Malicious PDF — malware analysis report

Static analysis result for SHA-256 09f0f49373ab8299…

MALICIOUS

PDF

775.5 KB Created: 2008-02-15 14:41:46 +01:00 Authoring application: AcroForm (via Adobe LiveCycle Designer ES 8.1) First seen: 2026-05-10
MD5: 76b502521b13d3df9e88e621099ad3fb SHA-1: dec8ea6736f6444a8628f66dcd851150f734a11f SHA-256: 09f0f49373ab82990095e321cc4037c44887f53295e93590e9bc0f8d008cc4d7
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript that triggers an alert box, prompting the user to update their PDF reader. If the user accepts, the script attempts to redirect them to 'http://cgi.adobe.com/special/acrobat/update' to download a malicious payload. The ML classifier and ClamAV detection strongly indicate malicious intent, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9443

Heuristics 9

  • ClamAV: Pdf.Exploit.Agent-20192 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-20192
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype In extracted file (stream_053_off0000b8f0.bin)
    • http://ocsp.verisign.com0In extracted file (font_03_sfnt_off00065197.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.4/Referenced by PDF JavaScript
    • http://www.w3.org/1999/xhtmlReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In extracted file (embedded_file_obj0304.bin)
    • http://www.xfa.org/schema/xci/1.0/In extracted file (embedded_file_obj0305.bin)
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In extracted file (embedded_file_obj0307.bin)
    • http://ns.adobe.com/xtd/In extracted file (embedded_file_obj0309.bin)
    • http://ns.adobe.com/xfdf/In extracted file (embedded_file_obj0311.bin)
    • http://www.xfa.org/schema/xfa-form/2.6/In extracted file (embedded_file_obj0312.bin)
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn extracted file (stream_053_off0000b8f0.bin)
    • https://www.verisign.com/rpaIn extracted file (stream_136_off00032685.bin)
    • http://ocsp.verisign.com/ocsp/status0In extracted file (stream_136_off00032685.bin)
    • https://www.verisign.com/rpa0In extracted file (stream_136_off00032685.bin)
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In extracted file (stream_136_off00032685.bin)
    • http://www.microsoft.com/typographyIn extracted file (stream_136_off00032685.bin)
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In extracted file (font_03_sfnt_off00065197.bin)
    • http://crl.verisign.com/tss-ca.crl0In extracted file (font_03_sfnt_off00065197.bin)
    • https://www.verisign.com/rpa01In extracted file (font_03_sfnt_off00065197.bin)
    • http://crl.verisign.com/pca3.crl0In extracted file (font_03_sfnt_off00065197.bin)
    • http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0DIn extracted file (font_03_sfnt_off00065197.bin)
    • http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0In extracted file (font_03_sfnt_off00065197.bin)
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlIn extracted file (font_03_sfnt_off00065197.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 17

