Malicious PDF — malware analysis report

Static analysis result for SHA-256 085ed12cea545a19…

MALICIOUS

PDF

273.0 KB Created: 2009-05-11 10:08:39 +03:00 Authoring application: Adobe LiveCycle Designer ES 8.2 First seen: 2026-05-10
MD5: 1c41ea1b3864b18d3c90bbef7c6a8c0e SHA-1: 93927f36fb9827c93e81f22db616608c725b2c0a SHA-256: 085ed12cea545a19171679ce3390ba99965a219b346ffd13998ab1a43b808995
214 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment T1041 Exfiltration Over C2 Channel

The PDF file contains embedded JavaScript that utilizes the `submitForm` and `unescape` functions, indicating an attempt to exfiltrate data. The `PDF_JS_EXPLOIT_CLUSTER` and `PDF_UNESCAPE` heuristics strongly suggest malicious JavaScript is present. The script appears to be designed to collect user identity information and potentially submit it to a remote location, aligning with credential exfiltration.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9460

Heuristics 10

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
            var decodedFileName = unescape(doc.documentFileName);
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • SubmitForm action medium PDF_SUBMITFORM
    PDF has a /SubmitForm action — form data can be silently posted to an attacker-controlled URL
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ocsp.verisign.com0 In extracted file (font_01_sfnt_off00012891.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/In PDF document text
    • http://crl.adobe.com/prodSvce.crl0In PDF document text
    • https://www.adobe.com/misc/pki/prod_svce_cps.html0In PDF document text
    • http://crl.adobe.com/cds.crl0���~�|�z0x1In PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.6/Referenced by PDF JavaScript
    • http://www.w3.org/1999/xhtmlReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In extracted file (embedded_file_obj0008.bin)
    • http://www.xfa.org/schema/xci/2.6/In extracted file (embedded_file_obj0009.bin)
    • http://www.xfa.org/schema/xci/2.8/In extracted file (embedded_file_obj0009.bin)
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In extracted file (embedded_file_obj0011.bin)
    • http://www.xfa.org/schema/xfa-locale-set/2.6/In extracted file (embedded_file_obj0011.bin)
    • http://ns.adobe.com/xfdf/In extracted file (embedded_file_obj0014.bin)
    • http://www.xfa.org/schema/xfa-form/2.8/In extracted file (embedded_file_obj0015.bin)
    • http://crl.verisign.com/tss-ca.crl0In extracted file (font_01_sfnt_off00012891.bin)
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In extracted file (font_01_sfnt_off00012891.bin)
    • https://www.verisign.com/rpaIn extracted file (font_01_sfnt_off00012891.bin)
    • https://www.verisign.com/rpa01In extracted file (font_01_sfnt_off00012891.bin)
    • http://crl.verisign.com/pca3.crl0In extracted file (font_01_sfnt_off00012891.bin)
    • http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0DIn extracted file (font_01_sfnt_off00012891.bin)
    • https://www.verisign.com/rpa0In extracted file (font_01_sfnt_off00012891.bin)
    • http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0In extracted file (font_01_sfnt_off00012891.bin)
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlIn extracted file (font_01_sfnt_off00012891.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 20

