Malicious PDF — malware analysis report

Static analysis result for SHA-256 1036375cc71760ec…

MALICIOUS

PDF

202.5 KB Created: 2007-12-27 12:52:04 -08:00 Authoring application: Adobe LiveCycle Designer ES 8.2 First seen: 2026-05-08
MD5: 2aaf8f0765c3992a594dde54d10bc49b SHA-1: 07b20cd09f91e8a4026ee83a846f47895ac22ae7 SHA-256: 1036375cc71760ec51366726592c24917529847bbb9cdc19ec7e004c44c71ce8
210 Risk Score

🔏 Digital signature Modified after signing

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment T1041 Exfiltration Over C2 Channel

This PDF document contains JavaScript that utilizes the `app.execDialog`, `unescape`, and `submitForm` functions, indicating an attempt to collect user input. The script is designed to exfiltrate data, likely credentials, by submitting it to a remote server. The document body presents a fake employment application, reinforcing the credential harvesting motive. The PDF was also digitally signed but later modified, suggesting an attempt to bypass security checks.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5654

Heuristics 11

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
            var decodedFileName = unescape(doc.documentFileName);
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Active content added after the PDF was signed medium PDF_SIGNATURE_POST_SIGN_MODIFICATION
    An incremental update appended AFTER the signed byte range introduces active content (/EmbeddedFile). Some of this can occur in legitimate form-fill (field scripts, a rewritten /Catalog), so it is suspicious rather than damning — but it is content the signer did not approve.
  • SubmitForm action medium PDF_SUBMITFORM
    PDF has a /SubmitForm action — form data can be silently posted to an attacker-controlled URL (matched inside decoded stream)
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic (matched inside decoded stream)
  • Embedded script payload in PDF stream info PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.5/Referenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In extracted file (embedded_file_obj0088.bin)
    • http://www.xfa.org/schema/xci/1.0/In extracted file (embedded_file_obj0089.bin)
    • http://www.xfa.org/schema/xci/2.8/In extracted file (embedded_file_obj0089.bin)
    • http://www.xfa.org/schema/xfa-data/1.0/In extracted file (embedded_file_obj0091.bin)
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In extracted file (embedded_file_obj0092.bin)
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In extracted file (embedded_file_obj0092.bin)
    • http://ns.adobe.com/xtd/In extracted file (embedded_file_obj0093.bin)
    • http://ns.adobe.com/xfdf/In extracted file (embedded_file_obj0095.bin)
    • http://www.xfa.org/schema/xfa-form/2.8/In extracted file (embedded_file_obj0096.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 17

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0088.bin pdf-embedded-file PDF EmbeddedFile object 88 at offset 0x22426 85 bytes
SHA-256: c06dcd026a7ea0536b63e07ce688691b585339a3ab7ff59065e546b56308c7bb
embedded_file_obj0089.bin pdf-embedded-file PDF EmbeddedFile object 89 at offset 0x224D9 1518 bytes
SHA-256: 7a441cbf3872425cb4c7705b2f967e622253a43f16fa95d4d07675112695743d
embedded_file_obj0090.bin pdf-embedded-file PDF EmbeddedFile object 90 at offset 0x227B5 62580 bytes
SHA-256: 1b19b49a0a1b1f8a84e5822247a507b8d3e529f576f2c226f5ed2a8a3f577d43
embedded_file_obj0091.bin pdf-embedded-file PDF EmbeddedFile object 91 at offset 0x24671 4373 bytes
SHA-256: bedd959c13bda4171d6fec94e714894b4eb8f330d4332ddec77cee286cb02363
embedded_file_obj0092.bin pdf-embedded-file PDF EmbeddedFile object 92 at offset 0x24B9A 2928 bytes
SHA-256: 226eeacc5eecef2a05ca480f144ff6936594e20b5c7672e8f29f25c8bea65a56
embedded_file_obj0093.bin pdf-embedded-file PDF EmbeddedFile object 93 at offset 0x24F08 200 bytes
SHA-256: 4cb349134bdb5f1a1c03281df9b53128ebe947f235398a912a4f0a9f638b24d5
embedded_file_obj0094.bin pdf-embedded-file PDF EmbeddedFile object 94 at offset 0x24FFC 1223 bytes
SHA-256: aa33350d7d6e065ba712c99cce2ee688e22d8d6fdd9fcc4634ccd065c80cd69f
embedded_file_obj0095.bin pdf-embedded-file PDF EmbeddedFile object 95 at offset 0x25251 80 bytes
SHA-256: 2ebdd7efeaa1190ff6bad8cbd649b313e3969564018f204e7385b97c2fab1e19
embedded_file_obj0096.bin pdf-embedded-file PDF EmbeddedFile object 96 at offset 0x252FC 382 bytes
SHA-256: 88b3b648350d60d77f474fca72470a37937d62085749223ca2a4b882fc6eed4a
embedded_file_obj0544.bin pdf-embedded-file PDF EmbeddedFile object 544 at offset 0x3194F 411 bytes
SHA-256: 12849cb5b637a67bc92337b2cea0c11116eee65bc2e4d96bc7dea88dbfaca583
javascript_obj-001_000.js pdf-javascript-stream PDF /JS object -1 at offset 0x2E1B 11505 bytes
SHA-256: dd6e063204762394fe1e5984b5562281379b07e2b5cfa3242c04077d0cc7807c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
//@@FORMSWORKFLOW auto-generated script

