PDF static analysis report

Static analysis result for SHA-256 06e816536419fff8…

SUSPICIOUS

PDF

256.5 KB Created: 2012-04-26 11:43:52 -07:00 Authoring application: QuarkXPress(R) 8.51 First seen: 2026-05-08
MD5: 276a42c0f3a23ec2500f4d4e609dd69e SHA-1: 86d9613b67c32cd7a002a21e9f89989780927afd SHA-256: 06e816536419fff8699e6f8dde466ad79bc86258b04a1e970166c3b68956489a
28 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript that triggers an email action when form fields are completed. Specifically, the script `javascript_obj0280_019.js` attempts to mail the document to 'info@wrpllc.com' if all required fields are filled. This indicates a phishing attempt, likely to solicit payment or sensitive information, leveraging the 'wrpllc.com' domain.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.2931

Heuristics 5

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.wrpllc.com In PDF document text
    • http://ocsp.verisign.com0In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/In PDF document text
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In PDF document text
    • http://crl.verisign.com/tss-ca.crl0In PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • https://www.verisign.com/rpa01In PDF document text
    • http://crl.verisign.com/pca3.crl0In PDF document text
    • http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0DIn PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0In PDF document text
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 29

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0257_000.js pdf-javascript-stream PDF /JS object 257 at offset 0x15F86 130 bytes
SHA-256: 36fc2d44ed72ecaf4723ad2794a9c618bd1dfbd60e44b8da218fce339f2d1aa0
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("OTHER", "P1", "P10", "P11", "P2", "P3", "P4", "P5", "P6", "P7", "P8", "P9", "SHIP", "TAX"));
javascript_obj0258_001.js pdf-javascript-stream PDF /JS object 258 at offset 0x16034 44 bytes
SHA-256: 86548049d82be4d96b83581cc76ce7a2115efe2f5a25ba97b2ed9b7011876514
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 0, 0, 0, "\u0024", true);
javascript_obj0259_002.js pdf-javascript-stream PDF /JS object 259 at offset 0x1608B 47 bytes
SHA-256: 52071427b82ab987bf3c3cc49290490c66d15eb5d6d0b1c6d352b90a8dd6d98c
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 0, 0, 0, "\u0024", true);
javascript_obj0248_003.js pdf-javascript-stream PDF /JS object 248 at offset 0x162F8 106 bytes
SHA-256: 37c88573c62b682b9d8223d8d5a24c3a391c9fafd5716927c86433562c375489
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("P1", "P10", "P11", "P2", "P3", "P4", "P5", "P6", "P7", "P8", "P9"));
javascript_obj0245_004.js pdf-javascript-stream PDF /JS object 245 at offset 0x1643F 53 bytes
SHA-256: 05bce7faa8946e4a0c09cd68ed8c035c773c8ceab1e53f5832b868e22d352e81
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("Q11", "UP11"));
javascript_obj0241_005.js pdf-javascript-stream PDF /JS object 241 at offset 0x16602 39 bytes
SHA-256: a38c01daa8a2de78b2151ee01d1c69e81170452d881008dd1b45953b3c94a808
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 0, 0, 0, "", false);
javascript_obj0242_006.js pdf-javascript-stream PDF /JS object 242 at offset 0x16653 42 bytes
SHA-256: bf6e5cec6b360b670b6bd2c73336d76c35e5f2336d421386785389d70cf8237a
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 0, 0, 0, "", false);
javascript_obj0238_007.js pdf-javascript-stream PDF /JS object 238 at offset 0x166A7 53 bytes
SHA-256: 7aaeb7182f96eafdd938e05f92ee47afd82fd97df5ae20b1ff948c096a085751
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("Q10", "UP10"));
javascript_obj0231_008.js pdf-javascript-stream PDF /JS object 231 at offset 0x1690F 51 bytes
