Malicious PDF — malware analysis report

Static analysis result for SHA-256 5bd690c70fb35071…

MALICIOUS

PDF

183.8 KB Created: 2004-09-21 08:31:57 -04:00 Authoring application: Adobe Designer 7.0 First seen: 2026-05-11
MD5: f5534541a221d69e55724b570e62aae9 SHA-1: a83be4bd98aecd7946a83205b941603a5dbf7302 SHA-256: 5bd690c70fb35071b2a785ec8edb9e646b9312a0134473cdbf5569bd753feca7
216 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document utilizes embedded JavaScript, including eval() calls and XFA forms, to execute malicious code. The script attempts to redirect the user to 'http://cgi.adobe.com/special/acrobat/update' by presenting a fake update prompt, likely to download a second-stage payload. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9527

Heuristics 10

  • XFA form contains risky executable script high CVE related PDF_XFA_SCRIPT
    PDF embeds an XFA form whose script block contains exploit, submission/launch, or shell-execution primitives. Ordinary LiveCycle print/update scripts are left as generic XFA/JS signals unless stronger behavior is present.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
        xfa.host.resetData("xfa.form.form1.scripting.FFResult");
 FFResult.rawValue = eval(FFScript.rawValue).toString();</script></event><traversal><traverse ref="RunFC[0]"></traverse></traversal></field><field anchorType="topCenter" h="7.62mm" name="RunFC" w="30.48mm" x="101.86mm" y="110.49mm"><ui><button></button></ui><caption><value><text>Run FormCalc</text></value><para hAlign="center" vAlign="middle"></para><font size="9pt" typeface="Myriad Pro"></font></caption><border><edge stroke="raised"></edge><fill><color value="212,208,200"></color></fill></borde …
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Embedded script payload in PDF stream info PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.1/Referenced by PDF JavaScript
    • http://www.w3.org/1999/xhtmlReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/1.0/In PDF document text
    • http://ns.adobe.com/xtd/In PDF document text
    • http://ns.adobe.com/xfdf/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 12

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0188.bin pdf-embedded-file PDF EmbeddedFile object 188 at offset 0x2A9FC 85 bytes
SHA-256: c06dcd026a7ea0536b63e07ce688691b585339a3ab7ff59065e546b56308c7bb
embedded_file_obj0189.bin pdf-embedded-file PDF EmbeddedFile object 189 at offset 0x2AAAF 1490 bytes
SHA-256: d7130124e21a7dcb5958432a23a5370668354cc0412b120f252a73e3304d17fb
embedded_file_obj0190.bin pdf-embedded-file PDF EmbeddedFile object 190 at offset 0x2AD8C 24824 bytes
SHA-256: 42c01c01f2b35522fe7669f4db44a307d38e3a768f61059abaed7946e9790221
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
embedded_file_obj0191.bin pdf-embedded-file PDF EmbeddedFile object 191 at offset 0x2BCA4 316 bytes
SHA-256: 1b986ca247d82649456825aa0a7d0439dbea634924b216fa0d6c072059e02101
embedded_file_obj0192.bin pdf-embedded-file PDF EmbeddedFile object 192 at offset 0x2BDBB 212 bytes
SHA-256: 57045217c453d4674a08ad8778674bf199a7989a9505424a1815c016e6bb412f
embedded_file_obj0193.bin pdf-embedded-file PDF EmbeddedFile object 193 at offset 0x2BEB3 765 bytes
SHA-256: e82f9d537010c5b3932becc11974f98af4f1923414fd7d176a8520f2d211e210
embedded_file_obj0194.bin pdf-embedded-file PDF EmbeddedFile object 194 at offset 0x2C0A7 85 bytes
SHA-256: a60265344cf1a9e94da34c8f587f64a4297e2fa417c895852209903ab7588bcc
javascript_obj0180_000.js pdf-javascript-stream PDF /JS object 180 at offset 0x2A2AD 825 bytes
SHA-256: aa92d846400e59fc3abaf6aa894b725d701cf695f8865309367ff82c0667999b
Preview script
First 1,000 lines of the extracted script
if (this.ADBE == undefined)
   this.ADBE = new Object();
if (ADBE.Reader_Value_Asked == undefined)
ADBE.Reader_Value_Asked = false;
if (ADBE.Viewer_Value_Asked == undefined)
ADBE.Viewer_Value_Asked = false;
if (ADBE.Reader_Need_Version == undefined || ADBE.Reader_Need_Version < 7.0)
{
ADBE.Reader_Need_Version = 7.0;
ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType;
}
if (ADBE.Viewer_Need_Version == undefined || ADBE.Viewer_Need_Version < 7.0)
{
ADBE.Viewer_Need_Version = 7.0;
ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType;
}
javascript_obj0182_001.js pdf-javascript-stream PDF /JS object 182 at offset 0x2A432 2674 bytes
SHA-256: 322c66470a1cefe70312a92078de4a6c0d0d01cae2864ad2009cb588c9b46ec9
Preview script
First 1,000 lines of the extracted script
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Acrobat - Reader 6.0.2 Update";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
javascript_obj0184_002.js pdf-javascript-stream PDF /JS object 184 at offset 0x2A6F5 1543 bytes
SHA-256: a683121ee7c84b6622d28073d5845477daf7eb3a0721f7af9e8a20da36ecf4bd
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.0)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 6.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_5x, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.viewerVersion < 7.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
               app.findComponent({cType:"App", cName:"Reader7", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
               app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
         else if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
font_00_cff_off0000169e.bin pdf-font-stream PDF embedded font (cff) at offset 0x169E 64586 bytes
SHA-256: 96161e3d15cf67591ef2a1c87940c8dc0af59a94fcfab5d6bfcf4cb992a24af8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.45, consistent with packed or encrypted content.
font_01_cff_off0000d47f.bin pdf-font-stream PDF embedded font (cff) at offset 0xD47F 67274 bytes
SHA-256: 19bc268243419390efbe4d4a72616ba894a394856f2c9ca5fc68f8c8c3d28328

Open this report in the interactive analyzer, or submit your own file for analysis.