Malicious PDF — malware analysis report

Static analysis result for SHA-256 39997e52c49c659e…

MALICIOUS

PDF

180.9 KB Created: 2008-05-30 20:35:14 UTC Authoring application: PScript5.dll Version 5.2.2 (via Acrobat Distiller 5.0.5 (Windows)) First seen: 2026-05-11
MD5: b2103a686935ab0c8047068ac1e28d90 SHA-1: 5008b4795dcc9cbe50314f48325f1e0e82754bec SHA-256: 39997e52c49c659e18f30dd3c2dac896e45ac7c8f85f7aaf6a280084a750ea8f
128 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.007 JavaScript

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT, PDF_JS, and PDF_EVAL. The `eval()` call and `String.fromCharCode` usage suggest obfuscated code execution. The extracted artifact `javascript_obj0027_000.js` is also flagged as suspicious due to script obfuscation. This points to an attempt to download and execute a secondary payload, a common technique for malware delivery.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3132

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
        {
  strTemp1 = String.fromCharCode(eval(i))
       Code128bCharSeta += strTemp1;
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype Referenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript
    • https://www.verisign.com/repository/CPS��In PDF document text
    • https://www.verisign.comIn PDF document text
    • https://www.verisign.com/repository/verisignlogo.gif0��In PDF document text
    • https://www.verisign.com/CPS0bIn PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0027_000.js pdf-javascript-stream PDF /JS object 27 at offset 0x72B 4987 bytes
SHA-256: 84131ddcb93309c84017e80740bd4419b5fcae74ddc45c3adb19291deab4ecdd
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 10 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
// 11060.pdf
// Based on 828888H.pdf
// fix leading zero problem
// Sept 9, 2004
// extract visit date from PA4
// Set FormId to valueAsString 
// Sept 17, 2004
var PV = this.getField("Patient.VisitNo");
var PA6 = this.getField("Patient.addressograph6");
var PA1 = this.getField("Patient.addressograph1");
var PA2 = this.getField("Patient.addressograph2");
var PA3 = this.getField("Patient.addressograph3");

var PA4 = this.getField("Patient.addressograph4");

//var FormID = this.getField("Forms.FormID").value;

var FormID = this.getField("Forms.FormID").valueAsString;
// var PN1 = this.getField("Patient.name1");
var PfMRN = this.getField("Patient.facilityMRN");
// var PAge1 = this.getField("Patient.age");
var Pmrn = this.getField("Patient.mrn");
var PmrnBarcode = this.getField("Patient.mrnBarcode");
var PVisitNo = "";

// var BarcodeInput = this.getField("Barcode.Input");

// var PmrnBarcode1 = this.getField("Patient.mrnBarcode1");
if (PA6.value !="")
{
   //console.println(util.printd(2, d));
   var PVEnd = PA6.value.length;
   PV.value=PA6.value.substring(16,24);
   // PVisitNo = PA6.value.substring(11,4);
   // console.println ("Visit No : " + PVisitNo);

}

if (PA1.value !="")
{   
console.println ("PA1 [0:2] = " + PA1.valueAsString.substring(0,2) );

  if (PA1.valueAsString.substring(0,2) == "03") {
  var PA6String = PA6.valueAsString;
  var EnDate = "";
  var LocCode = "";
// console.println ("Out Patient detected");
// substring(ending_char + 1,starting_char)
PVisitNo = PA6String.substring(15,11);
console.println ("PA6String : " + PA6String);
  console.println ("Visit No : " + PVisitNo);
//  EnDate = PA6String.substring(33,21);
// substring(ending_char + 1,starting_char)
EnDate = PA4.value.substring(8,0);
// console.println ("EnDate : " + EnDate);
  LocCode = PA4.value.substring(14,9);
  }
   // PfMRN.value=PA1.value.substring(4,14);
}

// if (PA2.value !="")
// {   
//   PN1.value=PA2.value;
// }

// if (PA3.value !="")
// {   
//   PAge1.value=PA3.value.substring(1,5);
// }

if (Pmrn.value !="")
{   
var BarcodeInputStr ="";
BarcodeInputStr = PA1.value.substring(4,5) + "|" + Pmrn.valueAsString + "|" + PVisitNo  + "|" + EnDate + "|" + LocCode + "|" + FormID; PmrnBarcode.value=gen_Code128B(BarcodeInputStr);
}



