Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ee7d84c16a541f6…

MALICIOUS

PDF

2.28 MB Created: À²€µÜü_ȘЀƒ( Authoring application: ÂçÀ虧DNÞHÈÒ×XçsJT (via ÅëÀꎪQo,¿û^Á× ¦>̗y*Ûy‰…6G|‚î¤) First seen: 2026-05-10
MD5: 587afd92e05eb168ff4e599fac1e8768 SHA-1: 70f488c19b59da05128d461988c13a781c528216 SHA-256: 5ee7d84c16a541f67def13cd2a1b252195c110f2e0efe36b65326f25c10fd585
114 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains multiple embedded JavaScript streams, and is encrypted with JavaScript actions. This indicates the document is designed to execute malicious JavaScript upon opening. The high number of streams and the encryption suggest obfuscation to hide the payload. The primary attack pattern involves leveraging PDF's scripting capabilities to deliver a malicious payload, likely a downloader.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9197

Heuristics 5

  • Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj1366_000.js pdf-javascript-stream PDF /JS object 1366 at offset 0x5B7B4 50 bytes
SHA-256: 5ac70b84459938ded62664aad54e1ff40650f175699fa2931b15b124edc42b21
Preview script
First 1,000 lines of the extracted script
action_zeitraum_format_field(event.targetName);
javascript_obj1367_001.js pdf-javascript-stream PDF /JS object 1367 at offset 0x5B819 47 bytes
SHA-256: 70d25d86fb9f8f3cf3ac42bd21fa0c978fe71f026066c74a24bea9ea5c4bef25
Preview script
First 1,000 lines of the extracted script
action_zeitraum2_aktualisieren(event, "01");
javascript_obj1369_003.js pdf-javascript-stream PDF /JS object 1369 at offset 0x5B8C9 33 bytes
SHA-256: c4287c5c3e37d48b98ace11b04930d19e8be4d405af6749d7e51f8d70a59029e
Preview script
First 1,000 lines of the extracted script
AFDate_KeystrokeEx("dd.mm.yyyy");
javascript_obj1370_004.js pdf-javascript-stream PDF /JS object 1370 at offset 0x5B91A 163 bytes
SHA-256: 413ed68bc802087dda08103e9e4285a7f971e944501d18ddc34d92fa31791ab9
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 120, event.value); } catch(the_error) {}
javascript_obj1377_005.js pdf-javascript-stream PDF /JS object 1377 at offset 0x5EBFB 163 bytes
SHA-256: b169d9628490b704f6f288d62c4d8f29bbb0d6e502370cc288515cc7ae8a7e30
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 121, event.value); } catch(the_error) {}
javascript_obj1379_006.js pdf-javascript-stream PDF /JS object 1379 at offset 0x5ED7E 52 bytes
SHA-256: 0a5ba4946d5ed46b8db34333c45fd219fcf2d70ef9cc1bc106fb3fc3da2f941a
Preview script
First 1,000 lines of the extracted script
//action_zeitraum_format_field(event.targetName);
javascript_obj1380_007.js pdf-javascript-stream PDF /JS object 1380 at offset 0x5EDE5 84 bytes
SHA-256: 9e63ea216fd884a8bfad76d793c38e4c7b944f3301700182adeda43e8f1f779e
Preview script
First 1,000 lines of the extracted script
//action_zeitraum2_aktualisieren(event, "01");

wert_kopieren("48011", "948011");
javascript_obj1381_008.js pdf-javascript-stream PDF /JS object 1381 at offset 0x5EE70 163 bytes
SHA-256: 3cdddfe420196d505f01b6b8faab3bf273d89380b81d7c4371f33c4034cb2ae8
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 489, event.value); } catch(the_error) {}
javascript_obj1385_009.js pdf-javascript-stream PDF /JS object 1385 at offset 0x63BDE 82 bytes
SHA-256: df9932821546cd706b63578db1dec51a5dfe57f05901183838b3f09ba708cad8
Preview script
First 1,000 lines of the extracted script
//action_zeitraum2_aktualisieren(event, "01");

