Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b306c18502a7570…

MALICIOUS

PDF

102.5 KB Created: x¤è:z)5s!íÓü4"AÈÔ|  Authoring application: }ý¨Bh"V8A(c¨¤hvØÖu —,¦¡/ï First seen: 2026-05-10
MD5: 2bd28f494c90c0c339cdb186b4d5e877 SHA-1: 5ad3da12920f1d10338dc4ad9cc33e34d7fbdabf SHA-256: 4b306c18502a75707a494e14b454dfb7923e0ea72e9925b621a5fc8901946b22
72 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file is flagged as malicious due to the presence of embedded JavaScript, which is used to obscure the actual content and likely deliver a secondary payload. The PDF is encrypted and uses JavaScript actions, indicating an attempt to bypass static analysis and hide malicious code. The presence of multiple small JavaScript streams suggests a complex obfuscation or loading mechanism.

Machine Learning

  • Nyx PDF Classifier clean score 0.0283

Heuristics 5

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 19

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0058_001.js pdf-javascript-stream PDF /JS object 58 at offset 0x30A1 33 bytes
SHA-256: b49875e7a786cc7d62191be88c49afc7a7f53551d4ec30ddf24c3fd7583d7233
Preview script
First 1,000 lines of the extracted script
AFDate_KeystrokeEx("mm/dd/yyyy");
javascript_obj0135_002.js pdf-javascript-stream PDF /JS object 135 at offset 0x7506 465 bytes
SHA-256: f65ec7ce0cc2f4ca346a4d5280460e49a0e02891fb47091c5f8deb30119d1eeb
Preview script
First 1,000 lines of the extracted script
/* If the user is holding down the control key */
if (event.modifier == true)
	{
	var answer = app.alert("Now be honest, can I ask you a question?",2,2);   
	if (answer == 4)
		{
    		var answer = app.alert("Do I turn you on baby?  Do I?",2,2);
		if (answer == 4)
			{
			app.alert("Yeah baby, YEAH!!!",3,0)
			}
		else
			{
			app.alert("I'm sorry.  Would you like a cup of tea?",2,0)
			}
		}
	else
		{
    		app.alert("Damn..");
		}
	}
else
	{
	// Do nothing
	}
font_00_cff_off0000b933.bin pdf-font-stream PDF embedded font (cff) at offset 0xB933 13570 bytes
SHA-256: c2b06881310c0aac55532be018481b1fb4584a1282fa6e5fe6d1cd09fa01d39a
font_01_cff_off0000e2c8.bin pdf-font-stream PDF embedded font (cff) at offset 0xE2C8 12885 bytes
SHA-256: 5ff225e2254a6b58860cba4e0657ba789e439bdf9713bd69fe463e1d94053391
font_02_cff_off00010ba5.bin pdf-font-stream PDF embedded font (cff) at offset 0x10BA5 10944 bytes
SHA-256: 873a925ed8e7be8e90692b09c018fa7c8e2fa2bab5e8142cb97d6b8170cce090
font_03_cff_off00012bf8.bin pdf-font-stream PDF embedded font (cff) at offset 0x12BF8 12914 bytes
SHA-256: 1c9cb98404aa4ac4e4cba5feeb034db38070600410bcab2e43d7bac4652c88dd
font_04_cff_off000154ed.bin pdf-font-stream PDF embedded font (cff) at offset 0x154ED 13599 bytes
SHA-256: e262b6b13b679e58a7aefe25d62608ae22bdc03134d0be4b4b5290dd49a9a229
javascript_obj0111_001.js pdf-javascript-stream PDF /JS object 111 at offset 0x15886 33 bytes
SHA-256: 941899caf5292dc0edd1018edd0e2de8ef1cc00775a7da183e7fdd60e4177222
Preview script
