PDF static analysis report

Static analysis result for SHA-256 54e6e87bacea9c9a…

SUSPICIOUS

PDF

407.3 KB First seen: 2026-05-08
MD5: 37ea1d679bbdba15faca7e2a51aa6f94 SHA-1: a6a3b6c663d1ce51fd5247e505c377578f0332f7 SHA-256: 54e6e87bacea9c9a8e495f029bc75ad9f3b87c3926430f368467f5c7e7b4c040
50 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains multiple embedded JavaScript streams, with one particularly large stream (stream_009_off000012f2.js) flagged as a suspicious payload. The presence of XFA forms and JavaScript actions within the PDF structure strongly suggests an attempt to leverage these features for malicious purposes, likely to download and execute further stages. The benign nature of all extracted URLs indicates the malicious activity is likely confined to the embedded scripts.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.2825

Heuristics 7

  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://forms.stefcameron.com/2006/06/14/acroform-field-name-generator/ Referenced by PDF JavaScript
    • http://www.monotype.comMonotypeIn PDF document text
    • http://ocsp.verisign.com0In PDF document text
    • http://www.adobe.com/go/reader_downloadIn PDF document text
    • http://www.adobe.com/go/acrreaderIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/3.0/Referenced by PDF JavaScript
    • http://www.w3.org/1999/xhtmlReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.8/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xci/3.0/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.8/\In PDF document text
    • http://www.w3.org/1999/xhtml\In PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/\In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In PDF document text
    • http://www.xfa.org/schema/xfa-connection-set/2.8/In PDF document text
    • http://ns.adobe.com/data-description/In PDF document text
    • http://www.bde.es/NoPerFisIn PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • http://crl.verisign.com/tss-ca.crl0In PDF document text
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In PDF document text
    • http://logo.verisign.com/vslogo.gif0In PDF document text
    • http://csc3-2010-crl.verisign.com/CSC3-2010.crl0DIn PDF document text
    • http://csc3-2010-aia.verisign.com/CSC3-2010.cer0In PDF document text
    • https://www.verisign.com/cps0*In PDF document text
    • http://logo.verisign.com/vslogo.gif04In PDF document text
    • http://crl.verisign.com/pca3-g5.crl04In PDF document text
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 11

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000003da.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3DA 1363 bytes
SHA-256: 529357503ec67b623d2a12816cdeea62bd639f2b4ff4e568b01c96cc3f5bfc6f
stream_003_off000005b7.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5B7 902 bytes
SHA-256: e985b5df65c8c3cf732a9074b575fbc594c1c7f0bccc0994182ec7e5c0f7308a
stream_008_off00000f03.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF03 2565 bytes
SHA-256: 52352e7d1f191d5c9320060265ddcd2c363dc161779baee8db16ed436559c1e1
stream_009_off000012f2.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x12F2 141614 bytes
SHA-256: af48e1cf20c153eebe98323763c2e647f4f2ba013aea3f5157b4ad2ff74bbbef
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 long base64-like blob(s).
stream_010_off0000d35e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD35E 2893 bytes
SHA-256: 984e33597cee6a139b4eb9668deb8ae3fd023cb2f29b1dac2e77dd6be0d9a93d
stream_012_off0000d8fe.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD8FE 335 bytes
SHA-256: ff4bb2a8b0d83107927de786b214bb17b128acba154b51968ad1378632d0ee4b
stream_013_off0000da22.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xDA22 831 bytes
SHA-256: 3323ffac250407d88fd7f3eb18b849ee93b1986ca62c44d0017ad35c480d5392
stream_016_off0002e8d6.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2E8D6 367087 bytes
SHA-256: b8e2518b116c26bab0e9f8c1672daf405dedad561157502b657e9005be2029aa
objstm_0048_00.bin pdf-objstm-decoded PDF /ObjStm 48 0 obj (inflated) 719 bytes
SHA-256: f779e95446c8e89b665cc87becc2bc04e87893d944ec8547f81385801cb2292b
font_00_sfnt_off0000dc39.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDC39 96552 bytes
SHA-256: bb2941ec4287d456b111082246b159a552fabcbd95c93efecdf11c9146f57370
font_01_sfnt_off0001e08a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1E08A 98046 bytes
SHA-256: b8a01f1bf52ef962d6ee77e0a9299704d38617565ea12f2a6dc7a39cdb0062eb

Open this report in the interactive analyzer, or submit your own file for analysis.