PDF static analysis report

Static analysis result for SHA-256 3c82feefb8d209ef…

SUSPICIOUS

PDF

675.0 KB Created: 2007-07-27 15:38:37 +02:00 Authoring application: Word: cgpdftops CUPS filter (via Acrobat Distiller 7.0 for Macintosh) First seen: 2026-05-11
MD5: 9b3d134487be91a1bd46caf79740cf5f SHA-1: d17b85c993e8064e93e120b5e947862bfef61dc8 SHA-256: 3c82feefb8d209ef2140f9b50bd3b5e839d2962c5dd996ba34027f1c2a6a14eb
26 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3506

Heuristics 4

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.)/DA In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0194_000.js pdf-javascript-stream PDF /JS object 194 at offset 0x98CAB 38 bytes
SHA-256: fefbea8a61fff6d2a5e8d7c764a407c92249644f8a10b0dec3cfae812883a2b7
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 2, 0, 0, "", true);
javascript_obj0148_001.js pdf-javascript-stream PDF /JS object 148 at offset 0x98D00 41 bytes
SHA-256: 572a91fc51702643df28955aaeeb86dd1625f4e3544ee1ba29446fcedc17c93d
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 2, 0, 0, "", true);
javascript_obj0174_002.js pdf-javascript-stream PDF /JS object 174 at offset 0x98D58 100 bytes
SHA-256: 706a5b5ad09a708bc319941f49f8e1b74da46ba6776d1fa63988aab8b65aac5e
Preview script
First 1,000 lines of the extracted script
var teiler = this.getField("Fin_10");
var summe = this.getField("gs_fin");
prozente(teiler,summe);
javascript_obj0200_003.js pdf-javascript-stream PDF /JS object 200 at offset 0x98DF3 38 bytes
SHA-256: dd4e86ff46931388298d522a0c25afc2a74df361f28fb6ad9f104ffc1f5056c1
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "", true);
javascript_obj0098_004.js pdf-javascript-stream PDF /JS object 98 at offset 0x98E48 41 bytes
SHA-256: 6aeb2fc8f6b0dba7b9d76914b437aa0140bcd183b4c2b0d2b66173e7a39a1974
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "", true);
javascript_obj0189_005.js pdf-javascript-stream PDF /JS object 189 at offset 0x98E9F 99 bytes
SHA-256: 0171384b351cf987c50cf228c12bfbd3b8e1954d22ba936b9ecae2c0b80eb755
Preview script
First 1,000 lines of the extracted script
var teiler = this.getField("Fin_9");
var summe = this.getField("gs_fin");
prozente(teiler,summe);
javascript_obj0097_006.js pdf-javascript-stream PDF /JS object 97 at offset 0x98FE5 99 bytes
SHA-256: a4c7d86e335f895f1d21d4947f4680270af82ec6f58b1c83f2e7b85588cb5a81
Preview script
First 1,000 lines of the extracted script
var teiler = this.getField("Fin_8");
var summe = this.getField("gs_fin");
prozente(teiler,summe);
javascript_obj0058_007.js pdf-javascript-stream PDF /JS object 58 at offset 0x9912A 99 bytes
SHA-256: d4e8c7b1d7b3fa7d8f1e82114d144167427d89e1db3fe948fd4f706f3eb8b9bf
Preview script
First 1,000 lines of the extracted script
var teiler = this.getField("Fin_7");
var summe = this.getField("gs_fin");
prozente(teiler,summe);
javascript_obj0184_008.js pdf-javascript-stream PDF /JS object 184 at offset 0x9926F 99 bytes
SHA-256: 8295fb72099977d3c32ca859bbc863a6d880cb32c50faffd1367933b383055a2
Preview script
First 1,000 lines of the extracted script
var teiler = this.getField("Fin_6");
var summe = this.getField("gs_fin");
prozente(teiler,summe);
javascript_obj0068_009.js pdf-javascript-stream PDF /JS object 68 at offset 0x993B6 99 bytes
SHA-256: 8dea1f3a8af4fa7f984b75692b641cd93e275e2c74e938a6df6f95a4419bce45
Preview script
First 1,000 lines of the extracted script
var teiler = this.getField("Fin_5");
var summe = this.getField("gs_fin");
prozente(teiler,summe);
javascript_obj0105_010.js pdf-javascript-stream PDF /JS object 105 at offset 0x994FC 101 bytes
SHA-256: ac1f38a69cf19d00b110847e67a895bb7bae26799ecd279c09ab9828450fa31d
Preview script
First 1,000 lines of the extracted script
var teiler = this.getField("zws_fin");
var summe = this.getField("gs_fin");
prozente(teiler,summe);
javascript_obj0092_011.js pdf-javascript-stream PDF /JS object 92 at offset 0x99643 99 bytes
SHA-256: 0dc99fe802c71c29300b9bf7277dee6c0f56ede175fdbbd7aa22e7bba4bd006e
Preview script
First 1,000 lines of the extracted script
var teiler = this.getField("Fin_3");
var summe = this.getField("gs_fin");
prozente(teiler,summe);
javascript_obj0132_012.js pdf-javascript-stream PDF /JS object 132 at offset 0x99789 99 bytes
SHA-256: 889daa73ba489e94df79a48ae322b4c209e967faf67fc3c90deb229687b8bd01
Preview script
First 1,000 lines of the extracted script
var teiler = this.getField("Fin_2");
var summe = this.getField("gs_fin");
prozente(teiler,summe);
