PDF static analysis report

Static analysis result for SHA-256 6220451e0fc12fb7…

SUSPICIOUS

PDF

57.4 KB Created: 2003-02-17 22:47:27 +01:00 Authoring application: AcroForm (via Adobe PDF library 5.00) First seen: 2014-06-27
MD5: 1a667ac562f653f7dd19127436d1a905 SHA-1: 1065d4f7a9e0da0d9546965dfda8f34556fd0a19 SHA-256: 6220451e0fc12fb73bec43618aecff1e48914ef3f426fd06a63e25b4c886aeb9
58 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF file contains multiple embedded JavaScript streams that manipulate date and user identity information. These scripts, such as 'event.value = (new Date()).toString(); AFDate_FormatEx("HH:mm:ss, yyyy-mm-dd");', suggest an attempt to craft dynamic content, possibly for phishing lures or to gather user details. The ML classifier also flagged this PDF as malicious with a high probability. No specific IOCs like URLs or hashes were extracted from the scripts themselves.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9013

Heuristics 5

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0118_000.js pdf-javascript-stream PDF /JS object 118 at offset 0x1780 82 bytes
SHA-256: eeac9794a6f81edf9c7b7e4d43e59dbdc9e515c4d52c5bdad2dbae7ef0cf702b
Preview script
First 1,000 lines of the extracted script
event.value = (new Date()).toString();
AFDate_FormatEx("HH:mm:ss, yyyy-mm-dd");
javascript_obj0085_001.js pdf-javascript-stream PDF /JS object 85 at offset 0x7CA1 84 bytes
SHA-256: 65e9a29d746d5dddb837ecf61cddc8549317c2e34bc5889766d31ed5439d0d72
Preview script
First 1,000 lines of the extracted script
event.value = (identity.corporation || (event.source.source || this).Collab.user);
javascript_obj0131_002.js pdf-javascript-stream PDF /JS object 131 at offset 0xDEF8 86 bytes
SHA-256: c2069e7df6e3f1bfc92e0dbad2fbfbd7f37467c8e9fba2e95e8ccf1cd19c545b
Preview script
First 1,000 lines of the extracted script
event.value = (identity.corporation || (event.source.source || this).Collab.user);
javascript_obj0138_003.js pdf-javascript-stream PDF /JS object 138 at offset 0xE2FF 81 bytes
SHA-256: 71646dfe35c4819f264f8410af12b664d4ee932e46807f069ce96bd282eca5c9
Preview script
First 1,000 lines of the extracted script
event.value = (new Date()).toString();
AFDate_FormatEx("HH:MM, yyyy-mm-dd");
javascript_obj0070_004.js pdf-javascript-stream PDF /JS object 70 at offset 0x6CC5 280 bytes
SHA-256: 956e5a48f6b906bc6ea867731a2c9ddd8584a946ef967720f7a90b589f0df03f
Preview script
First 1,000 lines of the extracted script
event.value = (new Date()).toString();
AFDate_FormatEx("HH:mm:ss, yyyy-mm-dd");
event.value = "Av " + ((!identity.name || identity.loginName != (event.source.source || this).Collab.user) ? (event.source.source || this).Collab.user : 

identity.name) + " kl. " + event.value;
javascript_obj0133_005.js pdf-javascript-stream PDF /JS object 133 at offset 0xDFAC 279 bytes
SHA-256: 9ef08eac0b3ec13e79beefb6bc0e71c3a008703aca9010bc424b25fe431d5409
Preview script
First 1,000 lines of the extracted script
event.value = (new Date()).toString();
AFDate_FormatEx("HH:MM, yyyy-mm-dd");
event.value = "Av " + ((!identity.name || identity.loginName != (event.source.source || this).Collab.user) ? (event.source.source || this).Collab.user : 

identity.name) + " kl. " + event.value;

Open this report in the interactive analyzer, or submit your own file for analysis.