PDF static analysis report

Static analysis result for SHA-256 457cb1722118fcac…

SUSPICIOUS

PDF

60.9 KB Created: 2010-08-16 13:28:08 UTC Authoring application: pdfFactory www.context-gmbh.de (via pdfFactory 2.21 (Windows XP German)) First seen: 2026-05-09
MD5: db79ad206a4c814e7b8924bcdcd4f3d3 SHA-1: 46f097b1e927d8063795be4e28e39deb6590ad2a SHA-256: 457cb1722118fcacafc43f203f2cbd6de5b1d8aa0e0e75f5cf01d55530ff122b
28 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains multiple embedded JavaScript streams, with one particularly large stream (javascript_obj0013_005.js) suggesting complex malicious functionality. The presence of PDF_JPX_CVE_2018_4990_RELATED heuristic indicates an attempt to exploit a known JPEG2000 vulnerability. The JavaScript actions and embedded streams are likely designed to download and execute a secondary payload, contributing to the overall malicious intent of the document.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4946

Heuristics 5

  • JPXDecode + active content — JPEG2000 CVE-family indicator info CVE related PDF_JPX_CVE_2018_4990_RELATED
    PDF uses /JPXDecode (JPEG2000) alongside JavaScript, XFA, or RichMedia indicators. This matches the delivery pattern for Adobe Reader JPEG2000 parser exploit families, including CVE-2018-4990, but does not prove the exact malformed JP2/JPX primitive.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 15

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0069_000.js pdf-javascript-stream PDF /JS object 69 at offset 0xD14A 39 bytes
SHA-256: cf3ef38cead83f4b1b39c7a061c8fef2c62d068861252a2b5ba7c0b959eec058
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "", false);
javascript_obj0070_001.js pdf-javascript-stream PDF /JS object 70 at offset 0xD19A 42 bytes
SHA-256: a22e7a3e6dbfb6427839e3a2fdcab1be9d58bdd666536d5308358ec98c59feed
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "", false);
javascript_obj0100_002.js pdf-javascript-stream PDF /JS object 100 at offset 0xDECA 39 bytes
SHA-256: 3328eab8501405fcffcc95bb30fbb8bcb963b88928e4a40bd4be3a45d3e80107
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 2, 0, 0, "", false);
javascript_obj0101_003.js pdf-javascript-stream PDF /JS object 101 at offset 0xDF1B 42 bytes
SHA-256: 1829f93c988f1bfcd4bf6a74fc06fa5705171ae9bf3ac877b13813c6b492c742
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 2, 0, 0, "", false);
javascript_obj0102_004.js pdf-javascript-stream PDF /JS object 102 at offset 0xDF6F 37 bytes
SHA-256: fe4e53074838f6abfbd472249e5e7aec56f4efbd3181dd9980dcac5cc4248e3e
Preview script
First 1,000 lines of the extracted script
AFRange_Validate(true, 18, true, 73);
javascript_obj0013_005.js pdf-javascript-stream PDF /JS object 13 at offset 0x34B3 7416 bytes
SHA-256: c3b4b5dbf495225a951f486fd196dcd03d890330a4c80742db27bf4f9b241ace
Preview script
First 1,000 lines of the extracted script
var datenarray = new Array();

