Malicious PDF — malware analysis report

Static analysis result for SHA-256 6300e7eac89c9c7c…

MALICIOUS

PDF

738.2 KB Created: 2005-08-31 12:45:52 UTC Authoring application: PScript5.dll Version 5.2 (via Acrobat Distiller 5.0 (Windows)) First seen: 2026-05-10
MD5: 6f60d65b175ff3105a79a7dee1c70b07 SHA-1: 0acb46938b32682b0bc0130a06450907bb87598e SHA-256: 6300e7eac89c9c7ca8ccbf413432fd1bb3ad44cea0b721d4935d7630515ffd4a
248 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF document exhibits characteristics of a social engineering attack, using a lure related to a technical standard (ISO/IEC 17799) to mask malicious intent. The embedded JavaScript, obfuscated using String.fromCharCode and eval(), is designed to construct and display license information, potentially as a distraction or to legitimize the document. The presence of PDF_JS_EXPLOIT_CLUSTER and PDF_EVAL heuristics indicates the script is likely attempting to exploit vulnerabilities or execute arbitrary code. The document body's repetition of license information and the heuristic SE_TRAVEL_SUPPORT_PHONE_SCAM (though not directly related to the content, it indicates a pattern of repetitive text stuffing) further support a social engineering pretext.

Machine Learning

  • Nyx PDF Classifier clean score 0.1747

Heuristics 8

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
       for (ct = 0; ct<tp; ct++) {
       v1 = eval("1"+s1.substring(ct * 3 + 6,ct * 3 + 9)+"-1000");
       v2 = (((tp - ct + 3) % 3) + 1);
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.iec.chIn extracted file (icc_00_off0008a265.icc)

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0455_000.js pdf-javascript-stream PDF /JS object 455 at offset 0x8D66A 1446 bytes
SHA-256: ca2c34fbd62c0f2b212d935995d68160a4b677acb6920f60baf443e9e3c891cc
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var d;
var f;
var s1;
var s2;
var s3;
var ct;
var chk;
var tp;
var v1;
var v2;
var dt;

d = event.target;
f = d.getField("licenca");

if (global.numero_serie) {
   s1 = global.numero_serie;
   tp = 50;
   chk = 0;
   s2 = "";
   for (ct = 0; ct<tp; ct++) {
       v1 = eval("1"+s1.substring(ct * 3 + 6,ct * 3 + 9)+"-1000");
       v2 = (((tp - ct + 3) % 3) + 1);
       s2 = String.fromCharCode(v1 / v2) + s2;
       chk = chk + (v1 / v2) * (((tp - ct) % 10) + 1);
   }

   if ((chk % 1000) == eval("1" + s1.substring(0,3) + "-1000") ) {

      s3 = "Licen�a de uso exclusivo para " + s2.substring(0, eval("1" + s1.substring(3,6) + "-1000") );

      s1 = s1.substring(tp*3+6);
      tp = 20;
      chk = 0;
      s2 = "";
      for (ct = 0; ct<tp; ct++) {
         v1 = eval("1" + s1.substring(ct * 3 + 6,ct * 3 + 9) + "-1000");
         v2 = (((tp - ct + 3) % 3) + 1);
         s2 = String.fromCharCode(v1 / v2) + s2;
         chk = chk + (v1 / v2) * (((tp - ct) % 10) + 1);
      }
      dt = new Date();
      if ((chk % 1000) == eval("1" + s1.substring(0,3) + "-1000") ) {
         s3 = s3 + String.fromCharCode(13) + "C�pia impressa pelo sistema "  + s2.substring(0, eval("1" + s1.substring(3,6) + "-1000") ) + " em " + util.printd("dd/mm/yyyy", dt);
      }
      else {
         s3 = f.defaultValue;
      }
   }
   else {
      s3 = f.defaultValue;
   }
   f.value = s3;
}
else {
   f.value = f.defaultValue;
   app.alert(f.userName);
}
stream_135_off0007e476.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7E476 51488 bytes
SHA-256: a404d1dde3c08e0c4a83355f4e1538b20532fb6f6abb2a31c5afb5cd64ad9fab
icc_00_off0008a265.icc pdf-icc-profile PDF ICC profile at offset 0x8A265 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_sfnt_off00072005.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x72005 22064 bytes
SHA-256: 3946f8be56c10737cd247e5a8a6fd840d586053b9b89ea7d295691a2f3bf1930
font_01_sfnt_off000740d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x740D1 20748 bytes
SHA-256: 6de27307f321c4dc59d8522a0d001584c2d20468d27219d5c0d7aad93a386553
font_02_sfnt_off00078b16.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x78B16 40944 bytes
SHA-256: 3d075071835bbaf38975498783253250a6d525b4622cf6d1d99f44c73e548d9f
font_04_sfnt_off0008590a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8590A 29360 bytes
SHA-256: 39b2c022ea00b1ade0267fec59f1973f0ee9d12caa610a97e7cb323ee95f46e0

Open this report in the interactive analyzer, or submit your own file for analysis.