Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a0eda312b8ad81c…

MALICIOUS

PDF

1.67 MB Created: â¬P—‘ùÈ0²RSpþ] Authoring application: ‡·ì ÒʨŽ Aê—"ªcoí|¥, (via €»ìÅǽÜPrÅ1Þ1ªu=¬1þm* ;ßÇH»K&ò]I¢¥) First seen: 2026-05-11
MD5: cd7fb762b1cda6e3e4d0ff012c1a9fa6 SHA-1: 53c9de80ce784d46a78834b7a9be994cbc4fa0d1 SHA-256: 1a0eda312b8ad81c148ded939b3a1dabc4896595776ba5e7bbbe837608957e31
114 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

The PDF file is heavily obfuscated, indicated by a high stream count and encryption with JavaScript. Embedded JavaScript streams were extracted, suggesting the document's primary purpose is to execute malicious code. This code likely downloads and executes a second-stage payload, a common technique for delivering malware. The presence of AcroForm buttons with action triggers further supports the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9402

Heuristics 5

  • Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj1365_000.js pdf-javascript-stream PDF /JS object 1365 at offset 0x594E2 50 bytes
SHA-256: 5ac70b84459938ded62664aad54e1ff40650f175699fa2931b15b124edc42b21
Preview script
First 1,000 lines of the extracted script
action_zeitraum_format_field(event.targetName);
javascript_obj1366_001.js pdf-javascript-stream PDF /JS object 1366 at offset 0x59547 47 bytes
SHA-256: 70d25d86fb9f8f3cf3ac42bd21fa0c978fe71f026066c74a24bea9ea5c4bef25
Preview script
First 1,000 lines of the extracted script
action_zeitraum2_aktualisieren(event, "01");
javascript_obj1368_003.js pdf-javascript-stream PDF /JS object 1368 at offset 0x595F7 33 bytes
SHA-256: c4287c5c3e37d48b98ace11b04930d19e8be4d405af6749d7e51f8d70a59029e
Preview script
First 1,000 lines of the extracted script
AFDate_KeystrokeEx("dd.mm.yyyy");
javascript_obj1369_004.js pdf-javascript-stream PDF /JS object 1369 at offset 0x59648 163 bytes
SHA-256: 413ed68bc802087dda08103e9e4285a7f971e944501d18ddc34d92fa31791ab9
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 120, event.value); } catch(the_error) {}
javascript_obj1376_005.js pdf-javascript-stream PDF /JS object 1376 at offset 0x5C93A 163 bytes
SHA-256: b169d9628490b704f6f288d62c4d8f29bbb0d6e502370cc288515cc7ae8a7e30
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 121, event.value); } catch(the_error) {}
javascript_obj1378_006.js pdf-javascript-stream PDF /JS object 1378 at offset 0x5CABD 52 bytes
SHA-256: 0a5ba4946d5ed46b8db34333c45fd219fcf2d70ef9cc1bc106fb3fc3da2f941a
Preview script
First 1,000 lines of the extracted script
//action_zeitraum_format_field(event.targetName);
javascript_obj1379_007.js pdf-javascript-stream PDF /JS object 1379 at offset 0x5CB24 84 bytes
SHA-256: 9e63ea216fd884a8bfad76d793c38e4c7b944f3301700182adeda43e8f1f779e
Preview script
First 1,000 lines of the extracted script
//action_zeitraum2_aktualisieren(event, "01");

wert_kopieren("48011", "948011");
javascript_obj1380_008.js pdf-javascript-stream PDF /JS object 1380 at offset 0x5CBAF 163 bytes
SHA-256: d0c68ebd1103bce01f936456b0c662a19990d0b4d2dd68032e5a63b27515e1e8
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 488, event.value); } catch(the_error) {}
javascript_obj1383_009.js pdf-javascript-stream PDF /JS object 1383 at offset 0x6C55A 82 bytes
SHA-256: df9932821546cd706b63578db1dec51a5dfe57f05901183838b3f09ba708cad8
Preview script
First 1,000 lines of the extracted script
//action_zeitraum2_aktualisieren(event, "01");

