Malicious PDF — malware analysis report

Static analysis result for SHA-256 20fb01b59b106411…

MALICIOUS

PDF

1.00 MB Created: 2003-07-07 18:34:32 UTC Authoring application: OmniForm (via Acrobat Distiller 5.0.5 (Windows)) First seen: 2026-05-11
MD5: ac3777544aea678222bcaee9b7365263 SHA-1: b2ed6f75114f813758f5ddd5a8b27023be8ed6eb SHA-256: 20fb01b59b10641158c6c45b32a07d7087b6823ab1ff4daf9fb24db184bc6f93
202 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains multiple embedded JavaScript streams and triggers JavaScript actions, including the use of eval(). This indicates an attempt to execute arbitrary code. The presence of an embedded file and numerous streams suggests obfuscation or a multi-stage attack. The primary malicious IOC is the URL http://www.advdelphisys.com/, which is likely used to download a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9812

Heuristics 9

  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    function GetFPropXArrays(v,A1,A2){for(var i=0;i<FT.length;i++){if(v==eval(A1+"[i]")){return eval(A2+"["+i+"]");}}return null;}
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript issues an HTTP request on open low PDF_JS_NETWORK_BEACON
    Embedded JavaScript calls a network API — this.getURL() to an http(s) URL, XMLHttpRequest, or SOAP — typically an open-time beacon / tracking pixel or data-exfil callback. This abuses a legitimate Acrobat API and exploits no vulnerability; the risk is the unsolicited outbound request (confirming recipient open or fetching a next stage).
    Matched line in script
        if (ans == 1)
        this.getURL("http://www.adobe.com/products/acrobat/readstep.html", false);
}
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.advdelphisys.com/Revised Referenced by PDF JavaScript
    • http://www.monotype.comMonotypeReferenced by PDF JavaScript
    • http://www.olms.dol.govReferenced by PDF JavaScript
    • http://www.adobe.com/products/acrobat/readstep.hReferenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by PDF JavaScript
    • http://ns.adobe.com/pdf/1.3/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/mm/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/rights/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/t/pg/Referenced by PDF JavaScript
    • http://purl.org/dc/elements/1.1/Referenced by PDF JavaScript
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript
    • http://ns.adobe.com/iX/1.0/Referenced by PDF JavaScript
    • http://www.adobe.com/products/acrobat/readstep.htmlReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ClientEnvironment pdf-embedded-file PDF EmbeddedFile object 1025 at offset 0x8CDDC 1002 bytes
SHA-256: beb3462d625d0908f9f83f9eb33269867ac9843b5139ac5d3cda3ffcbda539d9
javascript_obj1252_000.js pdf-javascript-stream PDF /JS object 1252 at offset 0x526B8 34 bytes
SHA-256: 3a1171d5c29a38e4d6ee9145e1a28845c833c1d0195915aee008bea71b971a75
Preview script
First 1,000 lines of the extracted script
esSubmitButtonPressed();
javascript_obj1253_001.js pdf-javascript-stream PDF /JS object 1253 at offset 0x5270E 54 bytes
SHA-256: ad3beb36c9be904cb528af802aca057ca0f97e99bd6c0401cf86f05dc45ba258
Preview script
First 1,000 lines of the extracted script
esSignPrintButtonPressed("PresSignature");
javascript_obj1254_002.js pdf-javascript-stream PDF /JS object 1254 at offset 0x5277A 48 bytes
SHA-256: 011b69045b66b6966dda07e6574c3e601347369aec52dfa520c28ea3c80c4546
Preview script
First 1,000 lines of the extracted script
esClearSignatureButtonPressed();
javascript_obj1255_003.js pdf-javascript-stream PDF /JS object 1255 at offset 0x527E4 51 bytes
SHA-256: 3aafe97981aa219647c6afeeefc2f4f22721d2604cdc1ec43aa4ab12754926d5
Preview script
First 1,000 lines of the extracted script
crCheckDayNumber("Pres", true);
javascript_obj1257_005.js pdf-javascript-stream PDF /JS object 1257 at offset 0x528A1 53 bytes
SHA-256: acb2b89f84755059d88c59f29ba927217c66aa24b0b7e082f0d4ea869f5f4206
Preview script
First 1,000 lines of the extracted script
crCheckMonthNumber("Pres", true);
javascript_obj1263_006.js pdf-javascript-stream PDF /JS object 1263 at offset 0x52A2A 68 bytes
SHA-256: 43568d8dc529b9fe39029fa296993215eaf60156ef86b8186cbc2d2ee24d2b76
Preview script
First 1,000 lines of the extracted script
esCheckTitleSelection( "Pres", 13, "PrimarySignature" );
javascript_obj1264_007.js pdf-javascript-stream PDF /JS object 1264 at offset 0x52AA4 52 bytes
SHA-256: 948d246143266b551322fee0ce6809f6228f1d2c6e954998905235689e805af8
Preview script
First 1,000 lines of the extracted script
crSkipSignatureBlock("Activity.Q8a.YN");
javascript_obj1269_008.js pdf-javascript-stream PDF /JS object 1269 at offset 0x52BD4 52 bytes
SHA-256: 0eb1aad3aee3cb327cae7671ec2675aacfc7f1150c775919aa03e6a08a3925c9
Preview script
First 1,000 lines of the extracted script
crOtherWithTextSelected("OtherOrgType");
javascript_obj1270_009.js pdf-javascript-stream PDF /JS object 1270 at offset 0x52C3E 38 bytes
