Malicious PDF — malware analysis report

Static analysis result for SHA-256 13e1bec505d82a58…

MALICIOUS

PDF

163.9 KB Created: 2009-01-29 23:55:37 UTC Authoring application: PScript5.dll Version 5.2 (via FDFMerge 5.0.4 Linux 7 SPDF_1096+ May 3 2004) First seen: 2026-05-11
MD5: b5bf224590e07df4aa3fbab27f44ef33 SHA-1: 0c2e56dab21dab7297846ce5896e7f652acb0196 SHA-256: 13e1bec505d82a58030bb97f154a7291a26762d7e2dd6fc22a580aea65ce3d21
198 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript that utilizes String.fromCharCode and eval(), indicating an attempt to obfuscate malicious code. The 'PDF_JS_EXPLOIT_CLUSTER' and 'PDF_EVAL' heuristics strongly suggest an exploit targeting PDF viewers. The ClamAV detection of 'Pdf.Exploit.Agent-21117' further confirms its malicious nature. The script's behavior is consistent with downloading and executing a second-stage payload, although the exact URL is not directly extractable from the provided evidence.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4271

Heuristics 8

  • ClamAV: Pdf.Exploit.Agent-21117 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-21117
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
        {
  strTemp1 = String.fromCharCode(eval(i))
       Code128bCharSeta += strTemp1;
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 1 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype In extracted file (stream_001_off000006f0.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn extracted file (stream_001_off000006f0.bin)
    • http://www.iec.chIn extracted file (icc_00_off0000f9c9.icc)
    • https://www.verisign.com/repository/CPS��In extracted file (font_01_sfnt_off00010430.bin)
    • https://www.verisign.comIn extracted file (font_01_sfnt_off00010430.bin)
    • https://www.verisign.com/repository/verisignlogo.gif0��In extracted file (font_01_sfnt_off00010430.bin)
    • https://www.verisign.com/CPS0bIn extracted file (font_01_sfnt_off00010430.bin)
    • http://www.microsoft.com/truetype/0In extracted file (font_01_sfnt_off00010430.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0001_000.js pdf-javascript-stream PDF /JS object 1 at offset 0xF 4987 bytes
SHA-256: ad6f764151cf536a95cfa42d4ac0d4d1f9e7b9516f4acb345bf5e1e699b299c4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 10 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
// 12005.pdf
// Based on 828888H.pdf
// fix leading zero problem
// Sept 9, 2004
// extract visit date from PA4
// Set FormId to valueAsString 
// Sept 17, 2004
var PV = this.getField("Patient.VisitNo");
var PA6 = this.getField("Patient.addressograph6");
var PA1 = this.getField("Patient.addressograph1");
var PA2 = this.getField("Patient.addressograph2");
var PA3 = this.getField("Patient.addressograph3");

var PA4 = this.getField("Patient.addressograph4");

//var FormID = this.getField("Forms.FormID").value;

var FormID = this.getField("Forms.FormID").valueAsString;
// var PN1 = this.getField("Patient.name1");
var PfMRN = this.getField("Patient.facilityMRN");
// var PAge1 = this.getField("Patient.age");
var Pmrn = this.getField("Patient.mrn");
var PmrnBarcode = this.getField("Patient.mrnBarcode");
var PVisitNo = "";

// var BarcodeInput = this.getField("Barcode.Input");

// var PmrnBarcode1 = this.getField("Patient.mrnBarcode1");
if (PA6.value !="")
{
   //console.println(util.printd(2, d));
   var PVEnd = PA6.value.length;
   PV.value=PA6.value.substring(16,24);
   // PVisitNo = PA6.value.substring(11,4);
   // console.println ("Visit No : " + PVisitNo);

}

if (PA1.value !="")
{   
console.println ("PA1 [0:2] = " + PA1.valueAsString.substring(0,2) );

  if (PA1.valueAsString.substring(0,2) == "03") {
  var PA6String = PA6.valueAsString;
  var EnDate = "";
  var LocCode = "";
// console.println ("Out Patient detected");
// substring(ending_char + 1,starting_char)
PVisitNo = PA6String.substring(15,11);
console.println ("PA6String : " + PA6String);
  console.println ("Visit No : " + PVisitNo);
//  EnDate = PA6String.substring(33,21);
// substring(ending_char + 1,starting_char)
EnDate = PA4.value.substring(8,0);
// console.println ("EnDate : " + EnDate);
  LocCode = PA4.value.substring(14,9);
  }
   // PfMRN.value=PA1.value.substring(4,14);
}

