PDF static analysis report

Static analysis result for SHA-256 5f2da9309d5b6f3f…

CLEAN

PDF

133.8 KB Created: 2009-04-10 18:22:56 +02:00 Authoring application: Gnostice PDFProcessor v 4.0 First seen: 2026-05-09
MD5: b10aa1985f869a11a3f892ef764a2575 SHA-1: 511574c72a1f752892e826e0983855dc7a6682d7 SHA-256: 5f2da9309d5b6f3f294f5d7f5133c1dbd263087756cb341617a2bcc208d8370b
24 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0347

Heuristics 3

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 16

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0021_000.js pdf-javascript-stream PDF /JS object 21 at offset 0xC9D 39 bytes
SHA-256: 3328eab8501405fcffcc95bb30fbb8bcb963b88928e4a40bd4be3a45d3e80107
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 2, 0, 0, "", false);
javascript_obj0022_001.js pdf-javascript-stream PDF /JS object 22 at offset 0xCF4 42 bytes
SHA-256: 1829f93c988f1bfcd4bf6a74fc06fa5705171ae9bf3ac877b13813c6b492c742
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 2, 0, 0, "", false);
javascript_obj0023_002.js pdf-javascript-stream PDF /JS object 23 at offset 0xD4E 36 bytes
SHA-256: 4ee60a7209a72b5dd66eea6edd1b78432a9b0f74db26c45ab6df97f2aceea21f
Preview script
First 1,000 lines of the extracted script
AFRange_Validate(true, 1, true, 31);
javascript_obj0027_003.js pdf-javascript-stream PDF /JS object 27 at offset 0xF46 36 bytes
SHA-256: 24db38f2fbe5b5be766901bf5810cda32f70c1d10f7f6dc38c0b22af87f75d1d
Preview script
First 1,000 lines of the extracted script
AFRange_Validate(true, 1, true, 12);
javascript_obj0031_004.js pdf-javascript-stream PDF /JS object 31 at offset 0x113E 41 bytes
SHA-256: 67aa33952482bdd9c560fb497a2d7ac75881365c76dfefbc4712fed40307d600
Preview script
First 1,000 lines of the extracted script
AFRange_Validate(true, 1900, true, 2500);
javascript_obj0184_007.js pdf-javascript-stream PDF /JS object 184 at offset 0x13851 85 bytes
SHA-256: 42f4237f7a4f0b33acc59f7604fcc87bccc4aa4f3882bca76d6134c2d9be0289
Preview script
First 1,000 lines of the extracted script
var e = this.getField("pro");
var g = this.getField("prova1");
g.value = e.value;
javascript_obj0223_009.js pdf-javascript-stream PDF /JS object 223 at offset 0x154F6 39 bytes
SHA-256: cf3ef38cead83f4b1b39c7a061c8fef2c62d068861252a2b5ba7c0b959eec058
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "", false);
javascript_obj0224_010.js pdf-javascript-stream PDF /JS object 224 at offset 0x1554E 42 bytes
SHA-256: a22e7a3e6dbfb6427839e3a2fdcab1be9d58bdd666536d5308358ec98c59feed
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "", false);
javascript_obj0226_011.js pdf-javascript-stream PDF /JS object 226 at offset 0x156A7 44 bytes
SHA-256: 37badb446af9695f0c0ef259bdfd390a13a3e306f952b3e69c47537b8d9a11e8
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "\u20ac", true);
javascript_obj0227_012.js pdf-javascript-stream PDF /JS object 227 at offset 0x15705 47 bytes
SHA-256: 406d95469a0464b9b79f30b85f9caeec6578a9f06fef37b4ab65da9f58df18b3
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "\u20ac", true);
javascript_obj0251_013.js pdf-javascript-stream PDF /JS object 251 at offset 0x19AE2 134 bytes
SHA-256: 752125f77e3af12709bc4568b2607c97d8152a3de2666c9605d972f5b660e89e
Preview script
First 1,000 lines of the extracted script
var f = this.getField("_rb33");
if (f.value != 2)
this.getField("_infA").hidden = f.value != "3";
this.getField("_infA").value = "";
javascript_obj0252_014.js pdf-javascript-stream PDF /JS object 252 at offset 0x19BA4 141 bytes
SHA-256: 352c40dcb822c04880bbe590a73d48ff1e87bb233b1a2a24fe228d99eb29a1d9
Preview script
First 1,000 lines of the extracted script
var f = this.getField("_rb33");
if (f.value == "2")
this.getField("_infA").hidden = f.value != "3";
this.getField("_infA").hidden = "On";
javascript_obj0258_015.js pdf-javascript-stream PDF /JS object 258 at offset 0x19F96 183 bytes
SHA-256: 788add3c7562c26dc80923a31974585e2535ddb176187f0f69c6efab4eaeaf83
Preview script
First 1,000 lines of the extracted script
var f = this.getField("_rb33");

this.getField("_infA").hidden = f.value != "3";

if (f.value != 3){
this.getField("_infA").value = "";
this.getField("_infA").hidden = "On";

     
}
javascript_obj0259_016.js pdf-javascript-stream PDF /JS object 259 at offset 0x1A090 180 bytes
SHA-256: f228efa1ee7bcd33090ee1a2e77e0da7db18cdf15e270139375379b54301e757
Preview script
First 1,000 lines of the extracted script
this.getField("_infA").value = "";
var f = this.getField("_rb33");

this.getField("_infA").hidden = f.value != "3";

if (f.value == "3")
  this.getField("_infA").hidden = "Off";
javascript_obj0294_018.js pdf-javascript-stream PDF /JS object 294 at offset 0x1C25B 33 bytes
SHA-256: 57758ded0ac3700f786c45e29cca00842b712fb028ce95a4cd688d4f70c62fce
Preview script
First 1,000 lines of the extracted script
AFDate_KeystrokeEx("dd/mm/yyyy");
font_00_sfnt_off000082ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x82AD 18860 bytes
SHA-256: 8e45d75141a92ebc312313b8e3faaedeed294a0f006ec72cf322cda6f3b18390

Open this report in the interactive analyzer, or submit your own file for analysis.