datenarray[18]=[58.64,98.02,24595,31110.14,57.22,95.65,24588,31101.65,147.3,246.15,61784,78119.57,143.74,240.19,61769,78099.67];
datenarray[19]=[59.1,98.63,24595,31110.14,57.62,96.15,24588,31101.64,148.46,247.66,61784,78119.57,144.76,241.43,61769,78099.64];
datenarray[20]=[59.58,99.25,24594,31109.02,58.05,96.67,24588,31101.63,149.67,249.23,61784,78119.57,145.82,242.75,61769,78099.6];
datenarray[21]=[60.08,99.91,24595,31110.13,58.49,97.22,24589,31103.81,150.93,250.87,61784,78118.52,146.92,244.11,61770,78100.68];
datenarray[22]=[60.6,100.6,24595,31110.13,58.94,97.79,24589,31103.79,152.23,252.61,61785,78120.64,148.07,245.54,61771,78101.74];
datenarray[23]=[61.14,101.31,24595,31110.1,59.41,98.37,24589,31102.69,153.59,254.4,61786,78121.7,149.26,247.03,61772,78102.79];
datenarray[24]=[61.7,102.06,24596,31111.15,59.91,99,24590,31104.83,155,256.28,61787,78122.7,150.49,248.59,61773,78103.81];
datenarray[25]=[62.29,102.84,24596,31111.11,60.42,99.65,24590,31104.79,156.47,258.25,61789,78124.86,151.78,250.22,61774,78104.79];
datenarray[26]=[62.9,103.66,24597,31112.17,60.95,100.32,24591,31105.85,158,260.3,61791,78126.89,153.12,251.91,61776,78106.88];
datenarray[27]=[63.53,104.51,24598,31113.2,61.51,101.03,24592,31106.9,159.6,262.45,61793,78128.92,154.52,253.7,61779,78112.15];
datenarray[28]=[64.19,105.41,24599,31114.23,62.09,101.77,24593,31107.95,161.26,264.69,61796,78133.12,155.97,255.56,61782,78115.33];
datenarray[29]=[64.89,106.35,24601,31116.37,62.69,102.55,24594,31108.99,163,267.06,61800,78138.42,157.49,257.51,61784,78118.43];
datenarray[30]=[65.61,107.32,24602,31117.37,63.32,103.36,24596,31111.12,164.82,269.5,61804,78142.62,159.07,259.55,61787,78121.57];
datenarray[31]=[66.36,108.35,24604,31119.5,63.98,104.21,24597,31112.16,166.7,272.08,61807,78145.67,160.72,261.69,61790,78125.76];
datenarray[32]=[67.15,109.42,24606,31121.6,64.66,105.1,24598,31113.18,168.68,274.78,61812,78150.95,162.43,263.92,61793,78128.85];
datenarray[33]=[67.97,110.54,24607,31122.59,65.38,106.04,24600,31115.32,170.74,277.6,61816,78155.09,164.23,266.27,61797,78134.17];
datenarray[34]=[68.82,111.72,24609,31124.7,66.12,107.02,24601,31116.35,172.89,280.55,61821,78161.38,166.11,268.74,61800,78138.37];
datenarray[35]=[69.72,112.96,24612,31128.94,66.9,108.05,24603,31118.49,175.15,283.65,61827,78167.7,168.07,271.33,61804,78142.61];
datenarray[36]=[70.66,114.25,24614,31131.01,67.72,109.13,24604,31119.52,177.52,286.9,61833,78174.03,170.12,274.04,61807,78145.7];
datenarray[37]=[71.64,115.62,24617,31134.19,68.57,110.27,24605,31120.51,179.98,290.32,61840,78181.42,172.26,276.91,61811,78149.91];
datenarray[38]=[72.67,117.05,24619,31136.22,69.47,111.47,24607,31122.64,182.57,293.92,61846,78187.61,174.51,279.91,61816,78155.26];
datenarray[39]=[73.75,118.54,24622,31139.38,70.41,112.72,24609,31124.76,185.26,297.68,61853,78195.98,176.86,283.06,61819,78158.3];
datenarray[40]=[74.88,120.12,24625,31142.5,71.38,114.04,24610,31125.77,188.11,301.65,61861,78204.35,179.31,286.39,61823,78163.5];
datenarray[41]=[76.06,121.79,24629,31147.81,72.41,115.44,24612,31128.93,191.07,305.83,61869,78213.73,181.9,289.89,61828,78168.8];
datenarray[42]=[77.31,123.56,24633,31154.1,73.49,116.92,24614,31131.06,194.2,310.25,61878,78223.16,184.6,293.6,61831,78171.88];
datenarray[43]=[78.62,125.4,24636,31157.2,74.62,118.47,24616,31133.17,197.5,314.88,61888,78234.81,187.45,297.48,61836,78177.15];
datenarray[44]=[79.98,127.35,24640,31162.42,75.81,120.11,24618,31135.28,200.92,319.78,61898,78249.5,190.45,301.59,61841,78182.44];
datenarray[45]=[81.43,129.42,24644,31167.69,77.05,121.84,24619,31136.26,204.55,324.97,61907,78259.91,193.56,305.95,61846,78187.67];
datenarray[46]=[82.93,131.61,24648,31171.89,78.37,123.68,24622,31139.43,208.32,330.47,61917,78270.36,196.87,310.57,61852,78195.02];
datenarray[47]=[84.53,133.9,24653,31177.18,79.74,125.6,24624,31141.5,212.35,336.22,61929,78283.11,200.31,315.4,61858,78201.3];
