PDF static analysis report

Static analysis result for SHA-256 6e1c8650798dafb4…

SUSPICIOUS

PDF

503.1 KB First seen: 2026-05-07
MD5: 17f47cbd914ab760c97e399874929ef8 SHA-1: 9b361a84704ae48cac8862e3db7e8711fb3bfa56 SHA-256: 6e1c8650798dafb44b10900b49079c44c53a8d3e1a5a2ffedcea7a07120c24bd
52 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript that displays messages impersonating Adobe Reader update prompts. The script constructs a URL, "http://cgi.adobe.com/special/acrobat/update", which is likely intended to lead the user to download a malicious payload. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 5

  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Encrypted PDF (string and stream contents are opaque to static scan) info PDF_ENCRYPTED
    PDF declares /Encrypt — string objects and stream contents are encrypted with the standard security handler (RC4 or AES). On its own this is informational; legitimate encrypted documents include signed contracts, billing statements, and rights-managed material. Static heuristics cannot inspect encrypted payload bytes.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype In PDF document text
    • http://ocsp.verisign.com0In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.6/Referenced by PDF JavaScript
    • http://www.w3.org/1999/xhtmlReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript
    • http://get.adobe.com/de/reader/Referenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/2.6/In PDF document text
    • http://www.xfa.org/schema/xci/2.8/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.6/In PDF document text
    • http://ns.adobe.com/xtd/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/In PDF document text
    • http://ns.adobe.com/xfdf/In PDF document text
    • http://www.iec.chIn PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • http://crl.verisign.com/tss-ca.crl0In PDF document text
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In PDF document text
    • https://www.verisign.com/rpa01In PDF document text
    • http://crl.verisign.com/pca3.crl0In PDF document text
    • http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0DIn PDF document text
    • http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0In PDF document text
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 23