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0008.bin pdf-embedded-file PDF EmbeddedFile object 8 at offset 0x1FA4 162 bytes
SHA-256: dc5340ca6b8faa6e248a740e920df7c0eb2bd05e99bdb59be07b72db43557153
embedded_file_obj0009.bin pdf-embedded-file PDF EmbeddedFile object 9 at offset 0x2093 2226 bytes
SHA-256: 606d512836d3eeec7f64a82d49963e8a0c0e609a462440dfb0a441983d6b9ae2
embedded_file_obj0010.bin pdf-embedded-file PDF EmbeddedFile object 10 at offset 0x243C 60203 bytes
SHA-256: d6e376e98576f857784df370e74358e4e5740db25f90fef09817d69015230b7f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
embedded_file_obj0011.bin pdf-embedded-file PDF EmbeddedFile object 11 at offset 0x45EB 2967 bytes
SHA-256: 8cc670d8d2f8fc6f4f0ebb1794bca1ba2e56b946a3f546d9b64c97b97d6104e7
embedded_file_obj0012.bin pdf-embedded-file PDF EmbeddedFile object 12 at offset 0x496A 871 bytes
SHA-256: 86b509487430fe2684e4c72fc9e0a07cc57145983a916b237d13a384b6b32322
embedded_file_obj0013.bin pdf-embedded-file PDF EmbeddedFile object 13 at offset 0x4A59 1535 bytes
SHA-256: ca28a4c9a405031892afb9851e38dcdc3db5b47daca8773a021830cd791c1216
embedded_file_obj0014.bin pdf-embedded-file PDF EmbeddedFile object 14 at offset 0x4D1E 80 bytes
SHA-256: 2ebdd7efeaa1190ff6bad8cbd649b313e3969564018f204e7385b97c2fab1e19
embedded_file_obj0015.bin pdf-embedded-file PDF EmbeddedFile object 15 at offset 0x4DC9 233 bytes
SHA-256: 81dd4e4a7f54fef2f09b8de7ee71036db7ea020657b0d07cc7fab7e4482af11d
embedded_file_obj0377.bin pdf-embedded-file PDF EmbeddedFile object 377 at offset 0x3FBD0 1893 bytes
SHA-256: 6bcfe81c94be3635ceecfaaa776868892753b3a4dfff9352e39a96315fb6903f
embedded_file_obj0378.bin pdf-embedded-file PDF EmbeddedFile object 378 at offset 0x3FD9D 1814 bytes
SHA-256: 4bd65eafcdb262e6a7eb278af3ae4be7b1a9ca650f86f4c6a2d2afd621c3700b
javascript_obj0196_000.js pdf-javascript-stream PDF /JS object 196 at offset 0x94DD 999 bytes
SHA-256: 4a3be1c97fa660c78458adbf8467d9ef0ece4b4be6574ddb6a76861e566be29f
Preview script
First 1,000 lines of the extracted script
//@@FORMSWORKFLOW auto-generated script

/**************************************************************
AdobePatentID="B643"
**************************************************************/
var AdobePatentID = "AdobePatentID=\"B643\"";

// initialize some constants
var METADATA_ANNOT_NAME = "adhocFormState";
var STATE_DISTRIBUTED   = "distributed";
var STATE_RETURNED      = "returned";
var PROP_WFSTATE        = "wfState";

// The following code executes only for Acrobat/Reader under 8.0
if (app.viewerVersion < 9) {
    // Change the distributed state to returned state
    var annot = this.getAnnot(0, METADATA_ANNOT_NAME);
    if (annot != null) {
        var arrProps = new Array();
        arrProps = annot.contents.split(";");
        var wfState = getProperty(arrProps, PROP_WFSTATE);
        if (wfState == STATE_DISTRIBUTED) {
            setProperty(arrProps, PROP_WFSTATE, STATE_RETURNED);
            annot.contents = arrProps.join(";");
        }
    }
}
javascript_obj0207_001.js pdf-javascript-stream PDF /JS object 207 at offset 0xB646 11503 bytes
SHA-256: 134dcea3245a20a641ef7275cb3bef9d6455db27e7caac2bd70f3663f8b3b24f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
//@@FORMSWORKFLOW auto-generated script

/**************************************************************
AdobePatentID="B643"
**************************************************************/
var AdobePatentID = "AdobePatentID=\"B643\"";

// Show a dialog to ask the user's name and email during submit.
askUserIdentity = function(doc)
{
    // string constants
    var dlgStrings =
    {
        sDlgTitle:          "Send Form",
        sEmailLabel:        "&Email Address:",
        sNameLabel:         "Full &Name:",
        sSubmitLabel:       "&Send",
        sToLabel:           "To:",
        sSubjectLabel:      "Subject:",
        sSubjectContent:    "Submitting Completed Form",
        sAttachmentLabel:   "Attachment:",
        sFromLabel:         "From:",
        sErrorEmailRequired:"Please enter a valid email address.",
        sErrorNameRequired: "Please enter your name."
    };
    
    var dlgElems = [];
    dlgElems[dlgElems.length] = {
        type: "view",
        align_children: "align_left",
        elements:
        [
            {
                type: "view",
                align_children: "align_row",
                elements:
                [
                    {
                        type: "static_text",
                        name: dlgStrings.sToLabel,
                        width: 80,
                        bold: true,
                        font: "dialog"
                    },
                    {
                        type: "static_text",
                        item_id: "sdto",
                        width: 270,
                        font: "dialog"
                    }
                ]
            },
            {
                type: "view",
                align_children: "align_row",
                elements:
                [
                    {
                        type: "static_text",
                        name: dlgStrings.sSubjectLabel,
                        bold: true,
                        width: 80,
                        font: "dialog"
                    },
                    {
                        type: "static_text",
                        name: dlgStrings.sSubjectContent,
                        width: 270,
                        font: "dialog"
                    }
                ]
            },
            {
                type: "view",
                align_children: "align_row",
                elements:
                [
                    {
                        type: "static_text",
                        name: dlgStrings.sAttachmentLabel,
                        bold: true,
                        width: 80,
                        font: "dialog"
                    },
                    {
                        type: "static_text",
                        item_id: "atch",
                        width: 270,
                        font: "dialog"
                    }
                ]
            },
            {
                type: "gap",
                height: 5,
                width: 350
            },
            {
                type: "static_text",
                name: dlgStrings.sFromLabel,
                bold: true,
                font: "dialog"
            },
            {
                type: "static_text",
                name: dlgStrings.sEmailLabel,
                bold: true,
                font: "dialog"
            },
            {
                type: "edit_text",
                item_id: "emal",
                width: 250
            },
            {
                type: "static_text",
                name: dlgStrings.sNameLabel,
                bold: true,
                font: "dialog"
            },
            {
                type: "edit_text",
                item_id: "name",
                width: 250
            },
            {
                type: "gap",
                height: 5,
                width: 350
            },
            {
                type: "ok_cancel",
                ok_name: dlgStrings.sSubmitLabel
            }
        ]
    }
    
