Malicious PDF — malware analysis report

Static analysis result for SHA-256 395a8b0db877011d…

MALICIOUS

PDF

243.7 KB Created: 2009-11-12 08:21:24 +04:00 Authoring application: PScript5.dll Version 5.2.2 (via Acrobat Distiller 8.0.0 (Windows)) First seen: 2026-05-08
MD5: 5c1c26fae0e659dc63e0a5265c913554 SHA-1: 409b10220f4eaf95b30cc7069ea6a79587ed7e83 SHA-256: 395a8b0db877011d3ba8ef53f75458ca4530ad4297ba961735118fd2ed247a04
66 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains multiple embedded JavaScript streams and a script payload, indicating an attempt to execute malicious code. The presence of XFA forms and JavaScript actions suggests exploitation of PDF vulnerabilities. The embedded scripts are likely responsible for downloading and executing a secondary payload, though their exact function is obscured by obfuscation. The primary attack vector appears to be leveraging PDF features to deliver further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9730

Heuristics 6

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Embedded script payload in PDF stream info PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/ In PDF document text
    • http://www.xfa.org/schema/xci/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.5/In PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In PDF document text
    • http://ns.adobe.com/xtd/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0139_000.js pdf-javascript-stream PDF /JS object 139 at offset 0xE38 1604 bytes
SHA-256: f979542c4992f256c12537db5bbe5f86605da11ef877e634ccfc2c47c9284b10
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 1.2)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 6.01)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_Older, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
               app.findComponent({cType:"Plugin", cName:"XFA",
                                   cDesc: ADBE.Viewer_string_Update_Reader_Desc});
         }
         ADBE.Reader_Value_Asked = true;
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion == 6)
         {
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_60,
            cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO,
            cTitle: ADBE.Viewer_string_Title});
         }
         else if (app.viewerVersion < 6)
         {
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older,
            cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO,
            cTitle: ADBE.Viewer_string_Title});
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Viewer_601, 1, 1) == 1)
                app.findComponent({cType:"Plugin", cName:"XFA",
                                   cDesc: ADBE.Viewer_string_Update_Desc});
         }
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
javascript_obj0140_001.js pdf-javascript-stream PDF /JS object 140 at offset 0x1021 902 bytes
SHA-256: 3bf84668674e23c91aaaa6c58c24a1f80a30566e9cfbd09040882d18101fed76
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 6.01)
{
   ADBE.Reader_Need_Version = 6.03
   ADBE.Reader_Value_New_Version_URL =
       "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l="
       + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_5";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 6.01)
{
   ADBE.Viewer_Need_Version = 6.03;
   ADBE.Viewer_Value_New_Version_URL =
       "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" 
       + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_5";
}
javascript_obj0141_002.js pdf-javascript-stream PDF /JS object 141 at offset 0x118C 2798 bytes
SHA-256: 922f7942d25f53e6e6eedc1b3a95c47a757faab3be4838fa02db0dbea2c4dbcc
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
embedded_pdf_script_00032e1c.bin pdf-embedded-script PDF raw stream script payload at offset 0x32E1C 3255 bytes
SHA-256: 97afbc7006d307beedb6e3d05831e457a2780e2af083f66f197ccce9d0ede545
Preview script
First 1,000 lines of the extracted script
<config xmlns="http://www.xfa.org/schema/xci/1.0/"
><trace
><area level="1" name="font"
></area
></trace
><agent name="designer"
><!--  [0..n]  --><destination
>pdf</destination
><pdf
><!--  [0..n]  --><fontInfo
></fontInfo
></pdf
></agent
><present
><!--  [0..n]  --><pdf
><!--  [0..n]  --><fontInfo
><embed
>0</embed
><subsetBelow
>100</subsetBelow
></fontInfo
><version
>1.5</version
><creator
>Adobe LiveCycle Designer 8.0</creator
><producer
>Adobe LiveCycle Designer 8.0</producer
><interactive
>1</interactive
><tagged
>0</tagged
><compression
><level
>6</level
><compressLogicalStructure
>1</compressLogicalStructure
><type
></type
></compression
><linearized
>1</linearized
><batchOutput
></batchOutput
><encryption
><encrypt
></encrypt
><permissions
><accessibleContent
>1</accessibleContent
><contentCopy
>1</contentCopy
><documentAssembly
>1</documentAssembly
><formFieldFilling
>1</formFieldFilling
><modifyAnnots
>1</modifyAnnots
><print
>1</print
><printHighQuality
>1</printHighQuality
><change
>1</change
><plaintextMetadata
>1</plaintextMetadata
></permissions
></encryption
><openAction
><destination
></destination
></openAction
><scriptModel
></scriptModel
><taggedMode
></taggedMode
><viewerPreferences
><addViewerPreferences
></addViewerPreferences
><duplexOption
></duplexOption
><numberOfCopies
></numberOfCopies
><pageRange
></pageRange
></viewerPreferences
><silentPrint
><addSilentPrint
></addSilentPrint
><printerName
></printerName
></silentPrint
></pdf
><xdp
><packets
>*</packets
></xdp
><common
><data
><uri
></uri
><adjustData
>1</adjustData
><xsl
><uri
></uri
></xsl
><outputXSL
><uri
></uri
></outputXSL
></data
><messaging
></messaging
><log
><to
>memory</to
><uri
>C:\DOCUME~1\SHEHRA~1.SAD\LOCALS~1\Temp\_165g1902j16462dv2n.log</uri
><mode
>overwrite</mode
><threshold
></threshold
></log
><template
><base
>C:\DOCUME~1\SHEHRA~1.SAD\LOCALS~1\Temp\</base
><relevant
></relevant
><uri
></uri
></template
><locale
></locale
></common
><cache
><renderCache
></renderCache
></cache
><incrementalMerge
></incrementalMerge
><script
><runScripts
></runScripts
><exclude
></exclude
><currentPage
></currentPage
></script
><pagination
></pagination
><copies
></copies
><layout
></layout
><destination
>pdf</destination
><output
><to
>uri</to
><uri
>C:\DOCUME~1\SHEHRA~1.SAD\LOCALS~1\Temp\_165g1902j16497fq2r.tmp</uri
></output
></present
><agent name="acrobat"
><common
><locale
></locale
><data
><uri
></uri
><adjustData
>1</adjustData
><xsl
><uri
></uri
></xsl
><outputXSL
><uri
></uri
></outputXSL
></data
><template
><base
>C:\DOCUME~1\SHEHRA~1.SAD\LOCALS~1\Temp\</base
><relevant
></relevant
><uri
></uri
></template
></common
></agent
><psMap
><font posture="normal" psName="KozMinProVI-Regular" typeface="Kozuka Mincho Pro-VI R" weight="normal"
></font
></psMap
><coolType
><additionalFontsDirectory
>C:\Program Files\Adobe\Acrobat 8.0\Designer 8.0\fonts</additionalFontsDirectory
><commonFontsDirectory
>C:\Program Files\Adobe\Acrobat 8.0\Designer 8.0\fonts</commonFontsDirectory
><unicodeDirectory
>C:\Program Files\Adobe\Acrobat 8.0\Designer 8.0\fonts\typeSpt\Unicode</unicodeDirectory
><fntNamesDBFile
>C:\Program Files\Adobe\Acrobat 8.0\Designer 8.0\fonts\typeSpt\FntNames.db</fntNamesDBFile
></coolType
></config
>
font_00_sfnt_off0000c935.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC935 47728 bytes
SHA-256: 1d519fdbe50e3423da2881d93f421b456c72234bdb6a779cb037eda36de96073

Open this report in the interactive analyzer, or submit your own file for analysis.