PDF static analysis report

Static analysis result for SHA-256 1b1d0346428a0d1d…

SUSPICIOUS

PDF

390.6 KB Created: 2006-10-03 11:59:30 -04:00 Authoring application: Acrobat PDFMaker 6.0 for Excel (via Acrobat Distiller 6.0 (Windows)) First seen: 2015-04-15
MD5: 6922390c2d5278b86b5093f8113f4661 SHA-1: 663b87baccbf4962ed2b0b990bb0fd2f222ca795 SHA-256: 1b1d0346428a0d1d8c7cfe3cad7efe3617933f332704e93dafc1a30afc3360a0
48 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.8036

Heuristics 3

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0009_000.js pdf-javascript-stream PDF /JS object 9 at offset 0x2A63 39 bytes
SHA-256: 1d03a107e45160304b614e4ae31a0dc575017e5d6e59414bb8916127c3277507
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 0, 0, 0, "", false);
javascript_obj0010_001.js pdf-javascript-stream PDF /JS object 10 at offset 0x2ABB 42 bytes
SHA-256: edc81df06236f4f7f78ad6c2ad7367f010516682b9b95cf24321c54c44a61f34
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 0, 0, 0, "", false);
javascript_obj0040_002.js pdf-javascript-stream PDF /JS object 40 at offset 0x49D8 53 bytes
SHA-256: c691accea42d9701a1ffb3e431ee24b096fb94401edd86a64dfbb67844591974
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("439", "4390"));
javascript_obj0043_003.js pdf-javascript-stream PDF /JS object 43 at offset 0x4AF6 52 bytes
SHA-256: a624a293ab5272301661fb9367e4a2da23f09b8380e4948246f36b3d7b90a027
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("435", "436"));
javascript_obj0045_004.js pdf-javascript-stream PDF /JS object 45 at offset 0x4BB7 52 bytes
SHA-256: 0a825e0f2026a5e24b8606e2123b2d44e61d72c7e82fa864297f5d9739661ab2
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("319", "320"));
javascript_obj0060_005.js pdf-javascript-stream PDF /JS object 60 at offset 0x57BA 52 bytes
SHA-256: 2959157c47792552808442cc33b5ee804a1a7577cdf43c7b4d55ef5d912de478
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("441", "442"));
javascript_obj0062_006.js pdf-javascript-stream PDF /JS object 62 at offset 0x587B 52 bytes
SHA-256: 6968c8eab989e4d72f0081fc896d82cd6a37a9583198f60d7b4b4381028277a4
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("445", "446"));
javascript_obj0084_007.js pdf-javascript-stream PDF /JS object 84 at offset 0x6869 52 bytes
SHA-256: 1cd6995e0d42eb764a7ff0053fdb2ae629fc359146c6adb770ea67ba5f32152b
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("287", "288"));
javascript_obj0090_008.js pdf-javascript-stream PDF /JS object 90 at offset 0x6C57 52 bytes
SHA-256: 109376689569ce420f61c689c0892ae841046f4d786007dc14dc80f86f3d6964
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("383", "384"));
javascript_obj0092_009.js pdf-javascript-stream PDF /JS object 92 at offset 0x6D18 52 bytes
SHA-256: b7b29d7da22b9db584fd6a246aea5a14dbc765df2c337601c022dd0d4b909631
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("427", "428"));
javascript_obj0095_010.js pdf-javascript-stream PDF /JS object 95 at offset 0x6E35 52 bytes
SHA-256: 8e57f012cf0d4f0b9eacf1d89e6b6fab93d0a3c0b8416057c0c4f668f2f78d4d
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("431", "432"));
javascript_obj0131_011.js pdf-javascript-stream PDF /JS object 131 at offset 0x9338 52 bytes
SHA-256: c5eb1b77237705493a741f3bc78fc46d410d405c3712021e5a6c0bd5511fd581
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("274", "275"));
javascript_obj0133_012.js pdf-javascript-stream PDF /JS object 133 at offset 0x93FE 52 bytes
SHA-256: c813d1f63ff5093c55e5833e67e921e901c764b1c6a4bc77348b772db3be4e66
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("270", "271"));
javascript_obj0136_013.js pdf-javascript-stream PDF /JS object 136 at offset 0x951E 52 bytes
SHA-256: 4a80d25b270fa54403253374b2a7c507ee7d2b1327acdc7eb07ff69c4ab9458e
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("265", "267"));
javascript_obj0137_014.js pdf-javascript-stream PDF /JS object 137 at offset 0x9587 52 bytes
SHA-256: 4ef479bfc7ad543dce5790b9888a0b05b69136e0d9bc5901d1c58834c8dfd2cc
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("245", "246"));
