Malicious PDF — malware analysis report

Static analysis result for SHA-256 f62bc3797a5326d1…

MALICIOUS

PDF

6.1 KB First seen: 2026-05-11
MD5: a1f9bfc1182fc02080f7381b33346ccb SHA-1: 9fde040e999f427176345d6f573ef4a9d0c735ee SHA-256: f62bc3797a5326d1fa6ddb19255e7d21c090cef5677e809b07808484f55d3cd1
148 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The presence of an eval() call within the JavaScript stream (PDF_EVAL) strongly suggests that the script is designed to execute arbitrary code. While no specific malicious URLs were extracted, the embedded JavaScript itself is the primary indicator of malicious intent, likely serving as a downloader or exploit loader. The objstm_0023_00.bin artifact is noted as a potential component of the malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9761

Heuristics 4

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    /*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/ eval(hvkoa6); /*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objstm_0023_00.bin pdf-objstm-decoded PDF /ObjStm 23 0 obj (inflated) 544 bytes
SHA-256: 4429382432a7aa21f226c3db79b0c0906da82da6d4484d26daada0975716da61

Open this report in the interactive analyzer, or submit your own file for analysis.