datenarray[48]=[86.19,136.34,24657,31181.34,81.2,127.66,24627,31145.74,216.52,342.35,61940,78294.6,203.98,320.56,61865,78209.63];
datenarray[49]=[87.97,138.95,24663,31187.71,82.72,129.85,24630,31148.86,220.99,348.87,61952,78307.14,207.79,326.06,61873,78218.04];
datenarray[50]=[89.82,141.66,24668,31192.88,84.34,132.18,24634,31155.14,225.62,355.7,61966,78322.81,211.86,331.89,61881,78226.32];
datenarray[51]=[91.8,144.59,24675,31200.24,86.02,134.62,24638,31160.37,230.59,363.07,61982,78342.66,216.08,338.02,61891,78238.98];
datenarray[52]=[93.85,147.72,24682,31207.48,87.82,137.24,24642,31164.52,235.76,370.94,62001,78363.52,220.61,344.6,61902,78253.61];
datenarray[53]=[96.07,151,24691,31216.86,89.69,140.04,24647,31170.85,241.31,379.17,62023,78389.6,225.3,351.62,61913,78266.12];
datenarray[54]=[98.37,154.54,24702,31230.53,91.69,142.96,24652,31176.05,247.08,388.04,62049,78416.73,230.34,358.96,61927,78280.82];
datenarray[55]=[100.84,158.34,24713,31242.97,93.77,146.12,24658,31182.35,253.31,397.58,62078,78450.09,235.56,366.89,61941,78295.44];
datenarray[56]=[103.41,162.31,24728,31260.86,96,149.5,24664,31188.58,259.76,407.54,62113,78489.86,241.17,375.39,61957,78312.09];
datenarray[57]=[106.2,166.61,24744,31279.65,98.32,153.01,24672,31196.95,266.76,418.32,62153,78535.83,246.98,384.22,61976,78335.02];
datenarray[58]=[109.08,171.25,24761,31298.4,100.82,156.84,24682,31207.47,273.99,429.97,62197,78582.84,253.25,393.82,61999,78360.17];
datenarray[59]=[112.22,176.01,24782,31320.44,103.4,160.97,24692,31217.86,281.86,441.93,62247,78641.38,259.73,404.21,62026,78392.64];
datenarray[60]=[115.44,181.27,24804,31345.52,106.19,165.19,24704,31232.5,289.95,455.13,62303,78703.18,266.76,414.79,62056,78424.95];
datenarray[61]=[118.97,186.95,24829,31374.87,109.07,169.87,24719,31250.35,298.81,469.38,62364,78774.27,273.97,426.52,62091,78463.58];
datenarray[62]=[122.57,192.68,24857,31406.26,112.2,174.71,24734,31268.01,307.86,483.76,62433,78849.59,281.85,438.67,62131,78510.63];
datenarray[63]=[126.54,199.09,24888,31440.76,115.41,179.99,24753,31288.98,317.84,499.84,62510,78936.39,289.88,451.93,62176,78560.75];
datenarray[64]=[130.58,206.05,24923,31480.49,118.92,185.68,24774,31311.96,327.96,517.32,62598,79036.77,298.71,466.22,62229,78619.33];
datenarray[65]=[135.05,212.9,24964,31526.48,122.48,191.47,24798,31339.14,339.19,534.51,62700,79149.71,307.66,480.75,62289,78688.32];
datenarray[66]=[139.57,220.73,25011,31579.84,126.41,197.88,24825,31369.46,350.54,554.13,62816,79280.2,317.52,496.86,62356,78764.59];
datenarray[67]=[144.61,228.58,25067,31641.45,130.37,204.81,24857,31406.11,363.16,573.86,62953,79435.72,327.45,514.19,62433,78848.16];
datenarray[68]=[149.69,237.32,25132,31716.6,134.74,211.56,24893,31445.76,375.93,595.74,63115,79616.22,338.43,531.17,62523,78949.47];
datenarray[69]=[155.34,246.86,25210,31802.11,139.14,219.27,24937,31494.89,390.1,619.71,63309,79834.21,349.47,550.52,62632,79074.79];
datenarray[70]=[161.57,256.18,25303,31905.29,144,227.58,24990,31554.28,405.73,643.11,63542,80095.95,361.67,569.8,62765,79222.9];
datenarray[71]=[167.43,266.71,25416,32031.55,149.31,235.41,25056,31628.24,420.41,669.52,63820,80407.54,375.01,591.02,62930,79405.16];
datenarray[72]=[174.41,278.31,25550,32183.75,154.32,244.6,25139,31722.04,437.95,698.57,64156,80782.79,387.56,614.06,63136,79636.32];
datenarray[73]=[181.08,289.27,25711,32361.95,160.24,253.52,25241,31835.56,454.67,726.09,64557,81230.99,402.41,636.44,63390,79920.58];
javascript_obj0071_006.js pdf-javascript-stream PDF /JS object 71 at offset 0xD1ED 421 bytes
SHA-256: 0299572f2295cd709b8efbf410a6cfcd8555d49290733748c6238eece99e8503
Preview script
First 1,000 lines of the extracted script
if((this.getField("Geschlecht").value=="H"||this.getField("Geschlecht").value=="F")&this.getField("alter").value!="")
{
var alter = this.getField("alter").value;

