Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b4e6aca00683c1b…

MALICIOUS

PDF

44.9 KB Created: 2010-08-03 15:00:09 +02:00 Authoring application: Adobe LiveCycle Designer ES 8.2 (via Adobe LiveCycle Forms 8.2) First seen: 2026-05-11
MD5: e185c97b032226f5a68be4796378d087 SHA-1: 3cf6a9db9a46513b0a42b5e896587d200883b09e SHA-256: 2b4e6aca00683c1b26462b42aaefc6976ef91be5142abbd3d506d1900c75a474
176 Risk Score

🔏 Digital signature Modified after signing

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains multiple embedded JavaScript streams, with one stream (stream_010_off000024e5.js) being flagged as a suspicious payload. The ML classifier also identified the PDF as malicious. The embedded JavaScript is likely responsible for downloading and executing a second-stage payload, which is a common technique for delivering malware via malicious documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9082

Heuristics 10

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
       output = output + String.fromCharCode(chr1);
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Active content added after the PDF was signed medium PDF_SIGNATURE_POST_SIGN_MODIFICATION
    An incremental update appended AFTER the signed byte range introduces active content (/EmbeddedFile, /Catalog). Some of this can occur in legitimate form-fill (field scripts, a rewritten /Catalog), so it is suspicious rather than damning — but it is content the signer did not approve.
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sbk-oms-qs:8080/pscm/SubmitServlet Referenced by PDF JavaScript
    • http://www.webtoolkit.info/Referenced by PDF JavaScript
    • http://SBK-HMS-QS-APP:8080/HimiWeb/PDFFunctions.action?save=a4da775c1b309cff9f2bc1d4087c82d5#FDFReferenced by PDF JavaScript
    • http://sbk-oms-qs:8080/pscm/PluginService?req=getTbxDir&amp;formID=3140_HIMI_05800&amp;testmode=falseReferenced by PDF JavaScript
    • http://sbk-oms-qs:8080/pscm/PluginService?req=getTbx&amp;tbxID=Referenced by PDF JavaScript
    • http://sbk-oms-qs:8080/pscmReferenced by PDF JavaScript
    • http://sbk-oms-qs:8080/FormServerReferenced by PDF JavaScript
    • http://sbk-oms-qs:8080/pscm/PluginService?req=getTbx&amp;tbxID={TBXID}&amp;isConditional={ISCONDITIONAL}&amp;conditionalField={CONDITIONALFIELD}&amp;conditionalValue={CONDITIONALVALUE}&amp;optionalField={OPTIONALFIELD}&amp;optionalValue={OPTIONALVALUE}&amp;testmode=falseIn PDF document text
    • http://www.adobe.com/products/acrobat/readstep2.htmlIn PDF document text
    • http://www.adobe.com/support/products/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/Referenced by PDF JavaScript
    • http://ns.adobe.com/pdf/1.3/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/mm/Referenced by PDF JavaScript
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/Referenced by PDF JavaScript
    • http://www.adobe.com/supporIn PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://ns.adobe.com/xdp/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xci/1.0/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xci/2.8/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.8/Referenced by PDF JavaScript
    • http://www.w3.org/1999/xhtmlReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.6/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-locale-set/2.7/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-locale-set/2.6/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-connection-set/2.8/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-connection-set/2.4/Referenced by PDF JavaScript
    • http://www.w3.org/2001/XMLSchema-instanceReferenced by PDF JavaScript
    • http://ns.adobe.com/data-description/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-form/2.8/Referenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0073.bin pdf-embedded-file PDF EmbeddedFile object 73 at offset 0xAD3B 162 bytes
SHA-256: 91804242fc1820b0901e741ccb58717c3f94737ce61fae89a1c032786ae65440
embedded_file_obj0074.bin pdf-embedded-file PDF EmbeddedFile object 74 at offset 0xAE2C 2228 bytes
SHA-256: 7acb096dbbc8e4614907cb8a63719f68be4ab64e4994dc644616f5a18610fb70
javascript_obj0022_000.js pdf-javascript-stream PDF /JS object 22 at offset 0x1BA3 1363 bytes
SHA-256: 529357503ec67b623d2a12816cdeea62bd639f2b4ff4e568b01c96cc3f5bfc6f
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.8)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 9.0)
         {
            if (app.alert(ADBE.Reader_string_Need_New_Version_Msg, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg_Updater, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.8"});
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_string_Need_New_Version_Msg_Old, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
		   else if (app.viewerVersion < 9.0)
         {
            if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg, 1, 1) == 1)
               app.launchURL(ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, true);
         }
         else if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg_Updater, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.8"});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
javascript_obj0023_001.js pdf-javascript-stream PDF /JS object 23 at offset 0x1D80 902 bytes
SHA-256: e985b5df65c8c3cf732a9074b575fbc594c1c7f0bccc0994182ec7e5c0f7308a
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 9.0)
{
   ADBE.Reader_Need_Version = 9.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Reader_Need_Version;
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 9.0)
{
   ADBE.Viewer_Need_Version = 9.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Viewer_Need_Version;
}
javascript_obj0024_002.js pdf-javascript-stream PDF /JS object 24 at offset 0x1EDA 1169 bytes
SHA-256: 0ab3d232b2f2272b7039ee3e45d0be78ade06bb45327a799559ad4a592ef5a3d
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_string_Need_New_Version_Msg_Old = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_string_Need_New_Version_Msg = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may display, but may not work properly. Some form elements might not be visible at all. Click OK for more information on obtaining the latest version of Adobe Reader.";
ADBE.Viewer_string_Need_New_Version_Msg_Updater = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may display, but may not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
stream_009_off00002200.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2200 1432 bytes
SHA-256: 114a28808be13308b9b10f86f5980f03402071757c5f8d05c8c38a47051e35e8
stream_010_off000024e5.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x24E5 40902 bytes
SHA-256: f6a674beb67b769fe9df38c5d082f2670357cadc647066667a11c6c61ce59de1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 15 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).
stream_011_off00004bb6.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4BB6 2915 bytes
SHA-256: 0c6a52d09299b9d2c335c01b653af0e669a58fd4908151145588b24b16c7f964
stream_013_off00005143.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5143 346 bytes
SHA-256: 59014517e191bf253573fe586d17ef0d27a274e2fc3c11ad36a2d347bd0c7d52
stream_014_off0000525a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x525A 16416 bytes
SHA-256: 48af322df599fd152a56a4b6fc976a61e60b7194b32d3f0517bfdff6e5d27604

Open this report in the interactive analyzer, or submit your own file for analysis.