PDF static analysis report

Static analysis result for SHA-256 0a8e3c8fe087c494…

SUSPICIOUS

PDF

265.4 KB Created: 2006-05-31 18:09:15 -04:00 Authoring application: PScript5.dll Version 5.2 (via Acrobat Distiller 6.0.1 (Windows)) First seen: 2026-05-09
MD5: a121bfbbbc353c0962a09d361652cd69 SHA-1: c912bd93f98630c0818f16f67c22645d44c27a51 SHA-256: 0a8e3c8fe087c494e6839cc52a41f50e1109f9e985aa5c7f7ee135c03a1acc83
26 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript that appears to be part of a pricing scam. The scripts calculate and display various price tiers based on user counts, such as 'total price 1 to 4 users' and 'total price 250 users'. While the URLs extracted are benign, the presence of JavaScript and form elements designed to manipulate pricing information strongly suggests a social engineering attempt, likely a phishing or scam lure delivered as an attachment.

Machine Learning

  • Nyx PDF Classifier clean score 0.0719

Heuristics 4

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 16

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0148_000.js pdf-javascript-stream PDF /JS object 148 at offset 0x1D77B 69 bytes
SHA-256: cf18ac961aa51bf27dca4a3cce384938af5fcc328508434828e18e3f42c1b4b4
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("$29.95", "xs # of users 1-4"));
javascript_obj0149_001.js pdf-javascript-stream PDF /JS object 149 at offset 0x1D7EB 42 bytes
SHA-256: bf6e5cec6b360b670b6bd2c73336d76c35e5f2336d421386785389d70cf8237a
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 0, 0, 0, "", false);
javascript_obj0150_002.js pdf-javascript-stream PDF /JS object 150 at offset 0x1D83E 39 bytes
SHA-256: a38c01daa8a2de78b2151ee01d1c69e81170452d881008dd1b45953b3c94a808
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 0, 0, 0, "", false);
javascript_obj0157_003.js pdf-javascript-stream PDF /JS object 157 at offset 0x1DA77 42 bytes
SHA-256: d7feabbe96d6239a4e68846c17660c84111cd34df235720909593806041f8a24
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 1, 0, 0, "", false);
javascript_obj0158_004.js pdf-javascript-stream PDF /JS object 158 at offset 0x1DACA 39 bytes
SHA-256: 6b7cde5083353dc94a728e784406248df1e3c34b8a1b86c325dca7d6822fc92b
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 1, 0, 0, "", false);
javascript_obj0165_007.js pdf-javascript-stream PDF /JS object 165 at offset 0x1DCE7 47 bytes
SHA-256: 52071427b82ab987bf3c3cc49290490c66d15eb5d6d0b1c6d352b90a8dd6d98c
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 0, 0, 0, "\u0024", true);
javascript_obj0166_008.js pdf-javascript-stream PDF /JS object 166 at offset 0x1DD40 44 bytes
SHA-256: 86548049d82be4d96b83581cc76ce7a2115efe2f5a25ba97b2ed9b7011876514
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 0, 0, 0, "\u0024", true);
javascript_obj0181_009.js pdf-javascript-stream PDF /JS object 181 at offset 0x1E253 68 bytes
SHA-256: a7c8abfc06e76a86dd7f713c005f9edc75ebef8a54cfc15c6cfe223eed38ed5a
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("$7.20", "xs # of users 250"));
javascript_obj0184_010.js pdf-javascript-stream PDF /JS object 184 at offset 0x1E371 73 bytes
SHA-256: ecb085f8abcd3f42e56efe6ad696cd9fbb2917e01311f95ee6200ad368ac54e5
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("$11.99", "xs # of users 100-249"));
javascript_obj0187_011.js pdf-javascript-stream PDF /JS object 187 at offset 0x1E494 71 bytes
SHA-256: 8453f936c44a66819d4861fe417d50064b33156bd1ec99e607e356032d0c9ae4
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("$17.99", "xs # of users 50-99"));
javascript_obj0190_012.js pdf-javascript-stream PDF /JS object 190 at offset 0x1E5B5 71 bytes
SHA-256: 487a7d169a776261903b57f9ea32ebac9c31f3bd55c9d666e99c48fc56ff72f4
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("$21.99", "xs # of users 25-49"));
javascript_obj0193_013.js pdf-javascript-stream PDF /JS object 193 at offset 0x1E6D6 70 bytes
SHA-256: ced523d0c2d9b4a1a8c5846100ff3841bcd90f7db0c290a24c5cbf442544b4df
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("$23.99", "xs # of users 5-24"));
javascript_obj0198_014.js pdf-javascript-stream PDF /JS object 198 at offset 0x1E8A5 212 bytes
SHA-256: e2c50261dcfde3b007c30297bb3bf8e1c568f220ccd300af7cbfdb81b39b0b9f
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("total price 1 to 4 users", "total price 100 to 249 users", "total price 25 to 49 users", "total price 250 users", "total price 5 to 24 users", "total price 50 to 99 users"));
icc_00_off0001e9f0.icc pdf-icc-profile PDF ICC profile at offset 0x1E9F0 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_sfnt_off00003704.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3704 108040 bytes
SHA-256: 3e36af02886057475f0536613460935eef6d2a068eb07e17fa26e60249b2cfb8
font_01_sfnt_off0002d277.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D277 129499 bytes
SHA-256: 514e370c5a0ccf1eb9b5e04437235c9b1f91e0542a31727709a1cc202ba957b6

Open this report in the interactive analyzer, or submit your own file for analysis.