PDF static analysis report

Static analysis result for SHA-256 1b026f36ef14b325…

SUSPICIOUS

PDF

393.3 KB Created: 2008-10-20 13:05:10 +02:00 Authoring application: Acrobat PDFMaker 8.1 für Word (via Acrobat Distiller 8.1.0 (Windows)) First seen: 2026-05-10
MD5: 4cace11f29e2f2bef97a63ea5188477c SHA-1: 50bae0152cc2f2a0c218cf983aeab7d754dfb3f8 SHA-256: 1b026f36ef14b3256b15a408a2d16c324fb6b77dcb942752df0fb0e1f7dd273c
36 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file exhibits multiple indicators of malicious intent, including embedded JavaScript streams and an embedded DOC file. The presence of JavaScript actions and streams points towards the execution of arbitrary code. The embedded '23-Beihilfeantrag.doc' file is likely a lure or a component of a multi-stage attack. The exact functionality of the JavaScript is not fully discernible due to potential obfuscation, but its presence alongside an embedded document strongly suggests a malicious payload delivery mechanism.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4535

Heuristics 6

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 12

Files carved from inside the sample during analysis.

FilenameKindSourceSize
23-Beihilfeantrag.doc pdf-embedded-file PDF EmbeddedFile object 2503 at offset 0x491F7 308736 bytes
SHA-256: 440d0f0fdd650f76cc2975b5f360257e799cfa74a9e48cadfc12f1f6d2a640d6
javascript_obj0152_000.js pdf-javascript-stream PDF /JS object 152 at offset 0x1148A 39 bytes
SHA-256: cf3ef38cead83f4b1b39c7a061c8fef2c62d068861252a2b5ba7c0b959eec058
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "", false);
javascript_obj0259_001.js pdf-javascript-stream PDF /JS object 259 at offset 0x15542 42 bytes
SHA-256: a22e7a3e6dbfb6427839e3a2fdcab1be9d58bdd666536d5308358ec98c59feed
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "", false);
javascript_obj2400_002.js pdf-javascript-stream PDF /JS object 2400 at offset 0x4740E 42 bytes
SHA-256: 1829f93c988f1bfcd4bf6a74fc06fa5705171ae9bf3ac877b13813c6b492c742
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 2, 0, 0, "", false);
javascript_obj2401_003.js pdf-javascript-stream PDF /JS object 2401 at offset 0x47463 39 bytes
SHA-256: 3328eab8501405fcffcc95bb30fbb8bcb963b88928e4a40bd4be3a45d3e80107
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 2, 0, 0, "", false);
javascript_obj2470_004.js pdf-javascript-stream PDF /JS object 2470 at offset 0x483B6 47 bytes
SHA-256: 406d95469a0464b9b79f30b85f9caeec6578a9f06fef37b4ab65da9f58df18b3
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "\u20ac", true);
javascript_obj2471_005.js pdf-javascript-stream PDF /JS object 2471 at offset 0x48411 44 bytes
SHA-256: 37badb446af9695f0c0ef259bdfd390a13a3e306f952b3e69c47537b8d9a11e8
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "\u20ac", true);
javascript_obj2505_006.js pdf-javascript-stream PDF /JS object 2505 at offset 0x54492 1438 bytes
SHA-256: 96e70381bb9d3e5feaf19d1051707cd6fa9ad3a8ba3d5afb7a4544f8d10fc0bb
Preview script
First 1,000 lines of the extracted script
var v = app.viewerVersion;
if (v < 7)
{
	var n = 0;
	if (this.dataObjects != null)
		n = this.dataObjects.length;
	if (v >= 5 && v < 6 && n > 0 && (app.viewerVariation == "Full" || app.viewerVariation == "Fill-In"))
	{
		if (this.external)
			app.alert("Dieses Dokument hat Dateianlagen. Zum Anzeigen der Anlagen klicken Sie auf "Speichern", um eine Kopie des Dokuments zu speichern. �ffnen Sie die Kopie in Adobe Acrobat, und w�hlen Sie "Datei" > "Dokumenteigenschaften" > "Eingebettete Datenobjekte".", 3, 0);
		else
			app.alert("Dieses Dokument hat Dateianlagen. Zum Anzeigen der Anlagen w�hlen Sie "Datei" > "Dokumenteigenschaften" > "Eingebettete Datenobjekte".", 3, 0);
	}
	else if (v >= 6 && v < 7)
	{
		if (n == 0)
		{
			var np = this.numPages;
			syncAnnotScan();
			for (var p = 0; p < np && n == 0; ++p)
			{
				var annots = this.getAnnots(p);
				if (annots != null)
				{
					for (var i = 0; i < annots.length; ++i)
					{
						if (annots[i].type == "FileAttachment")
						{
							n = 1;
							break;
						}
					}
				}
			}
		}
		if (n > 0)
		{
			if (this.external)
				app.alert("Dieses Dokument hat  Dateianlagen. Zum Anzeigen der Anlagen klicken Sie oben in der vertikalen Bildlaufleiste des Dokumentfensters auf das schwarze Dreieck und w�hlen "Dateianlagen".", 3, 0);
			else
				app.alert("Dieses Dokument hat Dateianlagen. Zum Anzeigen der Anlagen w�hlen Sie "Dokument" > "Dateianlagen".", 3, 0);
		}
	}
}
javascript_obj2375_007.js pdf-javascript-stream PDF /JS object 2375 at offset 0x46BF7 371 bytes
SHA-256: 04b1e0e37b922672f6622e50a7c8fda74d95598d12596bceb9cfc9216364bd31
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("Text152.0", "Text152.1", "Text152.10", "Text152.11", "Text152.12", "Text152.13", "Text152.14", "Text152.15", "Text152.16", "Text152.17", "Text152.18", "Text152.19", "Text152.2", "Text152.3", "Text152.4", "Text152.5", "Text152.6", "Text152.7", "Text152.8", "Text152.9", "Text158", "Text158.0", "Text158.1", "Text158.2", "Text158.3"));
javascript_obj2379_008.js pdf-javascript-stream PDF /JS object 2379 at offset 0x46CF0 371 bytes
SHA-256: bc27f504e3c24164c502f67286ebc0cd90b334b36157f0c53e0a94436c18d14b
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("Text150.0", "Text150.1", "Text150.10", "Text150.11", "Text150.12", "Text150.13", "Text150.14", "Text150.15", "Text150.16", "Text150.17", "Text150.18", "Text150.19", "Text150.2", "Text150.3", "Text150.4", "Text150.5", "Text150.6", "Text150.7", "Text150.8", "Text150.9", "Text156", "Text156.0", "Text156.1", "Text156.2", "Text156.3"));
icc_00_off00043db8.icc pdf-icc-profile PDF ICC profile at offset 0x43DB8 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_sfnt_off00007819.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7819 6508 bytes
SHA-256: 872fc8e11d02b38d239368ec36621a4a65686828f141301617eee05296c01266

Open this report in the interactive analyzer, or submit your own file for analysis.