Malicious PDF with Embedded JavaScript Opened

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the transfer of a potentially malicious PDF file containing embedded JavaScript over HTTP. It specifically looks for the PDF file header '%PDF' followed by the string '/JavaScript' within the file data, indicating the presence of JavaScript code within the PDF. This is a common technique used by attackers to execute malicious code when the PDF is opened.