    var desc = {
        resourceContext: "AcroForm",
        description:  {
            name: dlgStrings.sDlgTitle,
            elements: [
                {
                    type: "view",
                    align_children: "align_left",
                    elements: dlgElems
                }
            ]
        }
    }

    desc.initialize = function(dialog)
    {
        var METADATA_ANNOT_NAME = "adhocFormState";
        var PROP_INITIATOR = "initiator";
        
        var initiator;
        var annot = doc.getAnnot(0, METADATA_ANNOT_NAME);
        if (annot != null) {
            var arrProps = new Array();
            arrProps = annot.contents.split(";");
            initiator = getProperty(arrProps, PROP_INITIATOR);
        }
        
        var decodedFileName = unescape(doc.documentFileName);
        var initVars =
        {
            sdto: initiator,
            atch: decodedFileName
        }
        dialog.load(initVars);
    }

    desc.validate = function(dialog)
    {
        var values = dialog.store();
        if (values.emal == "") {
            app.alert(dlgStrings.sErrorEmailRequired);
            return false;
        }
        if (values.name == "") {
            app.alert(dlgStrings.sErrorNameRequired);
            return false;
        }
        return true;
    };
        
    desc.commit = function(dialog)
    {
        this.result = new Object;
        var values = dialog.store();
        this.result.name = values.name;
        this.result.email = values.emal;
    };

    var ret = app.execDialog(desc);
    if (ret == "ok")
        return desc.result;
    else
        return null;
};

askEmailClient = function(doc)
{
// string constants
    var dlgStrings =
    {
        sDlgTitle:      "Select Email Client",
        sDlgText:       "Please indicate the option which best describes how you send mail.",
        sDesktop:       "&Desktop Email Application",
        sDesktopDesc:   "Choose this option if you currently use an email application such as Microsoft Outlook Express, Microsoft Outlook, Eudora, or Mail.",
        sInternet:      "&Internet Email",
        sInternetDesc:  "Choose this option if you currently use an Internet email service such as Yahoo or Microsoft Hotmail. You will then need to save your form and return it manually to johanna.kontturi@certia.fi using your Internet email service."
    };
    
    var dlgElems = [];
    dlgElems[dlgElems.length] = {
        type: "view",
        align_children: "align_left",
        alignment: "align_fill",
        elements:
        [
            {
                type: "static_text",
                name: dlgStrings.sDlgText,
                width: 350,                
                font: "dialog"
            },
            {
                type: "radio",
                name: dlgStrings.sDesktop,
                item_id: "rad1",
                group_id: "rgrp",
                bold: true,
                font: "dialog"
            },
            {
                type: "view",
                align_children: "align_top",
                elements:
                [
                    {
                        type: "gap",
                        width: 20
                    },
                    {
                        type: "static_text",
                        name: dlgStrings.sDesktopDesc,
                        wrap_name: true,
                        width: 342,
                        font: "dialog"
                    }
                ]
            },            
            {
                type: "radio",
                name: dlgStrings.sInternet,
                item_id: "rad2",
                group_id: "rgrp",
                bold: true,
                font: "dialog"

            },
            {
                type: "view",
                align_children: "align_top",
                elements:
                [
                    {
                        type: "gap",
                        width: 20
                    },
                    {
                        type: "static_text",
                        name: dlgStrings.sInternetDesc,
                        wrap_name: true,
                        width: 342,
                        font: "dialog"
                    }
                ]
            },
            {
                type: "gap",
                height: 5,
                width: 350
            },
            {
                type: "ok_cancel",
            }
        ]
    }
    
    var desc = {
        resourceContext: "AcroForm",
        description:  {
            name: dlgStrings.sDlgTitle,
            width: 250,
            elements: [
                {
                    type: "view",
                    align_children: "align_left",
                    elements: dlgElems
                }
            ]
        }
    }
    
    desc.commit = function(dialog)
    {
        this.result = new Object;
        var values = dialog.store();
        this.result.send = values.rad1;
        this.result.save = values.rad2;
    };

    var ret = app.execDialog(desc);
    if (ret == "ok")
        return desc.result;
    else
        return null;            
};