wert_kopieren("48012", "948012");
javascript_obj1386_010.js pdf-javascript-stream PDF /JS object 1386 at offset 0x63C65 163 bytes
SHA-256: 9fd79543a8679233206b6c2262a67ada9fdf0e46acf3423302f4cd3e07a25762
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 490, event.value); } catch(the_error) {}
javascript_obj1389_011.js pdf-javascript-stream PDF /JS object 1389 at offset 0x63E4D 47 bytes
SHA-256: 13d8445ce4cdbd2643fa46fefb956685fcc132bd74b1e092c2e2b8a5ce631ae6
Preview script
First 1,000 lines of the extracted script
action_zeitraum2_aktualisieren(event, "02");
javascript_obj1390_012.js pdf-javascript-stream PDF /JS object 1390 at offset 0x63EAF 163 bytes
SHA-256: 56d59988902233c73786731fea7a74440e899dab76ee0d77e2d4557f1ba00e0b
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 122, event.value); } catch(the_error) {}
javascript_obj1394_013.js pdf-javascript-stream PDF /JS object 1394 at offset 0x640F9 163 bytes
SHA-256: 5d8e20f2c8a48e2100bf386d4574964f3ead560f66ec4030d61c30971867c61d
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 123, event.value); } catch(the_error) {}
javascript_obj1397_014.js pdf-javascript-stream PDF /JS object 1397 at offset 0x642E3 82 bytes
SHA-256: e583a6582922f246dc852e6c736ea081f36784e6ac2cadb40da94e6afa27daf7
Preview script
First 1,000 lines of the extracted script
//action_zeitraum2_aktualisieren(event, "02");

wert_kopieren("48021", "948021");
javascript_obj1398_015.js pdf-javascript-stream PDF /JS object 1398 at offset 0x6436A 163 bytes
SHA-256: d92ef9030d592e5a0ec67f96b29f7c4e632a8cb2a0ebeb080cde2ddcfd2f934c
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 491, event.value); } catch(the_error) {}
javascript_obj1400_016.js pdf-javascript-stream PDF /JS object 1400 at offset 0x644A6 82 bytes
SHA-256: 2655eeeeaf1a569e149973597d4bb191ecd5be4e79c4144be1af2ee412174e24
Preview script
First 1,000 lines of the extracted script
//action_zeitraum2_aktualisieren(event, "02");

wert_kopieren("48022", "948022");
javascript_obj1401_017.js pdf-javascript-stream PDF /JS object 1401 at offset 0x6452D 163 bytes
SHA-256: 3408435c744578d7ebaa52abdcaf177902e23dab281e97206dcda6b1e877e96b
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 492, event.value); } catch(the_error) {}
javascript_obj1403_018.js pdf-javascript-stream PDF /JS object 1403 at offset 0x64667 47 bytes
SHA-256: 6e1bbf5c8e4a2840b42feb0dfea373814e6a2183161cdf72179896fd05a15b53
Preview script
First 1,000 lines of the extracted script
action_zeitraum2_aktualisieren(event, "03");
javascript_obj1404_019.js pdf-javascript-stream PDF /JS object 1404 at offset 0x646C9 163 bytes
SHA-256: cd75fe68421c1323d4c8b3b4e6628816de7e1951e34a9ba67452687897f9e986
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 124, event.value); } catch(the_error) {}
javascript_obj1408_020.js pdf-javascript-stream PDF /JS object 1408 at offset 0x64913 163 bytes
SHA-256: fab3fb89e3a0cab19ca7416e3c5fd9330a6eeed76c606fe664bd8b79fbe65c2f
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 125, event.value); } catch(the_error) {}
javascript_obj1411_021.js pdf-javascript-stream PDF /JS object 1411 at offset 0x64AFD 82 bytes
SHA-256: ff391f63b06987fbc57f3d2305b67389f268820df6930eec6126fd8242f95639
Preview script
First 1,000 lines of the extracted script
//action_zeitraum2_aktualisieren(event, "03");