/**************************************************************
AdobePatentID="B643"
**************************************************************/
var AdobePatentID = "AdobePatentID=\"B643\"";

// Show a dialog to ask the user's name and email during submit.
askUserIdentity = function(doc)
{
    // string constants
    var dlgStrings =
    {
        sDlgTitle:          "Send Form",
        sEmailLabel:        "&Email Address:",
        sNameLabel:         "Full &Name:",
        sSubmitLabel:       "&Send",
        sToLabel:           "To:",
        sSubjectLabel:      "Subject:",
        sSubjectContent:    "Submitting Completed Form",
        sAttachmentLabel:   "Attachment:",
        sFromLabel:         "From:",
        sErrorEmailRequired:"Please enter a valid email address.",
        sErrorNameRequired: "Please enter your name."
    };
    
    var dlgElems = [];
    dlgElems[dlgElems.length] = {
        type: "view",
        align_children: "align_left",
        elements:
        [
            {
                type: "view",
                align_children: "align_row",
                elements:
                [
                    {
                        type: "static_text",
                        name: dlgStrings.sToLabel,
                        width: 80,
                        bold: true,
                        font: "dialog"
                    },
                    {
                        type: "static_text",
                        item_id: "sdto",
                        width: 270,
                        font: "dialog"
                    }
                ]
            },
            {
                type: "view",
                align_children: "align_row",
                elements:
                [
                    {
                        type: "static_text",
                        name: dlgStrings.sSubjectLabel,
                        bold: true,
                        width: 80,
                        font: "dialog"
                    },
                    {
                        type: "static_text",
                        name: dlgStrings.sSubjectContent,
                        width: 270,
                        font: "dialog"
                    }
                ]
            },
            {
                type: "view",
                align_children: "align_row",
                elements:
                [
                    {
                        type: "static_text",
                        name: dlgStrings.sAttachmentLabel,
                        bold: true,
                        width: 80,
                        font: "dialog"
                    },
                    {
                        type: "static_text",
                        item_id: "atch",
                        width: 270,
                        font: "dialog"
                    }
                ]
            },
            {
                type: "gap",
                height: 5,
                width: 350
            },
            {
                type: "static_text",
                name: dlgStrings.sFromLabel,
                bold: true,
                font: "dialog"
            },
            {
                type: "static_text",
                name: dlgStrings.sEmailLabel,
                bold: true,
                font: "dialog"
            },
            {
                type: "edit_text",
                item_id: "emal",
                width: 250
            },
            {
                type: "static_text",
                name: dlgStrings.sNameLabel,
                bold: true,
                font: "dialog"
            },
            {
                type: "edit_text",
                item_id: "name",
                width: 250
            },
            {
                type: "gap",
                height: 5,
                width: 350
            },
            {
                type: "ok_cancel",
                ok_name: dlgStrings.sSubmitLabel
            }
        ]
    }
    
    var desc = {
        resourceContext: "AcroForm",
        description:  {
            name: dlgStrings.sDlgTitle,
            elements: [
                {
                    type: "view",
                    align_children: "align_left",
                    elements: dlgElems
                }
            ]
        }
    }

    desc.initialize = function(dialog)
    {
        var METADATA_ANNOT_NAME = "adhocFormState";
        var PROP_INITIATOR = "initiator";
        
        var initiator;
        var annot = doc.getAnnot(0, METADATA_ANNOT_NAME);
        if (annot != null) {
            var arrProps = new Array();
            arrProps = annot.contents.split(";");
            initiator = getProperty(arrProps, PROP_INITIATOR);
        }
        
        var decodedFileName = unescape(doc.documentFileName);
        var initVars =
        {
            sdto: initiator,
            atch: decodedFileName
        }
        dialog.load(initVars);
    }

    desc.validate = function(dialog)
    {
        var values = dialog.store();
        if (values.emal == "") {
            app.alert(dlgStrings.sErrorEmailRequired);
            return false;
        }
        if (values.name == "") {
            app.alert(dlgStrings.sErrorNameRequired);
            return false;
        }
        return true;
    };
        
    desc.commit = function(dialog)
    {
        this.result = new Object;
        var values = dialog.store();
        this.result.name = values.name;
        this.result.email = values.emal;
    };

    var ret = app.execDialog(desc);
    if (ret == "ok")
        return desc.result;
    else
        return null;
};

askEmailClient = function(doc)
{
// string constants
    var dlgStrings =
    {
        sDlgTitle:      "Select Email Client",
        sDlgText:       "Please indicate the option which best describes how you send mail.",
        sDesktop:       "&Desktop Email Application",
        sDesktopDesc:   "Choose this option if you currently use an email application such as Microsoft Outlook Express, Microsoft Outlook, Eudora, or Mail.",
        sInternet:      "&Internet Email",
        sInternetDesc:  "Choose this option if you currently use an Internet email service such as Yahoo or Microsoft Hotmail. You will then need to save your form and return it manually to jobs@bgprinting.net using your Internet email service."
    };
    
