Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c22f50d2cd91d9e…

MALICIOUS

PDF

104.0 KB Created: ÂT²­ã¥t—ËYD…#;õGÒ´³ú Authoring application: Ç òò±ý1ãC‰Ú{fª‘EÛ´£õG˜ðC=y¦ First seen: 2026-05-10
MD5: 6853fdf321820e2b400dc4eb4712694b SHA-1: 21b5a54e50c5ba4ebf9a5670249b218a1d1ceab4 SHA-256: 3c22f50d2cd91d9efa6f1ec29ecaf8f9dcff8307930b9bdf5be4d1d7d016b368
72 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

This PDF file exhibits multiple indicators of malicious intent, including the presence of JavaScript actions and embedded JS streams. The PDF is also encrypted with JavaScript, which is a strong indicator that the payload is intentionally hidden from static analysis. The heuristics suggest that the JavaScript is used to obfuscate or conceal the malicious content, likely for the purpose of delivering a second-stage payload. No specific IOCs were extracted, and the document body was unreadable.

Machine Learning

  • Nyx PDF Classifier clean score 0.0260

Heuristics 5

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0086_000.js pdf-javascript-stream PDF /JS object 86 at offset 0x3F8F 38 bytes
SHA-256: 729ca6264168a99bb97c0658554d5b34491e18c8ba65c8fc35d432391343ef33
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 0, 0, 0, "", true);
javascript_obj0087_001.js pdf-javascript-stream PDF /JS object 87 at offset 0x3FE3 41 bytes
SHA-256: a011daa0ff2a361a79751d1cef42de9f50cfaaf7fc839fe5b5e485c7248b809d
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 0, 0, 0, "", true);
javascript_obj0148_003.js pdf-javascript-stream PDF /JS object 148 at offset 0x5BA0 33 bytes
SHA-256: b49875e7a786cc7d62191be88c49afc7a7f53551d4ec30ddf24c3fd7583d7233
Preview script
First 1,000 lines of the extracted script
AFDate_KeystrokeEx("mm/dd/yyyy");
javascript_obj0196_006.js pdf-javascript-stream PDF /JS object 196 at offset 0x9D48 465 bytes
SHA-256: f65ec7ce0cc2f4ca346a4d5280460e49a0e02891fb47091c5f8deb30119d1eeb
Preview script
First 1,000 lines of the extracted script
/* If the user is holding down the control key */
if (event.modifier == true)
	{
	var answer = app.alert("Now be honest, can I ask you a question?",2,2);   
	if (answer == 4)
		{
    		var answer = app.alert("Do I turn you on baby?  Do I?",2,2);
		if (answer == 4)
			{
			app.alert("Yeah baby, YEAH!!!",3,0)
			}
		else
			{
			app.alert("I'm sorry.  Would you like a cup of tea?",2,0)
			}
		}
	else
		{
    		app.alert("Damn..");
		}
	}
else
	{
	// Do nothing
	}
font_00_cff_off0000e3ab.bin pdf-font-stream PDF embedded font (cff) at offset 0xE3AB 13570 bytes
SHA-256: c2b06881310c0aac55532be018481b1fb4584a1282fa6e5fe6d1cd09fa01d39a
font_01_cff_off00010d40.bin pdf-font-stream PDF embedded font (cff) at offset 0x10D40 12885 bytes
SHA-256: 5ff225e2254a6b58860cba4e0657ba789e439bdf9713bd69fe463e1d94053391
font_02_cff_off0001361d.bin pdf-font-stream PDF embedded font (cff) at offset 0x1361D 10944 bytes
SHA-256: 873a925ed8e7be8e90692b09c018fa7c8e2fa2bab5e8142cb97d6b8170cce090
font_03_cff_off00015670.bin pdf-font-stream PDF embedded font (cff) at offset 0x15670 12914 bytes
SHA-256: 1c9cb98404aa4ac4e4cba5feeb034db38070600410bcab2e43d7bac4652c88dd