javascript_obj0096_013.js pdf-javascript-stream PDF /JS object 96 at offset 0x998D0 99 bytes
SHA-256: 48ccb41041dc4e83b445b531d72d40d3d0b29cfe30c9021689f43d3a341c59dd
Preview script
First 1,000 lines of the extracted script
var teiler = this.getField("Fin_1");
var summe = this.getField("gs_fin");
prozente(teiler,summe);
javascript_obj0139_014.js pdf-javascript-stream PDF /JS object 139 at offset 0x99BA6 104 bytes
SHA-256: 2f8c8c570ab050059bf180b05e6d607e406c9c94a95be6520c49668da302346f
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("zws_fin", "Fin_5", "Fin_6", "Fin_7", "Fin_8", "Fin_9", "Fin_10"));
javascript_obj0205_015.js pdf-javascript-stream PDF /JS object 205 at offset 0x9A21C 65 bytes
SHA-256: 59aec1bbe173fc9f9bb93beb2aefbf16f426a394b256fb4e47deae87bfe051dc
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("Fin_1", "Fin_2", "Fin_3"));
javascript_obj0087_016.js pdf-javascript-stream PDF /JS object 87 at offset 0x9A664 61 bytes
SHA-256: 535567aca56eae7700c3d123967bf2b8a14f04f5b8b23f8f09ae235d2731818c
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("111_8", "zws_invest"));
javascript_obj0118_017.js pdf-javascript-stream PDF /JS object 118 at offset 0x9A94F 101 bytes
SHA-256: 86423576b55dbad3bc84a590f4ebd1d31c53a84f6f018f1dde743a94eead20ac
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("111_1", "111_2", "111_3", "111_4", "111_5", "111_6", "111_7"));
javascript_obj0651_018.js pdf-javascript-stream PDF /JS object 651 at offset 0xA4256 100 bytes
SHA-256: 80e681277b5461dc5456fd078c9f8c71b291a7c4e501107f9de1c41add08ae71
Preview script
First 1,000 lines of the extracted script
var teiler = this.getField("Bbetrag");
var summe = this.getField("ueber");
prozente(teiler,summe);
javascript_obj0569_019.js pdf-javascript-stream PDF /JS object 569 at offset 0xA4764 455 bytes
SHA-256: c84df013425eedeb1eac520da86f42c1df218a9193779ce2d42aec6e39f75a3e
Preview script
First 1,000 lines of the extracted script
function prozente()
{
var f = this.getField("cache");
if (summe.value == "0" || teiler.value =="0" || summe.value == "" || teiler.value =="")
   {
      event.value="";
   }
else
   {
    f.value = teiler.value/(summe.value * 0.01);
    if (f.value == "NaN")
           {
            app.beep(0);
            app.alert("Bitte NUR ZAHLEN, keine Textzeichen eingeben!!!",0);
            event.value=0;
           }
     else {event.value = f.value;};
   }
}
stream_000_off0000178c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x178C 557168 bytes
SHA-256: 432434c906824be16396ca4cde515ddb9d6aebab3cb0a147dfc50beb7b7e621e
icc_01_off000696db.icc pdf-icc-profile PDF ICC profile at offset 0x696DB 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_cff_off0006f00d.bin pdf-font-stream PDF embedded font (cff) at offset 0x6F00D 3260 bytes
SHA-256: 0e41c92a9d597d0df4df2d3ea5061ab7de608cfa99a5a41728549c45fb99c749
font_01_cff_off0006fd6f.bin pdf-font-stream PDF embedded font (cff) at offset 0x6FD6F 17484 bytes
SHA-256: 442738d529d7c8da164d3d25f65bb30cc80095f4bdf8845d0f98c5f000c2eec9
font_02_cff_off00072df2.bin pdf-font-stream PDF embedded font (cff) at offset 0x72DF2 12997 bytes
SHA-256: 79e19d77084934d96158fee176a37ddcaaf87cc33fd8e1b50bd1a9f98790fb8c
font_03_cff_off0007580b.bin pdf-font-stream PDF embedded font (cff) at offset 0x7580B 12792 bytes
SHA-256: 24aef38d358353a66a2871e7a760283e5b0c00d00b7d4b52302da84e48fe10c7
font_04_cff_off000782d2.bin pdf-font-stream PDF embedded font (cff) at offset 0x782D2 43386 bytes
SHA-256: ca5c6190a367b7c75d855ca0ae619759bbec2e679002f02580201df54eb6cfee
font_05_cff_off000800c0.bin pdf-font-stream PDF embedded font (cff) at offset 0x800C0 13145 bytes
SHA-256: 7f1167bfafdc2242c51e2bb81cecf43dae9f265910bd5616de51a888d289cbba
font_06_cff_off00082b7d.bin pdf-font-stream PDF embedded font (cff) at offset 0x82B7D 4602 bytes
SHA-256: fc1cf82cca2862cd8af1b446983c4bcc2085a1225ebfec703a86f67d410aa454
font_07_sfnt_off0008e8b0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8E8B0 20408 bytes
SHA-256: e0a0534338a52ce79f357b3a5e828e973c2cac307cf191e4e8b1f5affed061d8
font_08_cff_off00091db6.bin pdf-font-stream PDF embedded font (cff) at offset 0x91DB6 928 bytes
SHA-256: 78743d5687ef8896bddb6cdbb08025c39bad97926d964bebb533be596799b8c2
font_09_cff_off000927f4.bin pdf-font-stream PDF embedded font (cff) at offset 0x927F4 5058 bytes
SHA-256: d207b16607ee331b9b06e1935168d47932cfae3bb6fdd857304eb803b82117f7

Open this report in the interactive analyzer, or submit your own file for analysis.