Malicious PDF — malware analysis report

Static analysis result for SHA-256 d2e10d8115750b36…

MALICIOUS

PDF

6.8 KB First seen: 2026-05-10
MD5: 817b310ea987e6c227418a346a3f3afa SHA-1: 8e933308d02c41cf907298e1b8c47d9e9936bf20 SHA-256: d2e10d8115750b36be4aa49ddebfebc4412b1733eaba7ec1d55c29f5da1fcb5c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript/JScript T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings related to PDF JavaScript actions and embedded JS streams. The presence of an unescape() call suggests obfuscation, commonly used to hide malicious code. While no specific malicious URLs or scripts were directly extracted and confirmed, the overall structure points to an attempt to execute arbitrary JavaScript, likely for downloading a second-stage payload or exploiting a vulnerability. The benign URLs present do not detract from the suspicious nature of the embedded script.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9802

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    function RandomVar8(RandomVar9){return unescape(RandomVar9.replace(/ARG/g,'%u'));}
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000043d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x43D 670 bytes
SHA-256: 25b4dbfdd9c8b56d1600cd221f92ed85039161aeaab6371af2bdee8038c7fa41
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
stream_004_off0000070c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x70C 485 bytes
SHA-256: 2a5f53cbe396919d12644d1516cfe1dfa27fc30ecd158d1027a7733af2b35667

Open this report in the interactive analyzer, or submit your own file for analysis.