if(this.getField("Geschlecht").value =="H")
this.getField("GAR-R1").value = datenarray[alter][0];

if(this.getField("Geschlecht").value =="F")
this.getField("GAR-R1").value = datenarray[alter][4];
}
else{
this.getField("GAR-R1").value = "";
}
javascript_obj0075_007.js pdf-javascript-stream PDF /JS object 75 at offset 0xD3A2 421 bytes
SHA-256: d77323f4373000ff95ada4aadfb95a61eeb33a8d3bfe37a55543a6d451b40ab8
Preview script
First 1,000 lines of the extracted script
if((this.getField("Geschlecht").value=="H"||this.getField("Geschlecht").value=="F")&this.getField("alter").value!="")
{
var alter = this.getField("alter").value;

if(this.getField("Geschlecht").value =="H")
this.getField("GES-R1").value = datenarray[alter][1];

if(this.getField("Geschlecht").value =="F")
this.getField("GES-R1").value = datenarray[alter][5];
}
else{
this.getField("GES-R1").value = "";
}
javascript_obj0079_008.js pdf-javascript-stream PDF /JS object 79 at offset 0xD557 421 bytes
SHA-256: 3dedd2b50d3fdaca64b1a719133aa058d944c3cd3a5f2dc985a688f8c31ca9df
Preview script
First 1,000 lines of the extracted script
if((this.getField("Geschlecht").value=="H"||this.getField("Geschlecht").value=="F")&this.getField("alter").value!="")
{
var alter = this.getField("alter").value;

if(this.getField("Geschlecht").value =="H")
this.getField("GAR-K1").value = datenarray[alter][2];

if(this.getField("Geschlecht").value =="F")
this.getField("GAR-K1").value = datenarray[alter][6];
}
else{
this.getField("GAR-K1").value = "";
}
javascript_obj0083_009.js pdf-javascript-stream PDF /JS object 83 at offset 0xD70C 421 bytes
SHA-256: e66676e0de05b4b8aa5abc13da8f42607f40d29f6b54d52094e5da982d3c1b5f
Preview script
First 1,000 lines of the extracted script
if((this.getField("Geschlecht").value=="H"||this.getField("Geschlecht").value=="F")&this.getField("alter").value!="")
{
var alter = this.getField("alter").value;