/**************************************************************
AdobePatentID="B643"
**************************************************************/
// set a new property value to a property in the specified array.
setProperty = function(arrProps, propName, propValue)
{
    var i;
    var bSet = false;
    for (i = 0; i < arrProps.length; i++) {
        var propParts = new Array();
        propParts = arrProps[i].split(":");
        if (propParts[0] == propName) {
            propParts[1] = propValue;
            arrProps[i] = propParts.join(":");
            bSet = true;
            break;
        }
    }
    
    if (!bSet)
        arrProps[arrProps.length] = propName + ":" + propValue;
};

/**************************************************************
AdobePatentID="B643"
**************************************************************/
// get the value for a property in the specified array.
getProperty = function(arrProps, propName)
{
    var i;
    for (i = 0; i < arrProps.length; i++) {
        var propParts = new Array();
        propParts = arrProps[i].split(":");
        if (propParts[0] == propName) {
            return propParts[1];
        }
    }
    return null;
};

/**************************************************************
AdobePatentID="B643"
**************************************************************/
showAutoGenSubmitBtn = function(bShow)
{
    var autoGenSubmitName = "form1[0].ButtonField1[0]";
    var fld = this.getField(autoGenSubmitName);
    if (fld != null)
    {
        var b= this.dirty;
        if (bShow)
            fld.display = display.noPrint;
        else
            fld.display = display.hidden;
        this.dirty= b;
    }
};

// Hide the auto-generated submit button for Acrobat/Reader >= 9.0
if (app.viewerVersion >= 9)
    showAutoGenSubmitBtn(false);
else
    showAutoGenSubmitBtn(true);
javascript_obj0208_002.js pdf-javascript-stream PDF /JS object 208 at offset 0xBFAD 1313 bytes
SHA-256: f94e41f586bf3f20bc1deeac4bfbda388a61db43f25fbd6304ba73f5653368cf
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.6)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 8.0)
         {
            if (app.alert(ADBE.Reader_string_Need_New_Version_Msg, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.6"});
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
		   else if (app.viewerVersion < 8.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
               app.launchURL(ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, true);
         }
         else if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.6"});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
javascript_obj0209_003.js pdf-javascript-stream PDF /JS object 209 at offset 0xC18F 902 bytes
SHA-256: 1b2ec98752b966f601d5223a750559cf13d562ac5e5c6d1fcc7217835b01f5fd
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 8.1)
{
   ADBE.Reader_Need_Version = 8.1;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Reader_Need_Version;
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 8.1)
{
   ADBE.Viewer_Need_Version = 8.1;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Viewer_Need_Version;
}
javascript_obj0210_004.js pdf-javascript-stream PDF /JS object 210 at offset 0xC2ED 2795 bytes
SHA-256: 826c5622c798d67e5281cca7e05933dddc90ccdcb0a6177c9f7d06f11bef8f7f
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
font_00_cff_off00000937.bin pdf-font-stream PDF embedded font (cff) at offset 0x937 3907 bytes
SHA-256: 87f6821ea7e5d41d56f8cc2a939bb40ac9487c6df45bf2376e6adbc768081f58
font_01_sfnt_off00012891.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12891 95975 bytes
SHA-256: c29e5b1537bee8c88b3ffca56c5f24a45ec8da374cf9d4c0b4a78d04fc230949
font_02_cff_off0002479f.bin pdf-font-stream PDF embedded font (cff) at offset 0x2479F 6013 bytes
SHA-256: 25316e6ef10fae455d1fcf7c92093ea2df713d3b40f605eecd85b19811c47a57
font_03_cff_off0002612a.bin pdf-font-stream PDF embedded font (cff) at offset 0x2612A 10178 bytes
SHA-256: e7ba48e2b8c5bace9783e2b6d2ca0e14b1f7e0d0461106328735597ec4e6e906
font_04_cff_off000288c2.bin pdf-font-stream PDF embedded font (cff) at offset 0x288C2 8997 bytes
SHA-256: ffa5ec5d4b5102547c14deba45374e016cb7342407dbd297fcafd421ec30b280

Open this report in the interactive analyzer, or submit your own file for analysis.