← All detection heuristics · Suspicious
high
PDF_JS_JSFUCK_FUNCTION_STAGER
What it means
PDF JavaScript constructs a hidden second stage through a JSFuck primitive table and the Function constructor.
Why it fires
The scanner evaluates only a bounded, inert subset of the JSFuck character-construction grammar and never executes JavaScript. Deriving Function and supplying it with a large dynamically assembled body is a strong exploit-stager signal in PDF JavaScript.