if(this.getField("Geschlecht").value =="H")
this.getField("GES-K1").value = datenarray[alter][3];

if(this.getField("Geschlecht").value =="F")
this.getField("GES-K1").value = datenarray[alter][7];
}
else{
this.getField("GES-K1").value = "";
}
javascript_obj0087_010.js pdf-javascript-stream PDF /JS object 87 at offset 0xD8C1 422 bytes
SHA-256: 09315a2a0d81cf1c7c35420810d40fd650d474f3a2b0ac0374e1e0468757b9c8
Preview script
First 1,000 lines of the extracted script
if((this.getField("Geschlecht").value=="H"||this.getField("Geschlecht").value=="F")&this.getField("alter").value!="")
{
var alter = this.getField("alter").value;

if(this.getField("Geschlecht").value =="H")
this.getField("GAR-R2").value = datenarray[alter][8];

if(this.getField("Geschlecht").value =="F")
this.getField("GAR-R2").value = datenarray[alter][12];
}
else{
this.getField("GAR-R2").value = "";
}
javascript_obj0091_011.js pdf-javascript-stream PDF /JS object 91 at offset 0xDA77 422 bytes
SHA-256: 6105de78b0641a5193918e98131d38c1d98583686db43d4a4fcc6df579f0d560
Preview script
First 1,000 lines of the extracted script
if((this.getField("Geschlecht").value=="H"||this.getField("Geschlecht").value=="F")&this.getField("alter").value!="")
{
var alter = this.getField("alter").value;

if(this.getField("Geschlecht").value =="H")
this.getField("GES-R2").value = datenarray[alter][9];

if(this.getField("Geschlecht").value =="F")
this.getField("GES-R2").value = datenarray[alter][13];
}
else{
this.getField("GES-R2").value = "";
}
javascript_obj0095_012.js pdf-javascript-stream PDF /JS object 95 at offset 0xDC2D 423 bytes
SHA-256: 97476515facd3eaa6a0072bdc40d283765fca17af94baf25aab71a4c77f2d81c
Preview script
First 1,000 lines of the extracted script
if((this.getField("Geschlecht").value=="H"||this.getField("Geschlecht").value=="F")&this.getField("alter").value!="")
{
var alter = this.getField("alter").value;

if(this.getField("Geschlecht").value =="H")
this.getField("GAR-K2").value = datenarray[alter][10];

if(this.getField("Geschlecht").value =="F")
this.getField("GAR-K2").value = datenarray[alter][14];
}
else{
this.getField("GAR-K2").value = "";
}
javascript_obj0099_013.js pdf-javascript-stream PDF /JS object 99 at offset 0xDDE3 423 bytes
SHA-256: 92fa10efcf997ca00f4358457dd1f5d20f6c6def3a83ddbe3fca3abcc2dc1515
Preview script
First 1,000 lines of the extracted script
if((this.getField("Geschlecht").value=="H"||this.getField("Geschlecht").value=="F")&this.getField("alter").value!="")
{
var alter = this.getField("alter").value;

if(this.getField("Geschlecht").value =="H")
this.getField("GES-K2").value = datenarray[alter][11];

if(this.getField("Geschlecht").value =="F")
this.getField("GES-K2").value = datenarray[alter][15];
}
else{
this.getField("GES-K2").value = "";
}
javascript_obj0106_014.js pdf-javascript-stream PDF /JS object 106 at offset 0xE128 274 bytes
SHA-256: 0f333934034a2885daa1406064428206ec3884e078d52f4fa4a7bcbb38299de3
Preview script
First 1,000 lines of the extracted script
var alter=getField("alter").value;

if(alter<48)
this.getField("Text3").value="Bei Kapitalwahl f�llt auf die Ertr�ge Abgeltungssteuer an, da bei Ablauf des Vertrages das 60. Lebensjahr noch nicht vollendet ist!";
if(alter>47||alter=="")
this.getField("Text3").value="";

Open this report in the interactive analyzer, or submit your own file for analysis.