PDF malware analysis — malicious · e70188979cd48124

MALICIOUS

PDF

6.2 KB

MD5: 6d67be8add80bbf45f22bcb39534f667 SHA-1: 7ff5798142af39f956e1a90a38159141dee37f76 SHA-256: e70188979cd48124b9b0b443499060897c4c5387e31b63c7fed4ad546b1a1ab0

256 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1059.001 Command and Scripting Interpreter: PowerShell T1059.003 Command and Scripting Interpreter: Windows Command Shell T1566 Phishing T1566.002 Phishing: Spearphishing Attachment

The PDF file contains embedded JavaScript that exploits a prototype pollution vulnerability (CVE-2026-3461_RELATED, PDF_JS_PROTOTYPE_POLLUTION). This script is designed to execute arbitrary code, likely by leveraging the app.launchURL function to target files or commands. The presence of multiple JavaScript streams and obfuscation indicators suggests a downloader or exploit delivery mechanism.

Heuristics 8

Acrobat prototype-pollution PoC/exploit pattern — CVE-2026-34621 related critical CVE likely CVE_2026_3461_RELATED

PDF JavaScript combines Acrobat prototype pollution targeting privileged state with an execution or sensitive file-read primitive. This matches the likely CVE-2026-34621 PoC/exploit cluster without asserting the exact internal Adobe API chain.
Prototype-pollution JavaScript pattern high CVE related PDF_JS_PROTOTYPE_POLLUTION

PDF JavaScript mutates object prototypes while also referencing privileged or sensitive PDF APIs. This tracks a modern PDF exploit technique family without assigning an unverified CVE.
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or HTML script tags. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.

URL https://www.example.com
app.launchURL with file/cmd/UNC target high PDF_FOXIT_LAUNCHURL

PDF JavaScript invokes app.launchURL() with a file://, cmd:, or UNC target — Foxit and Adobe handle these schemes inconsistently and they have been used for code execution and NTLM credential theft. (matched in decompressed stream)

URL https://www.example.com
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

URL https://www.example.com
String.fromCharCode medium PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Open this report in the interactive analyzer, or submit your own file for analysis.