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0012.bin pdf-embedded-file PDF EmbeddedFile object 12 at offset 0x228E 163 bytes
SHA-256: f212b90dd8d46fcfde4055c595ca334e51d9c315dcbea005dc86468bb12aa257
embedded_file_obj0013.bin pdf-embedded-file PDF EmbeddedFile object 13 at offset 0x237E 2352 bytes
SHA-256: c506e7de2dcb80802eeb8e3e7510be692104b112f6832675fa52ca5588fb5838
embedded_file_obj0014.bin pdf-embedded-file PDF EmbeddedFile object 14 at offset 0x2785 60691 bytes
SHA-256: cbd7701691b8944da79057a977aef7a040784775a1c02beb0e8bc7a6370c454e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
embedded_file_obj0015.bin pdf-embedded-file PDF EmbeddedFile object 15 at offset 0x8254 2920 bytes
SHA-256: ed21c449ec1f230da95997e24740e9ead7fb874c64926ff9a1130dcfe72d193a
embedded_file_obj0016.bin pdf-embedded-file PDF EmbeddedFile object 16 at offset 0x85D1 200 bytes
SHA-256: 48eba206f21018909bc5308626d34dfcb669a58b2cfc1e73e2f00f83f5079f38
embedded_file_obj0017.bin pdf-embedded-file PDF EmbeddedFile object 17 at offset 0x86C9 121 bytes
SHA-256: 90938f9e3cdf6db2eeee31ed7c949f3b0952b799b670df73d2e56d31bfcc8d34
embedded_file_obj0018.bin pdf-embedded-file PDF EmbeddedFile object 18 at offset 0x8787 1704 bytes
SHA-256: 79e4d0ec701dc6d55943165bc094ee646b98265be1ad438c35c2b96a4ab3bf73
embedded_file_obj0019.bin pdf-embedded-file PDF EmbeddedFile object 19 at offset 0x8A88 80 bytes
SHA-256: 2ebdd7efeaa1190ff6bad8cbd649b313e3969564018f204e7385b97c2fab1e19
javascript_obj0039_000.js pdf-javascript-stream PDF /JS object 39 at offset 0x7D9F1 2795 bytes
SHA-256: 826c5622c798d67e5281cca7e05933dddc90ccdcb0a6177c9f7d06f11bef8f7f
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
javascript_obj0040_001.js pdf-javascript-stream PDF /JS object 40 at offset 0x7DCB6 902 bytes
SHA-256: 1b2ec98752b966f601d5223a750559cf13d562ac5e5c6d1fcc7217835b01f5fd
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 8.1)
{
   ADBE.Reader_Need_Version = 8.1;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Reader_Need_Version;
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 8.1)
{
   ADBE.Viewer_Need_Version = 8.1;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Viewer_Need_Version;
}
javascript_obj0041_002.js pdf-javascript-stream PDF /JS object 41 at offset 0x7DE0E 1313 bytes
SHA-256: f94e41f586bf3f20bc1deeac4bfbda388a61db43f25fbd6304ba73f5653368cf
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.6)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 8.0)
         {
            if (app.alert(ADBE.Reader_string_Need_New_Version_Msg, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.6"});
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
		   else if (app.viewerVersion < 8.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
               app.launchURL(ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, true);
         }
         else if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.6"});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
xfa_image_rawvalue_000.tif pdf-xfa-image-tiff XFA image/rawValue TIFF payload near offset 0x9FBB 17350 bytes
SHA-256: ca9594e5acb74fd54230c1f0e6d1ea53619d226882e1be98d1ea6e6bb4a09f48
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.76, consistent with packed or encrypted content.
stream_010_off0000999f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x999F 352198 bytes
SHA-256: 1e8564d3d89047875dccaa98279599de9d7ddf77240906041f1156ba8edf3315
stream_011_off0003af3c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3AF3C 367087 bytes
SHA-256: b8e2518b116c26bab0e9f8c1672daf405dedad561157502b657e9005be2029aa
font_02_sfnt_off0006d754.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6D754 95975 bytes
SHA-256: c29e5b1537bee8c88b3ffca56c5f24a45ec8da374cf9d4c0b4a78d04fc230949
embedded_file_obj0001_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 1 at offset 0xECA; filter decode failed 176 bytes
SHA-256: 52f950605ae04d9d0c1c37deeb0fd63ae16eaacf83734ccd47029e47eefea22a
embedded_file_obj0002_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 2 at offset 0xFD3; filter decode failed 960 bytes
SHA-256: e80ba7cabdcb06966f87419ca34092a9219da4fb1751bf6c20bde7515fd020ff
embedded_file_obj0003_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 3 at offset 0x13EE; filter decode failed 24752 bytes
SHA-256: c2479adab60f947980ecce8e2b0779157670444c6707baf0f56ac000a5282e19
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.99, consistent with packed or encrypted content.
embedded_file_obj0004_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 4 at offset 0x74F7; filter decode failed 832 bytes
SHA-256: fb1fdbff613c09cbee10a3497d281938fb9afcb89eb6e0204f3f739f496f4454
embedded_file_obj0005_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 5 at offset 0x7890; filter decode failed 176 bytes
SHA-256: d4298beb3e9bdf8110e2526133bf97a79a65532db6247aeb00365f00a1e79ee6
embedded_file_obj0006_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 6 at offset 0x7999; filter decode failed 128 bytes
SHA-256: 26d724033fb8bfefa06fff3a6e786ebdb3ac7da2100401eb2c308b8f276cda4d
embedded_file_obj0007_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 7 at offset 0x7A72; filter decode failed 704 bytes
SHA-256: 6d656b957adcedd5870b8ca68bdaef547636342a7ec937ee99bd1726aa0c824e
embedded_file_obj0008_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 8 at offset 0x7D8B; filter decode failed 112 bytes
SHA-256: ee116ef9825f93518d7a27faa45b5634279e232dd523043ed7fdaaa57b2510d8

Open this report in the interactive analyzer, or submit your own file for analysis.