PDF static analysis report

Static analysis result for SHA-256 13650ebe28b11a12…

CLEAN

PDF

100.6 KB First seen: 2026-05-08
MD5: 30ab369c80a2bf2b366f1930e21ac8e1 SHA-1: 84875c58ca8b516bf332f8ffeb0b02f6cb0a151b SHA-256: 13650ebe28b11a12e1326b123c991243a4b26592e81d390611ac8054e42a9743
14 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1553.004 Subvert Trust Controls: Mark-of-the-Web Bypass

The PDF was identified as suspicious due to the presence of an embedded file and encryption. The encryption prevents deeper static analysis of the document's content and streams, making it difficult to determine the exact payload or delivery method. The embedded file heuristic suggests this PDF is likely a container for another malicious artifact.

Machine Learning

  • Nyx PDF Classifier clean score 0.0660

Heuristics 4

  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Encrypted PDF (string and stream contents are opaque to static scan) info PDF_ENCRYPTED
    PDF declares /Encrypt — string objects and stream contents are encrypted with the standard security handler (RC4 or AES). On its own this is informational; legitimate encrypted documents include signed contracts, billing statements, and rights-managed material. Static heuristics cannot inspect encrypted payload bytes.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.cra-arc.gc.ca/formspubs/hlp/bt_fllbl-eng.html In PDF document text
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/2.8/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.8/In PDF document text
    • http://www.w3.org/1999/xhtmlIn PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://docs.sun.com/source/806-3568/ncg_goldberg.htmlIn PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/In PDF document text
    • http://ns.adobe.com/xfdf/In PDF document text
    • http://www.xfa.org/schema/xfa-form/2.8/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 23