wert_kopieren("48031", "948031");
javascript_obj1412_022.js pdf-javascript-stream PDF /JS object 1412 at offset 0x64B84 163 bytes
SHA-256: 5c77fbe210ff8f89a0380fed67b27843a71c08dcd359946468826f10a2f2ec03
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 493, event.value); } catch(the_error) {}
javascript_obj1414_023.js pdf-javascript-stream PDF /JS object 1414 at offset 0x64CC0 83 bytes
SHA-256: a082277b00766b3599762d9631f4445859025ed6323d52dcb4375597b9597f13
Preview script
First 1,000 lines of the extracted script
//action_zeitraum2_aktualisieren(event, "03");

wert_kopieren("48032", "948032");
javascript_obj1415_024.js pdf-javascript-stream PDF /JS object 1415 at offset 0x64D49 163 bytes
SHA-256: 0af0e24924def36d101dd9693b3b049edca75c60034b8fb0bc813295c3b5d693
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 494, event.value); } catch(the_error) {}
javascript_obj1417_025.js pdf-javascript-stream PDF /JS object 1417 at offset 0x64E83 47 bytes
SHA-256: 48b4540b0e8cdc1f0415f589d5b4c9b4a54f949fc6ef0eb2d478a27ccb4063a2
Preview script
First 1,000 lines of the extracted script
action_zeitraum2_aktualisieren(event, "04");
javascript_obj1418_026.js pdf-javascript-stream PDF /JS object 1418 at offset 0x64EE5 163 bytes
SHA-256: 8a7badefc0f61897741da1a1b4bc1cf78d5a656a992e7e791751be41d2bc16ce
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 126, event.value); } catch(the_error) {}
javascript_obj1421_027.js pdf-javascript-stream PDF /JS object 1421 at offset 0x65081 163 bytes
SHA-256: 7afd4b66e1216f780aefab776c0e1552d48d7d4905afa736dacc726dafa6c2e1
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 127, event.value); } catch(the_error) {}
javascript_obj1423_028.js pdf-javascript-stream PDF /JS object 1423 at offset 0x651BD 83 bytes
SHA-256: d39f1fdd58b1ed77aa6c905c4a30b3fbd945403d80dcf9c28888ebca613bc22d
Preview script
First 1,000 lines of the extracted script
//action_zeitraum2_aktualisieren(event, "04");

wert_kopieren("48041", "948041");
javascript_obj1424_029.js pdf-javascript-stream PDF /JS object 1424 at offset 0x65246 163 bytes
SHA-256: bbe4af4216d328579c70f1324b2b19da8919998c140a425144d643c280a17b1a
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 495, event.value); } catch(the_error) {}
javascript_obj1426_030.js pdf-javascript-stream PDF /JS object 1426 at offset 0x65382 83 bytes
SHA-256: 4f759cb019a8f9a0d790a11fa90c39760198fac996857a21eea16150dec79e49
Preview script
First 1,000 lines of the extracted script
//action_zeitraum2_aktualisieren(event, "04");

wert_kopieren("48042", "948042");
javascript_obj1427_031.js pdf-javascript-stream PDF /JS object 1427 at offset 0x6540B 163 bytes
SHA-256: 6ff91f6c8a99adefe0a812f80dc63b670ddfc84af334f40da101347e3509b4c7
Preview script
First 1,000 lines of the extracted script
var the_field = event.target; var the_document = the_field.doc; try { the_document.dh_store_field(the_document, the_field, 496, event.value); } catch(the_error) {}
javascript_obj1429_032.js pdf-javascript-stream PDF /JS object 1429 at offset 0x65545 47 bytes
SHA-256: a92fe5542e24252ad3ce58b248264b254bdc7ee2c7cfb979c697520f573dbfc0
Preview script
First 1,000 lines of the extracted script
action_zeitraum2_aktualisieren(event, "05");

Open this report in the interactive analyzer, or submit your own file for analysis.