PDF static analysis report

Static analysis result for SHA-256 0f48b845c12f24b1…

SUSPICIOUS

PDF

306.3 KB First seen: 2026-05-07
MD5: 10b28ab4490ad8afd0fc5eb562e6e39d SHA-1: e34d7b9b55c1c483c74bbfdca1b17a0f7d01d6e2 SHA-256: 0f48b845c12f24b1cd9e2d71ee4811a1cf98040fd57fc63bc2efc77ef7a63841
48 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript

The PDF file contains embedded JavaScript streams, indicated by heuristic firings for PDF_JAVASCRIPT and PDF_JS. The ML classifier also flagged the PDF as malicious with a high probability. While the JavaScript code itself is minimal and appears to be related to form field formatting (AFNumber_Keystroke and AFNumber_Format), its presence within a PDF, combined with the ML detection, suggests a malicious intent, possibly to exploit a PDF viewer vulnerability or to serve as a dropper for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9713

Heuristics 3

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0041_000.js pdf-javascript-stream PDF /JS object 41 at offset 0x4C0E5 41 bytes
SHA-256: 617ef4da07d9bc9d4e06a2320fe0d4cbacd3d6c2cc82039cf4e79e7facf7545f
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 0, 0, 0, "", true);
javascript_obj0042_001.js pdf-javascript-stream PDF /JS object 42 at offset 0x4C137 38 bytes
SHA-256: ae95d6581723cae0c2c1e3044a60f6c91e032264799b53449cd6269e6993d7bc
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 0, 0, 0, "", true);

Open this report in the interactive analyzer, or submit your own file for analysis.