// if (PA2.value !="")
// {   
//   PN1.value=PA2.value;
// }

// if (PA3.value !="")
// {   
//   PAge1.value=PA3.value.substring(1,5);
// }

if (Pmrn.value !="")
{   
var BarcodeInputStr ="";
BarcodeInputStr = PA1.value.substring(4,5) + "|" + Pmrn.valueAsString + "|" + PVisitNo  + "|" + EnDate + "|" + LocCode + "|" + FormID; PmrnBarcode.value=gen_Code128B(BarcodeInputStr);
}



//working code 
function Code128bCharSet() 
{
    var i;
    var Code128bCharSeta = "";
    var strTemp1;
    for (i = 32; i <= 127; i++)
    {
		strTemp1 = String.fromCharCode(eval(i))
       Code128bCharSeta += strTemp1;
    }
    for (i = 193; i <= 199; i++)
    {
		strTemp1 = String.fromCharCode(eval(i))
       Code128bCharSeta += strTemp1;
    }    
	return Code128bCharSeta;
}





function gen_Code128B(BarcodeInput) {
 
var mappingSet=String.fromCharCode(204);
var strtmp="";
var bCharSet = Code128bCharSet();
console.println ("bCharSet = " + bCharSet);
for (var i= 33; i <=126; i++){ 
mappingSet = mappingSet + String.fromCharCode(i);
}

for (var i = 192;  i <=202; i++) {
mappingSet = mappingSet + String.fromCharCode(i);
}
console.println ("mappingSet = " + mappingSet);

console.println ("mappingSet length = " + mappingSet.length);
if (BarcodeInput !="")
{   
     strtmp = BarcodeInput;
 // fix leading 0 problem 
 // strtmp = "" + Pmrn.valueAsString;
console.println("Orginal String = " + BarcodeInput + " strtmp = " + strtmp );

console.println("length of strtmp = " + strtmp.length);

console.println("BarcodeInput.length = " + BarcodeInput.length);

var Code128b ="";
var checkSum = 104;
var charToEncode = "";


Code128b = strtmp;

//for ( var i=0; i<= 7; i=i+2) {
//charToEncode = strtmp.substring(i,i+2);
// console.println ("charToEncode  = " + charToEncode );
//j=charToEncode;
//console.println(" j = " + j);
//ss1 = mappingSet.substring(j - 1);  // get all the string starting at position j. 
//ss2 = ss1.substring(0,1);           // then get string at j only.

//Code128c= Code128c + ss2;

// console.println(" Extract code = " + Code128c);
}
// need convert to string
Code128b = "" + Code128b;
//calc check digit
charToEncode="";
console.println ("Code128b = " + Code128b);
console.println ("Code128b length =" + Code128b.length);
var charval;
var charPos = 0;

for ( var i=0; i< Code128b.length; i++) {
console.println ("Code128b = at " + i + " is " + Code128b);
// charToEncode = Code128b.substring( i, 1);
charToEncode=Code128b.charAt(i);

//charToEncode = Code128b.charAt(i);
console.println ("charToEncode = " + charToEncode);
charval = charToEncode.charCodeAt(0);
charPos = bCharSet.indexOf(charToEncode);
console.println ("charPos = " + charPos);
if (charPos > 0) {
//   checkSum = checkSum + (i+1)*(charPos - 1)
     checkSum += (i+1) * charPos;
}
console.println ("checkSum = " + checkSum);


}

// console.println checksum ;
checkSum = checkSum % 103;
console.println ("checkSum % 103 = " + checkSum );
checkDigit = mappingSet.charAt(checkSum);

var OutCode;
OutCode= String.fromCharCode(201) + Code128b + checkDigit + String.fromCharCode(203) + String.fromCharCode(205);

return OutCode;
}
stream_001_off000006f0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6F0 107773 bytes
SHA-256: f8b5634482dabaf0040161953b708d7648a1dc1459beb6e63bf997bafb4818f7
stream_005_off000120e7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x120E7 45320 bytes
SHA-256: 776c4818f6e73bbad0b9afa4f6699bed703829663ed6c6f0de08e2c981ae499a
icc_00_off0000f9c9.icc pdf-icc-profile PDF ICC profile at offset 0xF9C9 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_01_sfnt_off00010430.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10430 10232 bytes
SHA-256: 2fe0cdee7ff7fa3def9d1e52a85b5841f0793e1f34365bb95bea558d4affa8bb
font_03_sfnt_off00018498.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18498 36068 bytes
SHA-256: 63b26114b83cc1fe477a7211ef2809ec8989a929b736d22a94ce8405aee1b121
font_04_sfnt_off0001fa54.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1FA54 27605 bytes
SHA-256: 659bf0b8035208f1758f1b892614dbfb0b5b7baad6052234297b54474b1d2dba

Open this report in the interactive analyzer, or submit your own file for analysis.