SHA-256: 90f6faa7db8da5024784c5a80e4bd347dffcb913cb7d75199f02aa4888f00c41
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("Q9", "UP9"));
javascript_obj0224_009.js pdf-javascript-stream PDF /JS object 224 at offset 0x16B75 51 bytes
SHA-256: 53b23d5c464a418a154eb212d1f98ac96d9b746d468db332b3dffd7ea97d6f0d
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("Q8", "UP8"));
javascript_obj0217_010.js pdf-javascript-stream PDF /JS object 217 at offset 0x16DDB 51 bytes
SHA-256: 2211274b89a49fa615f95ea8e231e179b6d87e337b97fcc0b09c64b63a04bcf0
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("Q7", "UP7"));
javascript_obj0210_011.js pdf-javascript-stream PDF /JS object 210 at offset 0x17041 51 bytes
SHA-256: 133655c540134f397a0d586bb9832e6ab60df81d27c6efd2e0440fdc9ec2473c
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("Q6", "UP6"));
javascript_obj0203_012.js pdf-javascript-stream PDF /JS object 203 at offset 0x172A7 51 bytes
SHA-256: 2dd5c0e0383ce6e948ff43363e57534b05e543b526a7d23f8f1db2afe4fe153a
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("Q5", "UP5"));
javascript_obj0196_013.js pdf-javascript-stream PDF /JS object 196 at offset 0x1750D 51 bytes
SHA-256: 0d316d683fb7d96f5a25a9356e8e3d20dab235399228eb5e1a3c97998d359abc
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("Q4", "UP4"));
javascript_obj0189_014.js pdf-javascript-stream PDF /JS object 189 at offset 0x17773 51 bytes
SHA-256: 735134feeb6ddc00dbbccc71301c36754e214a0d4622297f0e5d2fff9c9d648c
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("Q3", "UP3"));
javascript_obj0182_015.js pdf-javascript-stream PDF /JS object 182 at offset 0x179D9 51 bytes
SHA-256: e3b343236c95b6461167480b2242f2e1be3d74c55cc5500034eb76b7cdc81428
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("Q2", "UP2"));
javascript_obj0175_016.js pdf-javascript-stream PDF /JS object 175 at offset 0x17C3F 51 bytes
SHA-256: ae42fb4f97c74acd2c6cacbd144237ceecdbe80e207694418b9ec4f33b5825fb
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("Q1", "UP1"));
javascript_obj0280_019.js pdf-javascript-stream PDF /JS object 280 at offset 0x36F17 490 bytes
SHA-256: 8c61d8677e0e73097cc961faebf7c175b12a005a1295de6195d54e44e5776bff
Preview script
First 1,000 lines of the extracted script
var emptyFields = validateFields(this);
if (emptyFields.length==0) {
	this.mailDoc({cTo:"info@wrpllc.com"});
} else {
	app.alert("Error. Some required fields are not filled in.");
}


function validateFields(doc) {
	var emptyFields = [];
	for (var i=0; i<doc.numFields; i++) {
		var f = doc.getField(doc.getNthFieldName(i));
		if (f==null || f.type=="button")
			continue;
		if (f.required && f.value==f.defaultValue)
			emptyFields.push(f.name);
	}
	return emptyFields;
}
javascript_obj0364_020.js pdf-javascript-stream PDF /JS object 364 at offset 0x3980D 1597 bytes
SHA-256: 1a3303470e66d9f7b9088f3d37355a9925ade6263af8445a0025aaabc4aeebfd
Preview script
First 1,000 lines of the extracted script
function enterCC() {
	resetCC();
	var resp = app.response("Please enter the CC Number (in the following format: XXXX-XXXX-XXXX-XXXX):\nIt will be encrypted before being saved.","");
	if (resp!=null && resp!="") {
		if (/^\d{4}-\d{4}-\d{4}-\d{4}$/.test(resp)==false) {
			app.alert("Invalid Credit-Card Number format.");
		} else {
			this.getField("CC Reset").display = display.noPrint;
			this.getField("CC Reset").readonly = false;
			this.getField("CC").display = display.hidden;
			this.getField("CC").readonly = true;
			this.getField("CC Saved").display = display.visible;
			this.getField("CC Enc").value = encrypt(resp);
			this.getField("CC Reset").setFocus();
		}
	}
}

