Malicious PDF — malware analysis report

Static analysis result for SHA-256 6acdb15233c20060…

MALICIOUS

PDF

5.98 MB Created: 2010-08-31 13:14:52 UTC Authoring application: Microsoft Word (via Mac OS X 10.5.8 Quartz PDFContext) First seen: 2026-05-11
MD5: aa7324f9424103f43fe4b6d3ffc5f9c2 SHA-1: 2d0e782ca5da0cc89378019bb6880d4ceb385053 SHA-256: 6acdb15233c200606e940e3e72445dbf022cc86ccb196bcb5c7dc2b28e860dd4
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains embedded JavaScript that attempts to exfiltrate credentials by leveraging the `getAnnots` API. The ML classifier strongly indicates maliciousness, and the presence of embedded files and suspicious JavaScript streams suggests the document is designed to exploit vulnerabilities and download further malicious content. The script's behavior is to check for and alert the user about file attachments, but the underlying intent is likely to trigger exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 8

  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www Referenced by PDF JavaScript
    • http://www.liveleak.com/view?i=ca2In PDF document text
    • http://www.elsevier.com/copyrightPDF link annotation
    • http://www.tandf.co.uk/journalsIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/g/img/In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://www.elsevier.com/copyright)/S/URIIn PDF document text
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
JBF.pdf pdf-embedded-file PDF EmbeddedFile object 1623 at offset 0x2D6854 111390 bytes
SHA-256: 874c341e863708e09aff6df9bc940aa1aa4fc89851892c03b4bd1cd33c0d1953
tpilpel.pdf pdf-embedded-file PDF EmbeddedFile object 2533 at offset 0x40445C 109427 bytes
SHA-256: 067d599d379e2ae316b06037ab631c8d7bfc94db83e56cf4ef0a56caad5b54ff
javascript_obj0988_000.js pdf-javascript-stream PDF /JS object 988 at offset 0x139C 1379 bytes
SHA-256: 736c69993d4cd953676f5971bd943955c344f3001c77f281afd5d8df5a456b51
Preview script
First 1,000 lines of the extracted script
var v = app.viewerVersion;
if (v < 7)
{
	var n = 0;
	if (this.dataObjects != null)
		n = this.dataObjects.length;
	if (v >= 5 && v < 6 && n > 0 && (app.viewerVariation == "Full" || app.viewerVariation == "Fill-In"))
	{
		if (this.external)
			app.alert("This document has file attachments. To view the attachments, click the Save button to save a copy of the document, open the copy in Acrobat, and use the File > Document Properties > Embedded Data Objects menu.", 3, 0);
		else
			app.alert("This document has file attachments. Use the File > Document Properties > Embedded Data Objects menu to view the attachments.", 3, 0);
	}
	else if (v >= 6 && v < 7)
	{
		if (n == 0)
		{
			var np = this.numPages;
			syncAnnotScan();
			for (var p = 0; p < np && n == 0; ++p)
			{
				var annots = this.getAnnots(p);
				if (annots != null)
				{
					for (var i = 0; i < annots.length; ++i)
					{
						if (annots[i].type == "FileAttachment")
						{
							n = 1;
							break;
						}
					}
				}
			}
		}
		if (n > 0)
		{
			if (this.external)
				app.alert("This document has file attachments. To view the attachments, click the black triangle at the top of the document window's vertical scrollbar and choose File Attachments.", 3, 0);
			else
				app.alert("This document has file attachments. Use the Document > File Attachments menu to view the attachments.", 3, 0);
		}
	}
}
icc_00_off00002cc0.icc pdf-icc-profile PDF ICC profile at offset 0x2CC0 1456 bytes
SHA-256: 2a18161bb96fd584d19e737ce294732789e0e8e6ae8c8e4e5f09f1b138232a63
icc_01_off0008f5e9.icc pdf-icc-profile PDF ICC profile at offset 0x8F5E9 704 bytes
SHA-256: 4abc5b9b591346b595d9a01568d01ebe51ae28c4e1fd99a95b1aef5b6babfbca
icc_02_off0009cdc8.icc pdf-icc-profile PDF ICC profile at offset 0x9CDC8 704 bytes
SHA-256: 6a2219c0dc16d6d0f4ef4d0ac2fd9fc75257ab7babce4331dfa3c2ba3cb000ae
icc_03_off001170f9.icc pdf-icc-profile PDF ICC profile at offset 0x1170F9 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
icc_04_off0012cbeb.icc pdf-icc-profile PDF ICC profile at offset 0x12CBEB 1296 bytes
SHA-256: 94722fe267764797f8887379cc0d355f5118beb3d186e087bfbd9e1a3f2d3f49