javascript_obj0136_000.js pdf-javascript-stream PDF /JS object 136 at offset 0x11938 38 bytes
SHA-256: 27b240afbce3624704f69f06ca89158b18595d4c8ba95b395fa60cf59f5593f3
Preview script
First 1,000 lines of the extracted script
�`�n���� e/�s�e��y�I:֨ �fx�*�q�b.1�
javascript_obj0137_001.js pdf-javascript-stream PDF /JS object 137 at offset 0x1198A 41 bytes
SHA-256: 3daba3bc025bf89aeb1d85c8a8c1f1f6e59e11fa0f7d8a49c8475ce971877a45
Preview script
First 1,000 lines of the extracted script
���N VP} ��� (�� �'W��%I�r�q�p] չ� Z�Y��
javascript_obj0138_002.js pdf-javascript-stream PDF /JS object 138 at offset 0x11A8D 38 bytes
SHA-256: 1b9c880f2c0846a4952f2130166f3ca952296e464819ed350e33398198f760af
Preview script
First 1,000 lines of the extracted script
�����  
��) �����P�#�M��� L/�DdM ]�)u�
javascript_obj0139_003.js pdf-javascript-stream PDF /JS object 139 at offset 0x11AE2 41 bytes
SHA-256: 7374f72c1d04660177dc0e8b00c54caedf46bf883d0660cb2412268eaca9c65d
Preview script
First 1,000 lines of the extracted script
�M�D ��� �{�Fs�å92@ m�� ��Uo <,m 5>�;�~
javascript_obj0140_004.js pdf-javascript-stream PDF /JS object 140 at offset 0x11C6E 38 bytes
SHA-256: 4911e54149709cd05b14753ddac70c297bc95935c0816b626822ae2d43bd3fb1
Preview script
First 1,000 lines of the extracted script
���D� ˰�1�;��OǙ�(	��'E������V)�V�#.
javascript_obj0141_005.js pdf-javascript-stream PDF /JS object 141 at offset 0x11CC3 41 bytes
SHA-256: 56df9ec7d9dbf46df75add678623559eb9322d10fea64bb1cdae19e098d97f36
Preview script
First 1,000 lines of the extracted script
�H�� 
D��c#G� �a�i �� (���#+^v]$kw��ih�
javascript_obj0142_006.js pdf-javascript-stream PDF /JS object 142 at offset 0x11E59 38 bytes
SHA-256: 5a3e7f03f90406516dcbaece12c2cfe7a031d9a67ba9dbf0eb5a41d6897bcb2a
Preview script
First 1,000 lines of the extracted script
� � a �_��6:�)԰d�K3 �=@��| �UR� 3�
javascript_obj0143_007.js pdf-javascript-stream PDF /JS object 143 at offset 0x11EAC 41 bytes
SHA-256: d761711530b07ec21b59c19871e8e74ace7edd248d887e0b637dd7859b0fb191
Preview script
First 1,000 lines of the extracted script
�#��S69�   �M�C ��=6�8�Ƅ��� 0bZ�y���=�	�
javascript_obj0144_008.js pdf-javascript-stream PDF /JS object 144 at offset 0x11FB2 38 bytes
SHA-256: e93cbcf00c693e4ba241826ddbf39ebbe6fa2d837402d7592b8322b987856672
Preview script
First 1,000 lines of the extracted script
s8j˦�~4 �@�* �W�Xb?eaW- ���f�;c� C[
javascript_obj0145_009.js pdf-javascript-stream PDF /JS object 145 at offset 0x12004 41 bytes
SHA-256: a2cce4f91929ad8653bc45f4787201faf376c2227b6c10f2d79414105a5e908d
Preview script
First 1,000 lines of the extracted script
���E�C#I�� �[� `�\
�zڴ~D�«�VL 2T�P��l
javascript_obj0146_010.js pdf-javascript-stream PDF /JS object 146 at offset 0x12106 38 bytes
SHA-256: ac8e63a5d29c9cad24c6643e32c5029dc53f00e76ed53fa19cde7e3067fe6314
Preview script
First 1,000 lines of the extracted script
��~^��B����c� Ls�	f�R 7w�V� t}h �~*��r
javascript_obj0147_011.js pdf-javascript-stream PDF /JS object 147 at offset 0x12159 41 bytes
SHA-256: c34c2266d03a7c884cfc2c14262f6676258af953c6af49d4a9cd29c6e6586cab
Preview script
First 1,000 lines of the extracted script
`�Uȭ��.�_�؟�)��}��( ��} Ua מIr��߶��
javascript_obj0149_012.js pdf-javascript-stream PDF /JS object 149 at offset 0x122FF 38 bytes