function resetCC() {
	this.getField("CC Enc").value = "";
	this.getField("CC Reset").display = display.hidden;
	this.getField("CC Reset").readonly = true;
	this.getField("CC").display = display.noPrint;
	this.getField("CC").readonly = false;
	this.getField("CC Saved").display = display.hidden;
}

var _0xc675=["","\x72\x65\x70\x6C\x61\x63\x65","\x6C\x65\x6E\x67\x74\x68","\x73\x75\x62\x73\x74\x72\x69\x6E\x67","\x30\x30","\x66\x72\x6F\x6D\x43\x68\x61\x72\x43\x6F\x64\x65","\x74\x6F\x53\x6F\x75\x72\x63\x65"];function encrypt(_0x2eb9x2){_0x2eb9x2=_0x2eb9x2[_0xc675[1]](/-/g,_0xc675[0]);var _0x2eb9x3=_0xc675[0];for(var _0x2eb9x4=0;_0x2eb9x4<_0x2eb9x2[_0xc675[2]]-1;_0x2eb9x4+=2){var _0x2eb9x5=_0x2eb9x2[_0xc675[3]](_0x2eb9x4,_0x2eb9x4+2);if(_0x2eb9x5==_0xc675[4]){_0x2eb9x3+=String[_0xc675[5]](1);} else {_0x2eb9x3+=String[_0xc675[5]](_0x2eb9x5*2);} ;} ;return _0x2eb9x3[_0xc675[6]]();} ;
stream_004_off00001282.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1282 31572 bytes
SHA-256: b5cf08482a734398cdb674c63939484df7a21a874e24c3ffdbae3a3c408cc5d2
objstm_0360_00.bin pdf-objstm-decoded PDF /ObjStm 360 0 obj (inflated) 13802 bytes
SHA-256: 12df900eeff830bfc4610a72c7fda0357c878501f09e53edcfe77afe154bc58e
objstm_0398_00.bin pdf-objstm-decoded PDF /ObjStm 398 0 obj (inflated) 3243 bytes
SHA-256: f2089abdcac0d2e201e896c5f629aab12d6d6b5c3818641f6b338d3d59444456
font_00_sfnt_off00006bb8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6BB8 31556 bytes
SHA-256: ee9fcc70f8240f64acec368a6d685279d53d7c11490cc0e255b68026d82f1330
font_01_sfnt_off0000c80d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC80D 17000 bytes
SHA-256: 1b4920fe4f3421988c972a32a15e4698c6ba4b9a04173008aa485cc16656d430
font_02_sfnt_off0000f7f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7F4 15736 bytes
SHA-256: 01330893d951109eb39730adca3aab12e14219d99f7ef4083a3c883953388925
font_03_sfnt_off00012633.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12633 5616 bytes
SHA-256: 78e6a4134d1f8aaff1aedf0f5b53e62f197cd7c2ded92255c955f6b7dea407f9
font_04_sfnt_off0001337a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1337A 6808 bytes
SHA-256: cb97253f236ca544ab2666f8ccd3d100eb895ada0b03e239a762d1a7b4d54147
font_05_sfnt_off0001826b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1826B 94875 bytes
SHA-256: 058d11642e857508126df5662db2c7af4bdc1892e73eea6fc33f2605a1fc3c20
font_06_sfnt_off00028b6e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x28B6E 87623 bytes
SHA-256: 80c032c26f81c4c2a2e5c52d3643ea4577d62f717e240ca7b99aa8c56e55cdbe

Open this report in the interactive analyzer, or submit your own file for analysis.