    var dlgElems = [];
    dlgElems[dlgElems.length] = {
        type: "view",
        align_children: "align_left",
        alignment: "align_fill",
        elements:
        [
            {
                type: "static_text",
                name: dlgStrings.sDlgText,
                width: 350,                
                font: "dialog"
            },
            {
                type: "radio",
                name: dlgStrings.sDesktop,
                item_id: "rad1",
                group_id: "rgrp",
                bold: true,
                font: "dialog"
            },
            {
                type: "view",
                align_children: "align_top",
                elements:
                [
                    {
                        type: "gap",
                        width: 20
                    },
                    {
                        type: "static_text",
                        name: dlgStrings.sDesktopDesc,
                        wrap_name: true,
                        width: 342,
                        font: "dialog"
                    }
                ]
            },            
            {
                type: "radio",
                name: dlgStrings.sInternet,
                item_id: "rad2",
                group_id: "rgrp",
                bold: true,
                font: "dialog"

            },
            {
                type: "view",
                align_children: "align_top",
                elements:
                [
                    {
                        type: "gap",
                        width: 20
                    },
                    {
                        type: "static_text",
                        name: dlgStrings.sInternetDesc,
                        wrap_name: true,
                        width: 342,
                        font: "dialog"
                    }
                ]
            },
            {
                type: "gap",
                height: 5,
                width: 350
            },
            {
                type: "ok_cancel",
            }
        ]
    }
    
    var desc = {
        resourceContext: "AcroForm",
        description:  {
            name: dlgStrings.sDlgTitle,
            width: 250,
            elements: [
                {
                    type: "view",
                    align_children: "align_left",
                    elements: dlgElems
                }
            ]
        }
    }
    
    desc.commit = function(dialog)
    {
        this.result = new Object;
        var values = dialog.store();
        this.result.send = values.rad1;
        this.result.save = values.rad2;
    };

    var ret = app.execDialog(desc);
    if (ret == "ok")
        return desc.result;
    else
        return null;            
};

/**************************************************************
AdobePatentID="B643"
**************************************************************/
// set a new property value to a property in the specified array.
setProperty = function(arrProps, propName, propValue)
{
    var i;
    var bSet = false;
    for (i = 0; i < arrProps.length; i++) {
        var propParts = new Array();
        propParts = arrProps[i].split(":");
        if (propParts[0] == propName) {
            propParts[1] = propValue;
            arrProps[i] = propParts.join(":");
            bSet = true;
            break;
        }
    }
    
    if (!bSet)
        arrProps[arrProps.length] = propName + ":" + propValue;
};

/**************************************************************
AdobePatentID="B643"
**************************************************************/
// get the value for a property in the specified array.
getProperty = function(arrProps, propName)
{
    var i;
    for (i = 0; i < arrProps.length; i++) {
        var propParts = new Array();
        propParts = arrProps[i].split(":");
        if (propParts[0] == propName) {
            return propParts[1];
        }
    }
    return null;
};

/**************************************************************
AdobePatentID="B643"
**************************************************************/
showAutoGenSubmitBtn = function(bShow)
{
    var autoGenSubmitName = "topmostSubform[0].ButtonField1[0]";
    var fld = this.getField(autoGenSubmitName);
    if (fld != null)
    {
        var b= this.dirty;
        if (bShow)
            fld.display = display.noPrint;
        else
            fld.display = display.hidden;
        this.dirty= b;
    }
};

// Hide the auto-generated submit button for Acrobat/Reader >= 9.0
if (app.viewerVersion >= 9)
    showAutoGenSubmitBtn(false);
else
    showAutoGenSubmitBtn(true);
stream_003_off0000377e.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x377E 1532 bytes
SHA-256: f574e4d51594d1a8fd22e125b109b827c437aa898edc78babb62dbb93f8744f8
stream_004_off0000396a.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x396A 870 bytes
SHA-256: 4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb
stream_105_off00026c19.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x26C19 999 bytes
SHA-256: 4a3be1c97fa660c78458adbf8467d9ef0ece4b4be6574ddb6a76861e566be29f
objstm_0311_00.bin pdf-objstm-decoded PDF /ObjStm 311 0 obj (inflated) 22721 bytes
SHA-256: ae3f7e8da0037725a5acbb781fdd0f8290baa651f5929c299703995441bd3f0d
objstm_0102_00.bin pdf-objstm-decoded PDF /ObjStm 102 0 obj (inflated) 171 bytes
SHA-256: 7bfff91f1cbcb99094706a67de0efab93065be7f4821bf03d6a4768a6044b191
objstm_0547_00.bin pdf-objstm-decoded PDF /ObjStm 547 0 obj (inflated) 4548 bytes
SHA-256: 8555523eea72d95d4e0e32296f6b2a6d1f06ff2a33c76c3e512b54c5dac0b268

Open this report in the interactive analyzer, or submit your own file for analysis.