PDF static analysis report

Static analysis result for SHA-256 36a89b8363d597eb…

CLEAN

PDF

162.3 KB First seen: 2026-05-09
MD5: fdc7e4927a12e66c318699efeb8a1807 SHA-1: 7e0afcb25a76864a4ec9bc15aa136c30ec2e209a SHA-256: 36a89b8363d597eb5db2b0ccdfeed7e3110b4589c1a8ea4ec3f5018b6f747598
14 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains an embedded file, indicated by the PDF_EMBEDDED heuristic. The document is also encrypted and appears to be an image-only lure, suggesting an attempt to obscure malicious content. The presence of an embedded file strongly suggests an attempt to deliver a secondary payload.

Machine Learning

  • Nyx PDF Classifier clean score 0.0061

Heuristics 4

  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Encrypted PDF (string and stream contents are opaque to static scan) info PDF_ENCRYPTED
    PDF declares /Encrypt — string objects and stream contents are encrypted with the standard security handler (RC4 or AES). On its own this is informational; legitimate encrypted documents include signed contracts, billing statements, and rights-managed material. Static heuristics cannot inspect encrypted payload bytes.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.cra-arc.gc.ca/formspubs/hlp/bt_fllbl-eng.html In PDF document text
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/2.8/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.8/In PDF document text
    • http://www.w3.org/1999/xhtmlIn PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://docs.sun.com/source/806-3568/ncg_goldberg.htmlIn PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/In PDF document text
    • http://www.xfa.org/schema/xfa-form/2.8/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 20

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0015.bin pdf-embedded-file PDF EmbeddedFile object 15 at offset 0x1A51 162 bytes
SHA-256: aaa24d81379da9a89f5dc33543dcf5c7074b06c82af4175ee82ab15e62b693f3
embedded_file_obj0016.bin pdf-embedded-file PDF EmbeddedFile object 16 at offset 0x1B41 2290 bytes
SHA-256: b96c8cad978e545b10dac89e84814f97c22881d96f59e07fa388c1959d258498
embedded_file_obj0017.bin pdf-embedded-file PDF EmbeddedFile object 17 at offset 0x1EF9 376191 bytes
SHA-256: 36c96504987bfd34e0e73b614f9b710589ae84a19ceadf55c5ae2035edb0d921
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
embedded_file_obj0018.bin pdf-embedded-file PDF EmbeddedFile object 18 at offset 0xE11C 2840 bytes
SHA-256: ca6f5283968773ce17c8440aea43319d7dfa4b13f5f2b72d11a10d5b9197c0b2
embedded_file_obj0019.bin pdf-embedded-file PDF EmbeddedFile object 19 at offset 0xE46C 1901 bytes
SHA-256: 4b9e4abc49f73ce159c813be86f1701c36d653fff1528b0cd8d0a69114addfdb
embedded_file_obj0020.bin pdf-embedded-file PDF EmbeddedFile object 20 at offset 0xE73D 96 bytes
SHA-256: 421ef013aec2550c96a882d09a34d48046d1672a67322348e93ff6f8f8fcc14f
embedded_file_obj0021.bin pdf-embedded-file PDF EmbeddedFile object 21 at offset 0xE7FD 1687 bytes
SHA-256: 962695e5da8764c1e6c7369994cad87b552f688d8aaa7fd1b58aa70fccf4ff93
javascript_obj0072_000.js pdf-javascript-stream PDF /JS object 72 at offset 0x19831 1169 bytes
SHA-256: 0ab3d232b2f2272b7039ee3e45d0be78ade06bb45327a799559ad4a592ef5a3d
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_string_Need_New_Version_Msg_Old = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_string_Need_New_Version_Msg = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may display, but may not work properly. Some form elements might not be visible at all. Click OK for more information on obtaining the latest version of Adobe Reader.";
ADBE.Viewer_string_Need_New_Version_Msg_Updater = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may display, but may not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
javascript_obj0073_001.js pdf-javascript-stream PDF /JS object 73 at offset 0x19A43 902 bytes
SHA-256: e985b5df65c8c3cf732a9074b575fbc594c1c7f0bccc0994182ec7e5c0f7308a
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 9.0)
{
   ADBE.Reader_Need_Version = 9.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Reader_Need_Version;
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 9.0)
{
   ADBE.Viewer_Need_Version = 9.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Viewer_Need_Version;
}
javascript_obj0074_002.js pdf-javascript-stream PDF /JS object 74 at offset 0x19B9A 1363 bytes
SHA-256: 529357503ec67b623d2a12816cdeea62bd639f2b4ff4e568b01c96cc3f5bfc6f
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.8)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 9.0)
         {
            if (app.alert(ADBE.Reader_string_Need_New_Version_Msg, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg_Updater, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.8"});
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_string_Need_New_Version_Msg_Old, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
		   else if (app.viewerVersion < 9.0)
         {
            if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg, 1, 1) == 1)
               app.launchURL(ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, true);
         }
         else if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg_Updater, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.8"});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
font_00_cff_off0002c866.bin pdf-font-stream PDF embedded font (cff) at offset 0x2C866 565 bytes
SHA-256: fcd37190bbd978b81693c7ef37a382d6bdd6fdad3f01c6b483baef56c894fc63
font_01_sfnt_off0002caef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2CAEF 36434 bytes
SHA-256: 9c32b44ecf17bf371ec1151579897bce960919ad4c8453fd79b005bf4e639ea8
embedded_file_obj0022_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 22 at offset 0x51F0; filter decode failed 176 bytes
SHA-256: 2b6abbb633e6580542730319046c9f423411c96c3ef3c925e095d29a0f7f3b48
embedded_file_obj0023_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 23 at offset 0x52FB; filter decode failed 880 bytes
SHA-256: 9add31e336582c20b5c4fdf6fcfca460115b1bc9dfe5d92a0c7dbb8ab8f05ada
embedded_file_obj0024_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 24 at offset 0x56C8; filter decode failed 80432 bytes
SHA-256: 1b56285f3570863efce663881466d647cbeb2b2a082c7f55ed8f7390cde2bb7b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 8.00, consistent with packed or encrypted content.
embedded_file_obj0025_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 25 at offset 0x19153; filter decode failed 784 bytes
SHA-256: 663494e9540867c5f3160c59b763d2b2538f6bc6a898d74d0c11fdfb5b743c73
embedded_file_obj0026_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 26 at offset 0x194BE; filter decode failed 656 bytes
SHA-256: bed1cfac36431b9635851e38c16dcf6a973d67514367bc8beb2fb391a8c07544
embedded_file_obj0027_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 27 at offset 0x197A9; filter decode failed 128 bytes
SHA-256: f39fa2fc79a3c66b63c02adf3b49cc70cca3613feca2f678a644c7def6f50e04
embedded_file_obj0028_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 28 at offset 0x19884; filter decode failed 448 bytes
SHA-256: 2a0f2378277e746608a0de4e4ea5af68a6c890f7be198a40f5b7df0062588f53
embedded_file_obj0029_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 29 at offset 0x19A9E; filter decode failed 48 bytes
SHA-256: 7aa65458365597d1cfed6498645362496bcf464fcd4ad38fa4a7e2e856c4ef08

Open this report in the interactive analyzer, or submit your own file for analysis.