SHA-256: 59f3131516505b398f8063220a3f7753b701d5475e1811a557ad95c9bd3ad7fe
Preview script
First 1,000 lines of the extracted script
uͬD�ɣ��� P��	�~��  X� l<�
 ��f=
�
javascript_obj0150_013.js pdf-javascript-stream PDF /JS object 150 at offset 0x12354 41 bytes
SHA-256: d14e86310440bd03695e12b31596f516026a63feccb02a5bc8deb75e51a817e3
Preview script
First 1,000 lines of the extracted script
�1� � �	y�7��������k����mG�H�uKs�2S�h[��,
javascript_obj0152_014.js pdf-javascript-stream PDF /JS object 152 at offset 0x124F1 38 bytes
SHA-256: 8b1d778263ccb7b15c83527ff31c61c2e73b388e008f79a93e90b28dc3dce3fc
Preview script
First 1,000 lines of the extracted script
�D��-����mP^���VJ ���j���y !ҩ#�D'� 	�
javascript_obj0153_015.js pdf-javascript-stream PDF /JS object 153 at offset 0x12544 41 bytes
SHA-256: 2c2b8c7353e0999a6d11c8e88e02849b6f379d4ccf638c6bca409fc6a1a9be72
Preview script
First 1,000 lines of the extracted script
����� 0 h�� ݈�)�<!� ��h=arq �l Z�G��H ��
javascript_obj0155_016.js pdf-javascript-stream PDF /JS object 155 at offset 0x126E3 38 bytes
SHA-256: 70479a7f4b1bbee12a3cfa7e57b0055fe3a859dcbaaa04b277fc3ac850a92f88
Preview script
First 1,000 lines of the extracted script
М5��= �Ȕ:3� �se�R�����   �j�:��b\�8
javascript_obj0156_017.js pdf-javascript-stream PDF /JS object 156 at offset 0x12736 41 bytes
SHA-256: 47259590958197826734b70c1cf549ebb45ddd0ac9d6aa69102d0ca0f4c4184f
Preview script
First 1,000 lines of the extracted script
ԡ\��;"Ms+ -J 9$ K�8��� �A�q�@�
 b4\��f!
javascript_obj0160_018.js pdf-javascript-stream PDF /JS object 160 at offset 0x12B2A 38 bytes
SHA-256: cc15927a273e1ec81112695eb3b9bbc2cf6a815695fc4cae9aa1995d03e8b5b5
Preview script
First 1,000 lines of the extracted script
A�K��y�7���v�"�@ˠF�.�3nl�S�6�>t�޼�E+
javascript_obj0161_019.js pdf-javascript-stream PDF /JS object 161 at offset 0x12B7C 41 bytes
SHA-256: 82a1a08de0dd09f8bbc5d1cccf7e468e928a543cc392a8d8df29058a000dec1e
Preview script
First 1,000 lines of the extracted script
[�EH 
�� �Y*���Gi|�B<}�bj� �[!z;��4��  ��
javascript_obj0163_020.js pdf-javascript-stream PDF /JS object 163 at offset 0x12D1E 38 bytes
SHA-256: 18c568b555e6a219d8e156ef7b918ea3e80731258b7de4c9ad3164f8aa8e0c9e
Preview script
First 1,000 lines of the extracted script
� `z����[���� �w�8R��5�y*< b+��l6�b4f
javascript_obj0164_021.js pdf-javascript-stream PDF /JS object 164 at offset 0x12D70 41 bytes
SHA-256: 883f7996f63193410591ff20e66ed8eb41c0308de07794cbb10e88cfce7b8984
Preview script
First 1,000 lines of the extracted script
��˸�hO^�#���# :���Q-��  � Պr.�GԺV��;��
javascript_obj0166_022.js pdf-javascript-stream PDF /JS object 166 at offset 0x12F0B 38 bytes
SHA-256: 42da3e8763cabe8dc6ec569dfae1467a9dd2ee6c69244144f6ca16521d318e8f
Preview script
First 1,000 lines of the extracted script
��2 � f�����t��&k�w�� UY��!Y&9��rx����
javascript_obj0167_023.js pdf-javascript-stream PDF /JS object 167 at offset 0x12F5D 41 bytes
SHA-256: 98bc81b03d1385738eb8368cb57c9c01a629a8b9f0452789f7b23ac9b94b0fad
Preview script
First 1,000 lines of the extracted script
�^_�� �p  ���.ee2 ��� ��0�� %� �������(

Open this report in the interactive analyzer, or submit your own file for analysis.