wert_kopieren("48012", "948012");
javascript_obj1384_010.js pdf-javascript-stream PDF /JS object 1384 at offset 0x6C5E1 163 bytes
SHA-256: 3cdddfe420196d505f01b6b8faab3bf273d89380b81d7c4371f33c4034cb2ae8
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 489, event.value); } catch(the_error) {}
javascript_obj1386_011.js pdf-javascript-stream PDF /JS object 1386 at offset 0x6C71B 47 bytes
SHA-256: 13d8445ce4cdbd2643fa46fefb956685fcc132bd74b1e092c2e2b8a5ce631ae6
Preview script
First 1,000 lines of the extracted script
action_zeitraum2_aktualisieren(event, "02");
javascript_obj1387_012.js pdf-javascript-stream PDF /JS object 1387 at offset 0x6C77D 163 bytes
SHA-256: 56d59988902233c73786731fea7a74440e899dab76ee0d77e2d4557f1ba00e0b
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 122, event.value); } catch(the_error) {}
javascript_obj1391_013.js pdf-javascript-stream PDF /JS object 1391 at offset 0x6C9C7 163 bytes
SHA-256: 5d8e20f2c8a48e2100bf386d4574964f3ead560f66ec4030d61c30971867c61d
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 123, event.value); } catch(the_error) {}
javascript_obj1394_014.js pdf-javascript-stream PDF /JS object 1394 at offset 0x6CBB1 82 bytes
SHA-256: e583a6582922f246dc852e6c736ea081f36784e6ac2cadb40da94e6afa27daf7
Preview script
First 1,000 lines of the extracted script
//action_zeitraum2_aktualisieren(event, "02");

wert_kopieren("48021", "948021");
javascript_obj1395_015.js pdf-javascript-stream PDF /JS object 1395 at offset 0x6CC38 163 bytes
SHA-256: 9fd79543a8679233206b6c2262a67ada9fdf0e46acf3423302f4cd3e07a25762
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 490, event.value); } catch(the_error) {}
javascript_obj1397_016.js pdf-javascript-stream PDF /JS object 1397 at offset 0x6CD74 82 bytes
SHA-256: 2655eeeeaf1a569e149973597d4bb191ecd5be4e79c4144be1af2ee412174e24
Preview script
First 1,000 lines of the extracted script
//action_zeitraum2_aktualisieren(event, "02");

wert_kopieren("48022", "948022");
javascript_obj1398_017.js pdf-javascript-stream PDF /JS object 1398 at offset 0x6CDFB 163 bytes
SHA-256: d92ef9030d592e5a0ec67f96b29f7c4e632a8cb2a0ebeb080cde2ddcfd2f934c
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 491, event.value); } catch(the_error) {}
javascript_obj1400_018.js pdf-javascript-stream PDF /JS object 1400 at offset 0x6CF35 47 bytes
SHA-256: 6e1bbf5c8e4a2840b42feb0dfea373814e6a2183161cdf72179896fd05a15b53
Preview script
First 1,000 lines of the extracted script
action_zeitraum2_aktualisieren(event, "03");
javascript_obj1401_019.js pdf-javascript-stream PDF /JS object 1401 at offset 0x6CF97 163 bytes
SHA-256: cd75fe68421c1323d4c8b3b4e6628816de7e1951e34a9ba67452687897f9e986
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 124, event.value); } catch(the_error) {}
javascript_obj1405_020.js pdf-javascript-stream PDF /JS object 1405 at offset 0x6D1E1 163 bytes
SHA-256: fab3fb89e3a0cab19ca7416e3c5fd9330a6eeed76c606fe664bd8b79fbe65c2f
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 125, event.value); } catch(the_error) {}
javascript_obj1408_021.js pdf-javascript-stream PDF /JS object 1408 at offset 0x6D3CB 82 bytes
SHA-256: ff391f63b06987fbc57f3d2305b67389f268820df6930eec6126fd8242f95639
Preview script
First 1,000 lines of the extracted script
//action_zeitraum2_aktualisieren(event, "03");

