 0x31CF	35 bytes
SHA-256: `2c7f51751f233d99f2d8c98e0d503132fea5dedeca79550355c6b0a81b0d5748`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script eval(this.getField("Text1").value);

Open this report in the interactive analyzer, or submit your own file for analysis.