First 1,000 lines of the extracted script
�? Niw� �2�D.)r������	V�h��kg�F�
javascript_obj0115_003.js pdf-javascript-stream PDF /JS object 115 at offset 0x15BCA 33 bytes
SHA-256: 0b8d0b5c26ae6edd10a37514166e6bfebd777fb9937b28cb38958919be9e541e
Preview script
First 1,000 lines of the extracted script
�!g ���c��9��-˳� �Ѧ9�
y��b�qѭ�
javascript_obj0120_005.js pdf-javascript-stream PDF /JS object 120 at offset 0x1600E 33 bytes
SHA-256: dba5aacc90c02ab6fc3eb655485ad93e416a19785ebc1ea3388e8c68914fa692
Preview script
First 1,000 lines of the extracted script
��!� �q �T7t:��2�`��&e�K5 � �ZC�y
javascript_obj0124_007.js pdf-javascript-stream PDF /JS object 124 at offset 0x16333 33 bytes
SHA-256: 7b7699fdae3d3622d897e89a018ce780cf05c061d3c775d2fa1cc6cd685d10c0
Preview script
First 1,000 lines of the extracted script
[  h)�=. �-QꩊQ�9�E���!�*�]>~�V%
javascript_obj0127_009.js pdf-javascript-stream PDF /JS object 127 at offset 0x16511 33 bytes
SHA-256: 393dd3984e3472cf36f22d398773ea0a6abbe716c838baaabcd1e025fce0e84d
Preview script
First 1,000 lines of the extracted script
�:�銒��:�~w�5&b_9Ύ�L� �%�WcЊ�
javascript_obj0134_011.js pdf-javascript-stream PDF /JS object 134 at offset 0x16BA6 33 bytes
SHA-256: 4179eacdf05c41c6293da3be9a360ae3f970d34151796d7af61bc71bf6829c00
Preview script
First 1,000 lines of the extracted script
�  �  ��= �W�E   �4@_��-Me�uԚ�
javascript_obj0137_013.js pdf-javascript-stream PDF /JS object 137 at offset 0x16D81 33 bytes
SHA-256: 72c7fd03d0bbb89a705b37745452b865a63f207ae875585281e41e9882afa122
Preview script
First 1,000 lines of the extracted script
��{ �75��0 ��$Ќ�!̫ �+�&gx� �'�
javascript_obj0143_015.js pdf-javascript-stream PDF /JS object 143 at offset 0x172EE 33 bytes
SHA-256: 1c17b818421ba6272b0523ffef877ecd8e6b6a4d395a3d4d8fcdd32cfe7a9721
Preview script
First 1,000 lines of the extracted script
�eXE�vZ��[�[�R .[����g�
�����6���
javascript_obj0146_017.js pdf-javascript-stream PDF /JS object 146 at offset 0x174C9 33 bytes
SHA-256: 6df66bffa5d5ba03ff060be9a10b55077c36f90b1b97f4bc42044368cfb0f424
Preview script
First 1,000 lines of the extracted script
}�� s�H\�AH�� V��#��� o�Ub����
javascript_obj0152_019.js pdf-javascript-stream PDF /JS object 152 at offset 0x17A36 33 bytes
SHA-256: 04e5e219867771ee8eff0b18278385d3af7849ad5cf10246a8106a751468decd
Preview script
First 1,000 lines of the extracted script
�k�d���Z a� �;.p e�����7g9��O9�
javascript_obj0155_021.js pdf-javascript-stream PDF /JS object 155 at offset 0x17C13 33 bytes
SHA-256: 65c14197afcf17926807ee1f42e5a9f6b4fe196a5a8088843b72b54ddbd6f56a
Preview script
First 1,000 lines of the extracted script
? ���*v  ����|Y��u �)D�a =�M� �
javascript_obj0163_023.js pdf-javascript-stream PDF /JS object 163 at offset 0x18415 33 bytes
SHA-256: 078fd812fb3a7eade2379565a6c68f02dcf3c5ede85fddbfb36d04822fd8ad29
Preview script
First 1,000 lines of the extracted script
��m �F �e� �'	�� ʈ$�|:q���{ D?�

Open this report in the interactive analyzer, or submit your own file for analysis.