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0016.bin pdf-embedded-file PDF EmbeddedFile object 16 at offset 0x19FF 162 bytes
SHA-256: 2e1e86cdf6c61bcc222ba01e28ee26d2d4ddccb999a4eb6a552cedbf5f1ec4b7
embedded_file_obj0017.bin pdf-embedded-file PDF EmbeddedFile object 17 at offset 0x1AEF 2266 bytes
SHA-256: ff411ed4d12034f074216fafef66acd3a88500c2e3bfe8ed8d242080d86c7716
embedded_file_obj0018.bin pdf-embedded-file PDF EmbeddedFile object 18 at offset 0x1EB4 216965 bytes
SHA-256: 83c8c1a6709561d05ac945c2b15e7d4cfcb898b51ee8e43e009da4138d72c6d1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
embedded_file_obj0019.bin pdf-embedded-file PDF EmbeddedFile object 19 at offset 0x9ADE 2840 bytes
SHA-256: ca6f5283968773ce17c8440aea43319d7dfa4b13f5f2b72d11a10d5b9197c0b2
embedded_file_obj0020.bin pdf-embedded-file PDF EmbeddedFile object 20 at offset 0x9E2E 2088 bytes
SHA-256: 63155c9affdb64245e8627a1bbf978bfd04d04806ebd4b2de9204ef7710959e1
embedded_file_obj0021.bin pdf-embedded-file PDF EmbeddedFile object 21 at offset 0xA164 85 bytes
SHA-256: af05f8185c725a70291567ae2112fa9a98b368528a7cc440552f0c0847d95121
embedded_file_obj0022.bin pdf-embedded-file PDF EmbeddedFile object 22 at offset 0xA212 96 bytes
SHA-256: 56e9c619e431eb2f95c62e8886d5698b5a8378e8f8ef3fa159227446b90ad51b
embedded_file_obj0023.bin pdf-embedded-file PDF EmbeddedFile object 23 at offset 0xA2D2 642 bytes
SHA-256: e374abf3843f6f35c4ff886e982e34f0b27f255cbb8d41394231d190a78d8e5b
javascript_obj0081_000.js pdf-javascript-stream PDF /JS object 81 at offset 0x10897 1169 bytes
SHA-256: 0ab3d232b2f2272b7039ee3e45d0be78ade06bb45327a799559ad4a592ef5a3d
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_string_Need_New_Version_Msg_Old = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_string_Need_New_Version_Msg = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may display, but may not work properly. Some form elements might not be visible at all. Click OK for more information on obtaining the latest version of Adobe Reader.";
ADBE.Viewer_string_Need_New_Version_Msg_Updater = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may display, but may not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
javascript_obj0082_001.js pdf-javascript-stream PDF /JS object 82 at offset 0x10AA9 902 bytes
SHA-256: e985b5df65c8c3cf732a9074b575fbc594c1c7f0bccc0994182ec7e5c0f7308a
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 9.0)
{
   ADBE.Reader_Need_Version = 9.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Reader_Need_Version;
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 9.0)
{
   ADBE.Viewer_Need_Version = 9.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Viewer_Need_Version;
}
javascript_obj0083_002.js pdf-javascript-stream PDF /JS object 83 at offset 0x10C00 1363 bytes
SHA-256: 529357503ec67b623d2a12816cdeea62bd639f2b4ff4e568b01c96cc3f5bfc6f
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.8)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 9.0)
         {
            if (app.alert(ADBE.Reader_string_Need_New_Version_Msg, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg_Updater, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.8"});
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_string_Need_New_Version_Msg_Old, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
		   else if (app.viewerVersion < 9.0)
         {
            if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg, 1, 1) == 1)
               app.launchURL(ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, true);
         }
         else if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg_Updater, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.8"});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
font_00_cff_off000172a8.bin pdf-font-stream PDF embedded font (cff) at offset 0x172A8 1062 bytes
SHA-256: f12f3f542d5eefd4411ec6408e2d013414a8ae1aa7a720a230442e7c43da5b1a
font_01_cff_off000176e2.bin pdf-font-stream PDF embedded font (cff) at offset 0x176E2 619 bytes
SHA-256: a7a2e1fc321300948839cbeed4635b2a8e5478b7a6bf3943819cc67e5ff75670
font_02_cff_off000196ee.bin pdf-font-stream PDF embedded font (cff) at offset 0x196EE 565 bytes
SHA-256: d7b5c274016c40049ea750b0d63c1cf8885ccf9d08b82b74ab8897c36d06386c
font_03_sfnt_off00019977.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19977 36434 bytes
SHA-256: 127e1ec3adde768ec84e81cfaaf2bc08496b20ea5fcd7dfe2588e0ca6e41fbcb
embedded_file_obj0001_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 1 at offset 0x58; filter decode failed 176 bytes
SHA-256: 85e48a47ab656875c6bc87cae0dfefda3b17e146808bba6a42a9c012b1bca9cb
embedded_file_obj0002_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 2 at offset 0x162; filter decode failed 896 bytes
SHA-256: 341e416a0ff18b174e6d5dce89d579d20b4d9f7ef0f510b2e00f5c575dfe4864
embedded_file_obj0003_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 3 at offset 0x53E; filter decode failed 48000 bytes
SHA-256: 6c4949d33fac78417a1094192d6d79350dade65df0f65e85b72417200d204b87
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 8.00, consistent with packed or encrypted content.
embedded_file_obj0004_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 4 at offset 0xC118; filter decode failed 784 bytes
SHA-256: ef28f0d5cd02f3071108a2316e23108b251899c5bf3ec5d5f015f8995c76a4da
embedded_file_obj0005_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 5 at offset 0xC482; filter decode failed 752 bytes
SHA-256: 8ac143d13481a102028b5e14554abd93edcc72944c286ee5d945f08d4e1dec86
embedded_file_obj0006_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 6 at offset 0xC7CC; filter decode failed 112 bytes
SHA-256: 85d70ec1db0bc326e03a9ef0ab53ab680c3e8758735834fc0b85e31b96d5b6cc
embedded_file_obj0007_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 7 at offset 0xC896; filter decode failed 128 bytes
SHA-256: 500b98742705d93f53ffd8e2bcca5734f83aef3dc960c7f265b9395b0265ea74
embedded_file_obj0008_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 8 at offset 0xC970; filter decode failed 240 bytes
SHA-256: 529abb6dde21b8bc6514f48514982d126056be073147db07fb5c21dbc31f0d9b

Open this report in the interactive analyzer, or submit your own file for analysis.