PDF static analysis report

Static analysis result for SHA-256 0ceefee58234661a…

CLEAN

PDF

452.8 KB Created: 2006-10-14 15:00:06 +02:00 Authoring application: PDFCreator Version 0.9.0 (via AFPL Ghostscript 8.53) First seen: 2019-04-18
MD5: c636ede090219d03d28e120095c57305 SHA-1: da1fb67c3b7fb3d30a2f73bf8a0bf0862cef1c48 SHA-256: 0ceefee58234661a0f1cc2a7e6460b72475dc261004ec0fc98035db5a0dce532
16 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4666

Heuristics 2

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0003_000.js pdf-javascript-stream PDF /JS object 3 at offset 0x1BA 55 bytes
SHA-256: 31891b256fb2c725efed8b2bbf38a5e15a3a35b583d76d8b3fb5ee6c8b85f769
Preview script
First 1,000 lines of the extracted script
this.print({bUI:true,bSilent:false,bShrinkToFit:true});
stream_011_off00015f08.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x15F08 46435 bytes
SHA-256: 9e5c883ee33e3843f32ef2a842e3c6cf8b38f9ded8409da2d07779bc32165bcf
stream_018_off00038c80.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x38C80 226919 bytes
SHA-256: 8328b27ff0629d780e86de93d1368326631c63c457bf91f4a4f526d9f18e75c3
stream_019_off00046b54.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x46B54 226098 bytes
SHA-256: 295a2e71d9fa7045dab40aa7f74065f2e023bcf9274b655517b31b5ced0c4f02
stream_025_off000634d1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x634D1 184899 bytes
SHA-256: a4e64fd33cb6c96e9dab19ff612b3633148177d437f51f74f0fdf98ad64d0fa8
font_00_sfnt_off0006d3f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6D3F3 12376 bytes
SHA-256: cc8684e5958385ee993f977935368549c913c89a465747c54403b653e2281fbf

Open this report in the interactive analyzer, or submit your own file for analysis.