javascript_obj0138_015.js pdf-javascript-stream PDF /JS object 138 at offset 0x95F0 52 bytes
SHA-256: 00910cb1eba83adbdd0ae990176de4fa6016661a88474dbd64fada78ac15d487
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("249", "250"));
javascript_obj0139_016.js pdf-javascript-stream PDF /JS object 139 at offset 0x9659 52 bytes
SHA-256: 074303db91ef3b93012015e25fae9bfe7f0ecf8d5d90dd8644333b5469d72a52
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("253", "254"));
javascript_obj0140_017.js pdf-javascript-stream PDF /JS object 140 at offset 0x96C2 52 bytes
SHA-256: 237901a2a0ae6bc3179f3ddd62d00f135fdd2a684df7eaf7edaeab4776ee8ac7
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("261", "262"));
javascript_obj0143_018.js pdf-javascript-stream PDF /JS object 143 at offset 0x97E2 52 bytes
SHA-256: 75eabed6b05d911537db394a92c3731da2214fe5690b85ee916987e7a77b923d
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("237", "238"));
javascript_obj0146_019.js pdf-javascript-stream PDF /JS object 146 at offset 0x9902 52 bytes
SHA-256: 807cea4569ea4b90c9e668e9341f8c29adbc7a362c5548a36fceb9c35ace26f7
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("230", "231"));
javascript_obj0149_020.js pdf-javascript-stream PDF /JS object 149 at offset 0x9A22 52 bytes
SHA-256: cfd614253db8e4d6f854aa38c7587bb8c773f8bfbd6390aa29d7af1fd1640175
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("279", "280"));
javascript_obj0152_021.js pdf-javascript-stream PDF /JS object 152 at offset 0x9B42 52 bytes
SHA-256: 15e7c63c5f7d1382beef7ff3e890eab82754eb4f433dc5298b2147ae2e83194c
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("283", "284"));
javascript_obj0158_022.js pdf-javascript-stream PDF /JS object 158 at offset 0x9F1F 52 bytes
SHA-256: b51acbd024188dec641cdabcf2b8d40e27a8362cf728cc1da41973edecf8f773
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("257", "258"));
javascript_obj0162_023.js pdf-javascript-stream PDF /JS object 162 at offset 0xA099 52 bytes
SHA-256: fc79da78a28b113fd6a570ee94487b55130b132f2c7f13ef1b14c93eb1558038
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("234", "235"));
javascript_obj0163_024.js pdf-javascript-stream PDF /JS object 163 at offset 0xA102 52 bytes
SHA-256: 3f4cc7b42f847fe23259b5c3c5ef08d0e20ee4424006c30d7ef58d4e16971e5c
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("241", "242"));
javascript_obj0166_025.js pdf-javascript-stream PDF /JS object 166 at offset 0xA336 52 bytes
SHA-256: d47b603a4a7de8c6812dd136287a497bd81423fa55e0683fd52b72d1ae2cce5b
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("226", "227"));
javascript_obj0196_026.js pdf-javascript-stream PDF /JS object 196 at offset 0xBFB4 52 bytes
SHA-256: 0950a5e13ca86a4044629f9bea143c3a9dd28b53d5f34ad6bcb66d230cdfadc9
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("335", "336"));
javascript_obj0203_027.js pdf-javascript-stream PDF /JS object 203 at offset 0xC677 52 bytes
SHA-256: 12b041a5fd369a61834d1c4add58e0fd24aad59d2cea7e08e57fc50a154db437
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("379", "380"));
javascript_obj0226_028.js pdf-javascript-stream PDF /JS object 226 at offset 0xD759 52 bytes
SHA-256: 4a3260f7ad5d98f09fca4f2735c11d9f01e6b66af19abeddb73f64c82d44d486
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("403", "404"));
javascript_obj0258_029.js pdf-javascript-stream PDF /JS object 258 at offset 0xF7A9 52 bytes
SHA-256: 603cba9925b5d872cd40fab9cdf991b99ed01ad232aeb779df57ad2f81ba21ad
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("423", "424"));
javascript_obj0265_030.js pdf-javascript-stream PDF /JS object 265 at offset 0xFD1C 52 bytes
SHA-256: 56eab73de8ef693df1b05b2d715ee20c6e4965756ad15356defcb13a7a2c7aa8
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("387", "388"));
javascript_obj0298_031.js pdf-javascript-stream PDF /JS object 298 at offset 0x11B75 52 bytes
SHA-256: db0a0e8a62a388b0df224bb3db23dbc6b0c88405262768e1e0f8a09dbf8fdd67
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("PRD", new Array ("339", "340"));

Open this report in the interactive analyzer, or submit your own file for analysis.