SHA-256: b1a9fb15b55bae252ec2934fefa0390bb1221220f729b18c6c57ed7de71ebebf
Preview script
First 1,000 lines of the extracted script
fmCheckOrganizationType();
javascript_obj1271_010.js pdf-javascript-stream PDF /JS object 1271 at offset 0x52C9A 43 bytes
SHA-256: 75ba8fe718bf1aa28c28b0badf17592b43c66f649b97d55fb1ad820ef5cb16eb
Preview script
First 1,000 lines of the extracted script
crClearOtherText("OtherOrgType");
javascript_obj1273_011.js pdf-javascript-stream PDF /JS object 1273 at offset 0x52D58 47 bytes
SHA-256: 5bfd1fcd6dbbeb0427be95ca6f2538ef873a86bf11feb7a053a2e3f880b3a2b2
Preview script
First 1,000 lines of the extracted script
crClearOtherText("OtherOrgType");
javascript_obj1277_012.js pdf-javascript-stream PDF /JS object 1277 at offset 0x52E0C 35 bytes
SHA-256: 0fb0bc5871c4772aaf6ad76554d1f02b8542fccb3435e8b8bb2e5bd06ecfdbc1
Preview script
First 1,000 lines of the extracted script
crPrintBasicForm();
javascript_obj1286_015.js pdf-javascript-stream PDF /JS object 1286 at offset 0x54B5E 53 bytes
SHA-256: 15db25e9f31cc1db67b813a9f5752a0b3a0990aeb733dcd3a675650ae36e7194
Preview script
First 1,000 lines of the extracted script
crCheckOtherState("Other", "cbxAltAddress3");
javascript_obj1287_016.js pdf-javascript-stream PDF /JS object 1287 at offset 0x54BC5 37 bytes
SHA-256: 37cba162c45cc497ccfabffa10e19a4594277f8f45f4eb07164d1b740dc8aa6c
Preview script
First 1,000 lines of the extracted script
crAcceptUpperCaseCharsOnly();
javascript_obj1290_018.js pdf-javascript-stream PDF /JS object 1290 at offset 0x54C93 33 bytes
SHA-256: b49875e7a786cc7d62191be88c49afc7a7f53551d4ec30ddf24c3fd7583d7233
Preview script
First 1,000 lines of the extracted script
AFDate_KeystrokeEx("mm/dd/yyyy");
javascript_obj1292_020.js pdf-javascript-stream PDF /JS object 1292 at offset 0x54D24 47 bytes
SHA-256: 4eb7d5ace7194418d2ca5bc75cbf1493c6d7310a7cf2edd0215d7a8ba209df69
Preview script
First 1,000 lines of the extracted script
crCheckYearNumber("Treas", true);
javascript_obj1294_021.js pdf-javascript-stream PDF /JS object 1294 at offset 0x54DD7 46 bytes
SHA-256: d142b227ef353e292510aacdf9509469e367287182a0ee3ddd10130546ef3d45
Preview script
First 1,000 lines of the extracted script
crCheckDayNumber("Treas", true);
javascript_obj1298_022.js pdf-javascript-stream PDF /JS object 1298 at offset 0x54F12 59 bytes
SHA-256: 9e58df098f822aaa721ed10dcebdad81bb5a1237f57b3d2ab894dd7e22b381a4
Preview script
First 1,000 lines of the extracted script
crCheckOtherState("Pple", "Other.FirstName");
javascript_obj1300_023.js pdf-javascript-stream PDF /JS object 1300 at offset 0x54FDC 48 bytes
SHA-256: 97d4961192fe0adef35677e51ca072bd70429e8e9aa55d02744c0e4262f499a0
Preview script
First 1,000 lines of the extracted script
crCheckMonthNumber("Treas", true);
javascript_obj1303_024.js pdf-javascript-stream PDF /JS object 1303 at offset 0x550A5 56 bytes
SHA-256: 7e0807da407b7681e052a2ac612ae17b162df02b71e1249809ec4de5528d4c5d
Preview script
First 1,000 lines of the extracted script
crCheckYearNumber("Fiscal.To", false);
javascript_obj1305_025.js pdf-javascript-stream PDF /JS object 1305 at offset 0x55165 59 bytes
SHA-256: 5ac9b01a6870ec29a1cb91df721807e91e62e17e2594874d6da94017a9617dbb
Preview script
First 1,000 lines of the extracted script
crCheckDayNumber("Fiscal.To", false);
javascript_obj1307_026.js pdf-javascript-stream PDF /JS object 1307 at offset 0x5522C 57 bytes
SHA-256: 33595198d6819a3bb1f9ade0cb3d0dc864c58c1b2c871a4c8d127892e43e8818
Preview script
First 1,000 lines of the extracted script
crCheckMonthNumber("Fiscal.To", false);
javascript_obj1312_027.js pdf-javascript-stream PDF /JS object 1312 at offset 0x55396 66 bytes
SHA-256: 2a7f7eeccd6e0f1c2d5f3853c2712947e6f02f5365310ce3ad4347bf7190ff92
Preview script
First 1,000 lines of the extracted script
crCheckYearNumber("Fiscal.From", false);
javascript_obj1314_028.js pdf-javascript-stream PDF /JS object 1314 at offset 0x55468 63 bytes
SHA-256: 1d2a6e349c743912089cadfd9cc026a38f06c3a717feb835d65838ad2024a65a
Preview script
First 1,000 lines of the extracted script
crCheckDayNumber("Fiscal.From", false);
javascript_obj1316_029.js pdf-javascript-stream PDF /JS object 1316 at offset 0x55535 59 bytes
SHA-256: 8af14d4bcfa43789b7492523c723805c1d28215dfe83b471654347713c052335
Preview script
First 1,000 lines of the extracted script
crCheckMonthNumber("Fiscal.From", false);
javascript_obj1318_030.js pdf-javascript-stream PDF /JS object 1318 at offset 0x555F8 65 bytes
SHA-256: 53db24e58427768002f53fd3a8c4e1b5c55c35a7dc544d0cdf3eba1e5178e0b6
Preview script
First 1,000 lines of the extracted script
esCheckTitleSelection( "Treas", 14, "SecondarySignature" );
javascript_obj1319_031.js pdf-javascript-stream PDF /JS object 1319 at offset 0x55669 162 bytes
SHA-256: c2e6b56da9eaf64b4435e817c688a39e837635e65c9550b1880bffcd36a8defd
Preview script
First 1,000 lines of the extracted script
esLockDownTheForm(true);
			esHandleSignHelp("Hide", "ALL");
app.alert("finished MouseDown");