icc_09_off001bcc9d.icc pdf-icc-profile PDF ICC profile at offset 0x1BCC9D 1328 bytes
SHA-256: eda03c8910c87b8a3e3c1ffbc35d223da8ae1d0dcfbad0c153c4eefbff436723
icc_11_off00320867.icc pdf-icc-profile PDF ICC profile at offset 0x320867 3588 bytes
SHA-256: eefbe1e4f64e2d3dc1614343a47c57aa5ab1e88e8ee1f8bc7f22cd097595bb65
icc_12_off0032145c.icc pdf-icc-profile PDF ICC profile at offset 0x32145C 3144 bytes
SHA-256: 3f6d674174f3804eb0dabdac90ae17486e898c5063a66f861c116ea033da8301
font_00_sfnt_off0000585c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x585C 12216 bytes
SHA-256: 21210c1056784d889d51f4cd13a709dabff8d7f1fe54cbdcaac2cdcd6f523a75
font_01_sfnt_off000079e5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x79E5 12320 bytes
SHA-256: 3379d31eca9426bfd9c885143dfda9d5563c2431b797a5ba2f122cbe487d8217
font_02_sfnt_off0000a017.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA017 18116 bytes
SHA-256: a96d80af6c29227d7d1c97a032a10f4037e24a64870902cd42bd2f15e86f2a24
font_03_cff_off00029c93.bin pdf-font-stream PDF embedded font (cff) at offset 0x29C93 887 bytes
SHA-256: 12b6eec1a7a22b655d325f776d188ee57e8aed9c1c9be9d5b02f735d2e782a40
font_04_cff_off0003bd4e.bin pdf-font-stream PDF embedded font (cff) at offset 0x3BD4E 2139 bytes
SHA-256: 2bcb8be84e320391ae06202f1586924a7e1927f2fd6d41932d92fa1134af1a8a
font_05_cff_off0003c72f.bin pdf-font-stream PDF embedded font (cff) at offset 0x3C72F 2745 bytes
SHA-256: 1a58fae190d4d0bf7307b7d25d77cfff63ff863e3fceaf640f27e578d20e8d9f
font_06_cff_off0005263a.bin pdf-font-stream PDF embedded font (cff) at offset 0x5263A 509 bytes
SHA-256: 4ef1833a96021a014c7f793a7a0bb58cd422c8ed5adb30c672f84c87b1179629
font_07_cff_off000529c8.bin pdf-font-stream PDF embedded font (cff) at offset 0x529C8 1136 bytes
SHA-256: b2e0ac974111494926cb15c0406d0e3c75afdd4e0fc7efa0b71b4c36efc0b715
font_08_cff_off0005f951.bin pdf-font-stream PDF embedded font (cff) at offset 0x5F951 2026 bytes
SHA-256: 1f98d07656c20a8cdb53e2d67b599cbab8615ae08d50889d702ac95cdb4763d1
font_09_cff_off00075d06.bin pdf-font-stream PDF embedded font (cff) at offset 0x75D06 1757 bytes
SHA-256: 671ab432c7759de8d8dd0b811561a156c4bb0c0a6e4214f3e29c63f39da6b817
font_10_cff_off00076596.bin pdf-font-stream PDF embedded font (cff) at offset 0x76596 216 bytes
SHA-256: 27c1fde03b201537555a16c4e44308330cd0e6aa96e69bb0f04e64474bc4f94c
font_11_cff_off000767d1.bin pdf-font-stream PDF embedded font (cff) at offset 0x767D1 988 bytes
SHA-256: b50589bb37dd51d6cafe2520ddbcc512bd5e53ffa42f41ef5b8b2d97266eb0f8
font_12_cff_off0007a99a.bin pdf-font-stream PDF embedded font (cff) at offset 0x7A99A 1637 bytes
SHA-256: f6b824a181e392bcdcb58cc110aa77ef297ef55eae78abd9774dbe454c838417
font_13_cff_off00084425.bin pdf-font-stream PDF embedded font (cff) at offset 0x84425 868 bytes
SHA-256: 733a898095268cada7711cf8cb26e0ab13fb88f0984452fe3da44c8de8b9cc68
font_14_sfnt_off00091700.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x91700 7416 bytes
SHA-256: e628fa64688e3d5761dc73c28cfe9a9eb015844bab61943c94ce9bb83e2fd866
font_15_sfnt_off00092c4f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x92C4F 5724 bytes
SHA-256: a4c52261cbafb7c0671777736f7f9bd3c5d8f92e6c5aad8b530e0fc5431fe2ab
font_16_sfnt_off00093d29.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x93D29 6320 bytes
SHA-256: 8d328985c6a122943206d1fb74f9a1cd75b4bb1c56590194f7744100efa0855b
font_17_sfnt_off00095002.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x95002 6112 bytes
SHA-256: f85c4a006be563af738adf3226cbb203cf6ebc9212e365b141382ad9e260fc48
font_18_sfnt_off000961a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x961A2 2024 bytes
SHA-256: c1e8eec3ee97fe2f5c146df5917548933b7b42862a93d007de2be2c9e71d07fa
font_19_sfnt_off00096a0a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x96A0A 1768 bytes
SHA-256: 02e6b6fadd97842e73028cb941c20aeccc4bb9931f438ecb5e241fffb63d7d1c
font_20_sfnt_off000970cc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x970CC 1540 bytes
SHA-256: 8b1f973a0080879374887d7b5e04174c3b390b98c63bd4c92f761fc0c8898087

Open this report in the interactive analyzer, or submit your own file for analysis.