//working code 
function Code128bCharSet() 
{
    var i;
    var Code128bCharSeta = "";
    var strTemp1;
    for (i = 32; i <= 127; i++)
    {
		strTemp1 = String.fromCharCode(eval(i))
       Code128bCharSeta += strTemp1;
    }
    for (i = 193; i <= 199; i++)
    {
		strTemp1 = String.fromCharCode(eval(i))
       Code128bCharSeta += strTemp1;
    }    
	return Code128bCharSeta;
}





function gen_Code128B(BarcodeInput) {
 
var mappingSet=String.fromCharCode(204);
var strtmp="";
var bCharSet = Code128bCharSet();
console.println ("bCharSet = " + bCharSet);
for (var i= 33; i <=126; i++){ 
mappingSet = mappingSet + String.fromCharCode(i);
}

for (var i = 192;  i <=202; i++) {
mappingSet = mappingSet + String.fromCharCode(i);
}
console.println ("mappingSet = " + mappingSet);

console.println ("mappingSet length = " + mappingSet.length);
if (BarcodeInput !="")
{   
     strtmp = BarcodeInput;
 // fix leading 0 problem 
 // strtmp = "" + Pmrn.valueAsString;
console.println("Orginal String = " + BarcodeInput + " strtmp = " + strtmp );

console.println("length of strtmp = " + strtmp.length);

console.println("BarcodeInput.length = " + BarcodeInput.length);

var Code128b ="";
var checkSum = 104;
var charToEncode = "";


Code128b = strtmp;

//for ( var i=0; i<= 7; i=i+2) {
//charToEncode = strtmp.substring(i,i+2);
// console.println ("charToEncode  = " + charToEncode );
//j=charToEncode;
//console.println(" j = " + j);
//ss1 = mappingSet.substring(j - 1);  // get all the string starting at position j. 
//ss2 = ss1.substring(0,1);           // then get string at j only.

//Code128c= Code128c + ss2;

// console.println(" Extract code = " + Code128c);
}
// need convert to string
Code128b = "" + Code128b;
//calc check digit
charToEncode="";
console.println ("Code128b = " + Code128b);
console.println ("Code128b length =" + Code128b.length);
var charval;
var charPos = 0;

for ( var i=0; i< Code128b.length; i++) {
console.println ("Code128b = at " + i + " is " + Code128b);
// charToEncode = Code128b.substring( i, 1);
charToEncode=Code128b.charAt(i);

//charToEncode = Code128b.charAt(i);
console.println ("charToEncode = " + charToEncode);
charval = charToEncode.charCodeAt(0);
charPos = bCharSet.indexOf(charToEncode);
console.println ("charPos = " + charPos);
if (charPos > 0) {
//   checkSum = checkSum + (i+1)*(charPos - 1)
     checkSum += (i+1) * charPos;
}
console.println ("checkSum = " + checkSum);


}

// console.println checksum ;
checkSum = checkSum % 103;
console.println ("checkSum % 103 = " + checkSum );
checkDigit = mappingSet.charAt(checkSum);

var OutCode;
OutCode= String.fromCharCode(201) + Code128b + checkDigit + String.fromCharCode(203) + String.fromCharCode(205);

return OutCode;
}
stream_003_off0000313a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x313A 43096 bytes
SHA-256: 1bf949ae4629a9399ece545df3143fc2d234da4150d2071262db003a29ec93f8
stream_007_off000110ea.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x110EA 10288 bytes
SHA-256: 41e6e0496fdd90c7c09a0f10077193f0992899e80c6f77e30c53cd167f01f808
stream_010_off00019f03.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x19F03 107773 bytes
SHA-256: f8b5634482dabaf0040161953b708d7648a1dc1459beb6e63bf997bafb4818f7
icc_00_off00008cee.icc pdf-icc-profile PDF ICC profile at offset 0x8CEE 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_01_sfnt_off000129dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x129DD 28540 bytes
SHA-256: d380df7f17417c88681f271d5f8c718157eb3982e3389e956a29c4ab5fb5b943
font_02_sfnt_off00015e46.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15E46 14824 bytes
SHA-256: 6f75721f41befd87422e1ebf76f00622abaf7309b3a64cb737247037c047e259
font_04_sfnt_off0002946c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2946C 27605 bytes
SHA-256: 659bf0b8035208f1758f1b892614dbfb0b5b7baad6052234297b54474b1d2dba

Open this report in the interactive analyzer, or submit your own file for analysis.