PDF static analysis report

Static analysis result for SHA-256 3a9a2cc21b2e4a9e…

SUSPICIOUS

PDF

454.2 KB First seen: 2026-05-09
MD5: e9600b76b9a7a0eaeff1e7bc05bdcf42 SHA-1: 1df8ac05fa489c847728a404785e42ba68d37ae1 SHA-256: 3a9a2cc21b2e4a9e2aed90e66ff5430f3f4f0d41f8e11d6dbd5f43fbbea8ef44
48 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1059.001 Command and Scripting Interpreter: PowerShell T1059.003 Command and Scripting Interpreter: Windows Command Shell T1204.002 Malicious Link: Malicious File

The PDF file contains XFA forms and multiple embedded JavaScript streams, indicating a complex delivery mechanism. One of the embedded JavaScript streams (stream_002_off0000050e.js) is particularly large and appears to be obfuscated, suggesting it contains the primary malicious payload. The presence of these elements strongly suggests the document is designed to execute arbitrary code, likely to download and run a second-stage payload.

Machine Learning

  • Nyx PDF Classifier clean score 0.1908

Heuristics 6

  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://forms.stefcameron.com/2006/06/14/acroform-field-name-generator/ Referenced by PDF JavaScript
    • http://www.monotype.comMonotypeIn PDF document text
    • http://ocsp.verisign.com0In PDF document text
    • http://www.adobe.com/go/reader_downloadIn PDF document text
    • http://www.adobe.com/go/acrreaderIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/In PDF document text
    • http://www.xfa.org/schema/xfa-template/3.0/Referenced by PDF JavaScript
    • http://www.w3.org/1999/xhtmlReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.8/Referenced by PDF JavaScript
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xci/3.0/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.8/\In PDF document text
    • http://www.w3.org/1999/xhtml\In PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/\In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In PDF document text
    • http://www.xfa.org/schema/xfa-connection-set/2.8/In PDF document text
    • http://www.bde.es/InfTrimComYTipIn PDF document text
    • http://ns.adobe.com/data-description/In PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • http://crl.verisign.com/tss-ca.crl0In PDF document text
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In PDF document text
    • http://logo.verisign.com/vslogo.gif0In PDF document text
    • http://csc3-2010-crl.verisign.com/CSC3-2010.crl0DIn PDF document text
    • http://csc3-2010-aia.verisign.com/CSC3-2010.cer0In PDF document text
    • https://www.verisign.com/cps0*In PDF document text
    • http://logo.verisign.com/vslogo.gif04In PDF document text
    • http://crl.verisign.com/pca3-g5.crl04In PDF document text
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00000121.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x121 2560 bytes
SHA-256: 6d8fe6a533994ddfe69a896426fe3b7db6a82b0dcd7520289ad970a4d0e1c6d1
stream_002_off0000050e.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x50E 738041 bytes
SHA-256: d433a5756c5d4dea4c1d5c462684af70355f53a0e1dc86c69e79f50756e0a2b3
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 3 long base64-like blob(s).
stream_003_off00028e6a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x28E6A 2893 bytes
SHA-256: 984e33597cee6a139b4eb9668deb8ae3fd023cb2f29b1dac2e77dd6be0d9a93d
stream_005_off0002940c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2940C 354 bytes
SHA-256: 03ce370fa65ba03e4bf47493c3eb2ead0d7f8285d9431a26cbc7ae86788c3050
stream_006_off00029540.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x29540 16809 bytes
SHA-256: 919096b3d35103619a6c57f6ebd787332bbae67769d345136b62fbe308f15bfc
stream_008_off0003a108.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3A108 367087 bytes
SHA-256: b8e2518b116c26bab0e9f8c1672daf405dedad561157502b657e9005be2029aa
stream_010_off0006e7a5.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6E7A5 1363 bytes
SHA-256: 529357503ec67b623d2a12816cdeea62bd639f2b4ff4e568b01c96cc3f5bfc6f
stream_011_off0006e983.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6E983 902 bytes
SHA-256: e985b5df65c8c3cf732a9074b575fbc594c1c7f0bccc0994182ec7e5c0f7308a
objstm_0011_00.bin pdf-objstm-decoded PDF /ObjStm 11 0 obj (inflated) 10185 bytes
SHA-256: f2fafb708036d60059bd45a0712d86be54a7e6db94ba7c3f2f96bf59f9b1a89e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
font_00_sfnt_off00029cb7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x29CB7 96552 bytes
SHA-256: bb2941ec4287d456b111082246b159a552fabcbd95c93efecdf11c9146f57370

Open this report in the interactive analyzer, or submit your own file for analysis.