Malicious PDF — malware analysis report

Static analysis result for SHA-256 618a565d3d28ecaa…

MALICIOUS

PDF

294.5 KB Created: 4Ø[vS9ÚF¸®uŒdÁ€^I¬ëÿ Authoring application: ± @/R5Æäõ`è1ŠÞåîöð (via 1]$C ¬ûí)Ò8ßNJ¥õíâúæ¸B®8u) First seen: 2026-05-09
MD5: f9b77b333423e07f6d85fe73a82d69d7 SHA-1: 529a82a2556e547cc9065e2962cadd596c75395f SHA-256: 618a565d3d28ecaaf878575ea64d98b25519f943418211324de45418c3dcc0d6
96 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript that displays a message prompting the user to update Adobe Reader, directing them to a specific URL. This is a common social engineering tactic to deliver malicious payloads. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5792

Heuristics 5

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • https://www.verisign.com/rpaIn PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0069_002.js pdf-javascript-stream PDF /JS object 69 at offset 0x77F6 39 bytes
SHA-256: 6b7cde5083353dc94a728e784406248df1e3c34b8a1b86c325dca7d6822fc92b
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 1, 0, 0, "", false);
javascript_obj0070_003.js pdf-javascript-stream PDF /JS object 70 at offset 0x784B 42 bytes
SHA-256: d7feabbe96d6239a4e68846c17660c84111cd34df235720909593806041f8a24
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 1, 0, 0, "", false);
javascript_obj0126_006.js pdf-javascript-stream PDF /JS object 126 at offset 0x44A2D 372 bytes
SHA-256: 1cbe3230bb47687bb85c260df7d916d6169a08e3fbcd9258f74c67716912c6a9
Preview script
First 1,000 lines of the extracted script
if (this.ADBE == undefined)
    this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Acrobat - Reader 6.0.2 Update";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
javascript_obj0127_007.js pdf-javascript-stream PDF /JS object 127 at offset 0x44B67 392 bytes
SHA-256: 292f5eec823ac9a29d2b678f07695a400782d715ec1ed8cf3f44d54ac74928c6
Preview script
First 1,000 lines of the extracted script
if (ADBE.Reader_Value_Asked == undefined)
  ADBE.Reader_Value_Asked = false;
if (ADBE.Reader_Need_Version == undefined || ADBE.Reader_Need_Version < 6.0)
{
  ADBE.Reader_Need_Version = 6.0;
  ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
  ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType;
}
javascript_obj0128_008.js pdf-javascript-stream PDF /JS object 128 at offset 0x44C8C 338 bytes
SHA-256: 2f3a7b409302734f22a8ba5616f7c840e218882ac559109832417c6922d82ea3
Preview script
First 1,000 lines of the extracted script
if (app.viewerType == "Reader")
{
  if (ADBE.Reader_Value_Asked != true)
  {
    if (ADBE.Reader_Need_Version > app.viewerVersion)
    {
       if (app.alert(ADBE.Reader_string_Need_New_Version_Msg, 1, 1) == 1)
        this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
      ADBE.Reader_Value_Asked = true;
    }
  }
}
stream_020_off0000951b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x951B 409252 bytes
SHA-256: a0f5b5f69a88877ffaa1733f0e0bbf9b4b3eef82f4ff804c724870cecea228d2
javascript_obj0224_002.js pdf-javascript-stream PDF /JS object 224 at offset 0x9E59 39 bytes
SHA-256: 2460ac4084aef1aa38ce3ded210c25fdcaaa89150a693c038ba2b842d1c5fb21
Preview script
First 1,000 lines of the extracted script
gW�)neU rb��x.Ij�  ��[B� > ���ث���x� !
javascript_obj0225_003.js pdf-javascript-stream PDF /JS object 225 at offset 0x9EA8 42 bytes
SHA-256: 5bf210d34351b990ad353b9d7b54b770f7bc5e2b80d14d2d3a338a905f85efbe
Preview script
First 1,000 lines of the extracted script
{���oxچho
��9 /������G�?�n�`�� �fs��=]俔
javascript_obj0228_006.js pdf-javascript-stream PDF /JS object 228 at offset 0x9F74 39 bytes
SHA-256: 633665f82aa54d32439b86422550630f98f4f2eda00bc1d942bd6850868d87f4
Preview script
First 1,000 lines of the extracted script
��^2<�Vi��y��a̞ %2���  �s �Q�Ft���
javascript_obj0229_007.js pdf-javascript-stream PDF /JS object 229 at offset 0x9FC2 42 bytes
SHA-256: 7dd069c06c3737be7f67d8249d9ab5c656c0c0739c5dcb3b6311519d33742397
Preview script
First 1,000 lines of the extracted script
Sך4�o�� v�W�GM� `��b�3��͏ܠ2� � RF�����

Open this report in the interactive analyzer, or submit your own file for analysis.