Malicious PDF — malware analysis report

Static analysis result for SHA-256 c715dd56a889a882…

MALICIOUS

PDF

229.5 KB First seen: 2026-05-13
MD5: 30e6a497475baab58af4eb0508812fa9 SHA-1: 1597dff59a3cc64f4caf2463f0928b2e20418e14 SHA-256: c715dd56a889a88252c4c3281ed0484566f9dfcac710aac58ab559e7acc65afe
136 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ML classifier also flagged the PDF as malicious. The embedded JavaScript stream is the primary indicator of malicious activity, likely intended to execute further malicious code or redirect the user to a malicious site. No document body text was available for analysis.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5193

Heuristics 6

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • exportDataObject + nLaunch — embedded-file launch-on-open dropper critical PDF_JS_EXPORT_LAUNCH_DROPPER
    PDF JavaScript calls exportDataObject() with nLaunch set, which extracts the document's embedded file and launches it in its default application. This is a launch-on-open dropper: the embedded file is the payload. No benign workflow auto-launches an extracted PDF attachment. (matched in decompressed stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0031.bin pdf-embedded-file PDF EmbeddedFile object 31 at offset 0x36533 11279 bytes
SHA-256: 5a94db878f8d8c8340b2b6e6dda8e99f2cdaee4bb29f088b338ae286bbe5e443
Detection
ClamAV: No threats found
Obfuscation or payload: likely
actual_type=ZIP; declared_or_context_type=PDF; filename=embedded_file_obj0031.bin; kind=pdf-embedded-file
stream_014_off00039259.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x39259 1067 bytes
SHA-256: b83aa5c9c1bd503cae0fb7bf8b1b42080b202151eadf6351fcc219e4457501c5

Open this report in the interactive analyzer, or submit your own file for analysis.