wert_kopieren("48031", "948031");
javascript_obj1409_022.js pdf-javascript-stream PDF /JS object 1409 at offset 0x6D452 163 bytes
SHA-256: 3408435c744578d7ebaa52abdcaf177902e23dab281e97206dcda6b1e877e96b
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 492, event.value); } catch(the_error) {}
javascript_obj1411_023.js pdf-javascript-stream PDF /JS object 1411 at offset 0x6D58E 83 bytes
SHA-256: a082277b00766b3599762d9631f4445859025ed6323d52dcb4375597b9597f13
Preview script
First 1,000 lines of the extracted script
//action_zeitraum2_aktualisieren(event, "03");

wert_kopieren("48032", "948032");
javascript_obj1412_024.js pdf-javascript-stream PDF /JS object 1412 at offset 0x6D617 163 bytes
SHA-256: 5c77fbe210ff8f89a0380fed67b27843a71c08dcd359946468826f10a2f2ec03
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 493, event.value); } catch(the_error) {}
javascript_obj1414_025.js pdf-javascript-stream PDF /JS object 1414 at offset 0x6D751 47 bytes
SHA-256: 48b4540b0e8cdc1f0415f589d5b4c9b4a54f949fc6ef0eb2d478a27ccb4063a2
Preview script
First 1,000 lines of the extracted script
action_zeitraum2_aktualisieren(event, "04");
javascript_obj1415_026.js pdf-javascript-stream PDF /JS object 1415 at offset 0x6D7B3 163 bytes
SHA-256: 8a7badefc0f61897741da1a1b4bc1cf78d5a656a992e7e791751be41d2bc16ce
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 126, event.value); } catch(the_error) {}
javascript_obj1418_027.js pdf-javascript-stream PDF /JS object 1418 at offset 0x6D94F 163 bytes
SHA-256: 7afd4b66e1216f780aefab776c0e1552d48d7d4905afa736dacc726dafa6c2e1
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 127, event.value); } catch(the_error) {}
javascript_obj1420_028.js pdf-javascript-stream PDF /JS object 1420 at offset 0x6DA8B 83 bytes
SHA-256: d39f1fdd58b1ed77aa6c905c4a30b3fbd945403d80dcf9c28888ebca613bc22d
Preview script
First 1,000 lines of the extracted script
//action_zeitraum2_aktualisieren(event, "04");

wert_kopieren("48041", "948041");
javascript_obj1421_029.js pdf-javascript-stream PDF /JS object 1421 at offset 0x6DB14 163 bytes
SHA-256: 0af0e24924def36d101dd9693b3b049edca75c60034b8fb0bc813295c3b5d693
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 494, event.value); } catch(the_error) {}
javascript_obj1423_030.js pdf-javascript-stream PDF /JS object 1423 at offset 0x6DC50 83 bytes
SHA-256: 4f759cb019a8f9a0d790a11fa90c39760198fac996857a21eea16150dec79e49
Preview script
First 1,000 lines of the extracted script
//action_zeitraum2_aktualisieren(event, "04");

wert_kopieren("48042", "948042");
javascript_obj1424_031.js pdf-javascript-stream PDF /JS object 1424 at offset 0x6DCD9 163 bytes
SHA-256: bbe4af4216d328579c70f1324b2b19da8919998c140a425144d643c280a17b1a
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 495, event.value); } catch(the_error) {}
javascript_obj1426_032.js pdf-javascript-stream PDF /JS object 1426 at offset 0x6DE13 47 bytes
SHA-256: a92fe5542e24252ad3ce58b248264b254bdc7ee2c7cfb979c697520f573dbfc0
Preview script
First 1,000 lines of the extracted script
action_zeitraum2_aktualisieren(event, "05");

Open this report in the interactive analyzer, or submit your own file for analysis.