Attachment: PDF with base64 JavaScript and eval functions

calendar Aug 11, 2026  ·
Share on: linkedin copy

PDF attachment contains base64-encoded JavaScript variables with eval functions, indicating potential code obfuscation and execution techniques commonly used in malicious documents.

Sublime rule (View on GitHub)

 1name: "Attachment: PDF with base64 JavaScript and eval functions"
 2description: "PDF attachment contains base64-encoded JavaScript variables with eval functions, indicating potential code obfuscation and execution techniques commonly used in malicious documents."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(filter(attachments, .file_type == "pdf"),
 8          any(file.explode(.),
 9              .depth == 0
10              and any(.scan.yara.matches, .name in ("pdf_b64_js_var_eval", ))
11          )
12  )  
13
14attack_types:
15  - "Malware/Ransomware"
16tactics_and_techniques:
17  - "Evasion"
18  - "PDF"
19detection_methods:
20  - "File analysis"
21  - "Javascript analysis"
22  - "YARA"
23id: "7fa9cfb5-c043-58b0-8914-d726222073b2"
to-top