//esCheckStatusBeforeSign("Pres");
javascript_obj1321_032.js pdf-javascript-stream PDF /JS object 1321 at offset 0x558FE 106 bytes
SHA-256: 4e619262277086c0fa9493f20043e236b838ec4cf933981a9ea5cc0d4c01d0c5
Preview script
First 1,000 lines of the extracted script
esCheckStatusForSigning( "Treas", "TreasSignature", "PresSignature", "SecondarySignature" );
javascript_obj1322_033.js pdf-javascript-stream PDF /JS object 1322 at offset 0x559A0 49 bytes
SHA-256: 46d680a99e51f3a29f99b4cffd2121bbab1719982aca54bc6d3f86624d30ba52
Preview script
First 1,000 lines of the extracted script
esCheckStatusBeforeSign("Treas");
javascript_obj1328_037.js pdf-javascript-stream PDF /JS object 1328 at offset 0x55B6F 54 bytes
SHA-256: 2c44f622282dffd17742bb5ef78a8f001f345a30097360af9ecc1db2c4439043
Preview script
First 1,000 lines of the extracted script
crCheckYearNumber("Pres", true);
javascript_obj1332_038.js pdf-javascript-stream PDF /JS object 1332 at offset 0x55CBA 53 bytes
SHA-256: 64379f2bd499310a0fd1ea3856e8a6f73b84c55906772e65555aaed5e9f77a38
Preview script
First 1,000 lines of the extracted script
crCheckOtherState("Filer", "Pple.FirstName");

Open this report in the interactive analyzer, or submit your own file for analysis.