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0304.bin pdf-embedded-file PDF EmbeddedFile object 304 at offset 0xA9789 86 bytes
SHA-256: f7ee3ef2f8f35d669a6c2b8b0b0ee89655bbc3d04b107a8d22531830f6fc28a1
embedded_file_obj0305.bin pdf-embedded-file PDF EmbeddedFile object 305 at offset 0xA983E 2013 bytes
SHA-256: 539bb0dc3d533dea4997a7dc59e3c33ef624313c40e1dd953ba223d43bd3562a
embedded_file_obj0306.bin pdf-embedded-file PDF EmbeddedFile object 306 at offset 0xA9BBD 1025950 bytes
SHA-256: c06222e209ce01b6bdc8cda23741aa5a2f6200cfb72e25ffc808d3b0c2a12942
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
embedded_file_obj0307.bin pdf-embedded-file PDF EmbeddedFile object 307 at offset 0xB804F 2415 bytes
SHA-256: bac3e4de866ac1448036bb843b9b97f7525c1e48b40f0b6335cf6bfcf93c9858
embedded_file_obj0308.bin pdf-embedded-file PDF EmbeddedFile object 308 at offset 0xB8341 2014 bytes
SHA-256: 454f05c5039ecbbf413e4412383dddc6944e0fb13ce7ce7fcb1515aef1d91819
embedded_file_obj0309.bin pdf-embedded-file PDF EmbeddedFile object 309 at offset 0xB852F 200 bytes
SHA-256: 500856001a9edb17a299f41c8b34871c12c85d56ec8eff03ef181fca24bb96b5
embedded_file_obj0310.bin pdf-embedded-file PDF EmbeddedFile object 310 at offset 0xB8625 1218 bytes
SHA-256: 56c83cc92abed3c964a609ef5c89c2f134f7a3d73de93e6af31d215141ad9110
embedded_file_obj0311.bin pdf-embedded-file PDF EmbeddedFile object 311 at offset 0xB8882 80 bytes
SHA-256: 2ebdd7efeaa1190ff6bad8cbd649b313e3969564018f204e7385b97c2fab1e19
embedded_file_obj0312.bin pdf-embedded-file PDF EmbeddedFile object 312 at offset 0xB892D 63 bytes
SHA-256: ad801486e3cb7389075fad83415aa12a315eba18ebcc5a81167104cfcb6fd70b
javascript_obj1082_000.js pdf-javascript-stream PDF /JS object 1082 at offset 0x1810 1532 bytes
SHA-256: f574e4d51594d1a8fd22e125b109b827c437aa898edc78babb62dbb93f8744f8
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.1)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 6.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_5x, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.viewerVersion < 7.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
               app.findComponent({cType:"App", cName:"Reader7", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
               app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
         else if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
javascript_obj1083_001.js pdf-javascript-stream PDF /JS object 1083 at offset 0x19FD 870 bytes
SHA-256: 4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 7.0)
{
   ADBE.Reader_Need_Version = 7.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 7.0)
{
   ADBE.Viewer_Need_Version = 7.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
javascript_obj1084_002.js pdf-javascript-stream PDF /JS object 1084 at offset 0x1B59 3792 bytes
SHA-256: 42532e6508d5c2db0ab8c8dfcd630c448464119f6e0ad9b9d96e038b45e726fc
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms - Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "Diese PDF-Datei erfordert einen h�here Version von Adobe Reader. Dr�cken Sie OK, um die neueste Version herunterzuladen, oder wenden Sie sich an Ihren Systemadministrator.";
ADBE.Viewer_Form_string_Reader_601 = "F�r dieses PDF-Formular ist eine neuere Version von Adobe Reader erforderlich. Selbst wenn das Formular ordnungsgem�� zu funktionieren scheint, funktionieren einige Elemente m�glicherweise nicht einwandfrei oder werden �berhaupt nicht angezeigt. Klicken Sie auf OK, um ein Online-Update zu initiieren, oder wenden Sie sich an den Systemadministrator.";
ADBE.Viewer_Form_string_Reader_Older = "F�r dieses PDF-Formular ist eine neuere Version von Adobe Reader erforderlich. Selbst wenn das Formular ordnungsgem�� zu funktionieren scheint, funktionieren einige Elemente m�glicherweise nicht einwandfrei oder werden �berhaupt nicht angezeigt. Klicken Sie auf OK, um Informationen �ber Online-Downloads abzurufen, oder wenden Sie sich an den Systemadministrator.";
ADBE.Viewer_Form_string_Viewer_601 = "F�r dieses PDF-Formular ist eine neuere Version von Adobe Acrobat erforderlich. Selbst wenn das Formular ordnungsgem�� zu funktionieren scheint, funktionieren einige Elemente m�glicherweise nicht einwandfrei oder werden �berhaupt nicht angezeigt. Klicken Sie auf OK, um ein Online-Update zu initiieren, oder wenden Sie sich an den Systemadministrator.";
ADBE.Viewer_Form_string_Viewer_60 = "F�r dieses PDF-Formular ist eine neuere Version von Adobe Acrobat erforderlich. Selbst wenn das Formular ordnungsgem�� zu funktionieren scheint, funktionieren einige Elemente m�glicherweise nicht einwandfrei oder werden �berhaupt nicht angezeigt. Weitere Informationen erhalten Sie, wenn Sie die folgende Internetadresse aufrufen (indem Sie die URL durch Dr�cken von STRG+C [Win] oder Befehlstaste+C [Mac] kopieren und in die Adressleiste Ihres Browsers einf�gen). Sie k�nnen sich auch an Ihren Systemadministrator wenden.";
ADBE.Viewer_Form_string_Viewer_Older = "F�r diese PDF-Datei ist eine neuere Version von Adobe Acrobat erforderlich. Kopieren Sie diese URL, und f�gen Sie sie in Ihren Browser ein, oder wenden Sie sich an den Systemadministrator.";
ADBE.Viewer_Form_string_Reader_5x = "Dieses PDF-Formular kann nur in einer neueren Adobe Reader-Version verwendet werden. In einer �lteren Version wird das Formular zwar angezeigt, doch es funktioniert m�glicherweise nicht einwandfrei. Einige Formularelemente werden u. U. �berhaupt nicht angezeigt. Wenn eine Internetverbindung zur Verf�gung steht, klicken Sie auf OK, um in Ihrem Browser eine Web-Seite zu �ffnen, auf der die aktuelle Version erh�ltlich ist.";
ADBE.Viewer_Form_string_Reader_6_7x = "Dieses PDF-Formular kann nur in einer neueren Adobe Reader-Version verwendet werden. In einer �lteren Version wird das Formular zwar angezeigt, doch es funktioniert m�glicherweise nicht einwandfrei. Einige Formularelemente werden u. U. �berhaupt nicht angezeigt. Wenn eine Internetverbindung zur Verf�gung steht, klicken Sie auf OK, um die aktuelle Version herunterzuladen und zu installieren";
ADBE.Viewer_Form_string_Viewer = "Dieses PDF-Formular kann nur in einer neueren Adobe Acrobat-Version verwendet werden. In einer �lteren Version wird das Formular zwar angezeigt, funktioniert jedoch m�glicherweise nicht einwandfrei. Einige Formularelemente werden u. U. �berhaupt nicht angezeigt. Wenn eine Internetverbindung zur Verf�gung steht, klicken Sie auf OK, um die aktuelle Version herunterzuladen und zu installieren.";
stream_053_off0000b8f0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xB8F0 78969 bytes
SHA-256: d471946590249e9daf7aa91da1ce61ccfee32eef6886a8aa6e15902698f3d6c9
stream_136_off00032685.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x32685 352198 bytes
SHA-256: 1e8564d3d89047875dccaa98279599de9d7ddf77240906041f1156ba8edf3315
stream_139_off00074d2c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x74D2C 367087 bytes
SHA-256: b8e2518b116c26bab0e9f8c1672daf405dedad561157502b657e9005be2029aa
font_01_sfnt_off000154f1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x154F1 70960 bytes
SHA-256: 3262fe1d3576673a82907aae700ee6d66733172020c0128aac8c7d9205d27e00
font_03_sfnt_off00065197.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x65197 94875 bytes
SHA-256: 058d11642e857508126df5662db2c7af4bdc1892e73eea6fc33f2605a1fc3c20

Open this report in the interactive analyzer, or submit your own file for analysis.