Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ebd5c874098c0fb…

MALICIOUS

PDF

593.8 KB Created: lìW~’8· åÊ7˜|ÿ÷Ež.¢„øˆ Authoring application: ‹iÝÞ½„àó (via i² ,Æ)ÊU¢žvzÈ(®ã,ËiìÓ¦Ê Åq) First seen: 2026-05-09
MD5: 9e1ca9ca456d5358a184702c30a730e7 SHA-1: 097768ec2bf7adb16b3d9502b5f04cb945714a59 SHA-256: 6ebd5c874098c0fbce3c9885f845f2ba43b3564bb4a7ce05c1aafa5d0f95f8fa
244 Risk Score

🔏 Digital signature Modified after signing

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains JavaScript that displays fake update prompts for Adobe Reader or Acrobat, directing the user to download a malicious file from 'http://cgi.adobe.com/special/acrobat/update'. The document body and heuristics indicate a scam related to passport applications, likely a lure to encourage the user to proceed with the fake update. The PDF is also signed but modified post-signature, and contains embedded files, suggesting an attempt to bypass security measures.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8763

Heuristics 13

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Travel-support phone-number stuffing scam high SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Active content added after the PDF was signed medium PDF_SIGNATURE_POST_SIGN_MODIFICATION
    An incremental update appended AFTER the signed byte range introduces active content (/EmbeddedFile). Some of this can occur in legitimate form-fill (field scripts, a rewritten /Catalog), so it is suspicious rather than damning — but it is content the signer did not approve.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.passportcanada.gc.ca Referenced by PDF JavaScript
    • http://www.travel.gc.caReferenced by PDF JavaScript
    • http://www.cic.gc.caReferenced by PDF JavaScript
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.5/Referenced by PDF JavaScript
    • http://www.w3.org/1999/xhtmlReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript
    • http://www.w3.org/2001/XMLSchema-instanceReferenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In extracted file (embedded_file_obj0022.bin)
    • http://www.xfa.org/schema/xci/1.0/In extracted file (embedded_file_obj0023.bin)
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In extracted file (embedded_file_obj0025.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In extracted file (embedded_file_obj0027.bin)
    • http://purl.org/dc/elements/1.1/In extracted file (embedded_file_obj0027.bin)
    • http://ns.adobe.com/pdf/1.3/In extracted file (embedded_file_obj0027.bin)
    • http://ns.adobe.com/xap/1.0/In extracted file (embedded_file_obj0027.bin)
    • http://ns.adobe.com/xap/1.0/mm/In extracted file (embedded_file_obj0027.bin)
    • http://ns.adobe.com/xfdf/In extracted file (embedded_file_obj0028.bin)
    • http://ns.adobe.com/xtd/In extracted file (embedded_file_obj0029.bin)
    • http://www.xfa.org/schema/xfa-form/2.8/In extracted file (embedded_file_obj0030.bin)

Extracted artifacts 25

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0022.bin pdf-embedded-file PDF EmbeddedFile object 22 at offset 0x3B96 85 bytes
SHA-256: c06dcd026a7ea0536b63e07ce688691b585339a3ab7ff59065e546b56308c7bb
embedded_file_obj0023.bin pdf-embedded-file PDF EmbeddedFile object 23 at offset 0x3C4A 3343 bytes
SHA-256: 08f477eb081f262c637b72fefc09878d8a0fb79df9b5f2f3f71ed0ab863122ea
embedded_file_obj0024.bin pdf-embedded-file PDF EmbeddedFile object 24 at offset 0x413D 1074989 bytes
SHA-256: 41c33c2110b26b9cc41adba871de7a860a7aefc351021c4e16a69793646641e6
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 85 eval/decoder/string-building token(s). Carved artifact contains 4 long base64-like blob(s).
embedded_file_obj0025.bin pdf-embedded-file PDF EmbeddedFile object 25 at offset 0x2AE2C 7125 bytes
SHA-256: 8ca41e7a63829b1b1469cbc51b17e14ea3b30b405715f48a33bc525c639acf02
embedded_file_obj0026.bin pdf-embedded-file PDF EmbeddedFile object 26 at offset 0x2B275 5374 bytes
SHA-256: 4af863b4dd8f744bccda25894e98ad1e02508eb126d2d17cb38f4c9dc3c9c6e6
embedded_file_obj0027.bin pdf-embedded-file PDF EmbeddedFile object 27 at offset 0x2B778 799 bytes
SHA-256: f01fb718d292a662ec40a55c746bd30c760bdaac97a3e5112bb9dedba7f1f33a
embedded_file_obj0028.bin pdf-embedded-file PDF EmbeddedFile object 28 at offset 0x2B987 110 bytes
SHA-256: b1b296d371e691ae903fc90e2f3bd69eeac3730137d7c7f5d9379aed02cb51d6
embedded_file_obj0029.bin pdf-embedded-file PDF EmbeddedFile object 29 at offset 0x2BA36 214 bytes
SHA-256: 0796cb78318af629d0ec59a294644666f2996ec7d0eb2a9583645b1d6126e4da
embedded_file_obj0030.bin pdf-embedded-file PDF EmbeddedFile object 30 at offset 0x2BB36 30176 bytes
SHA-256: d8eb6589b2920aa924f5b7fb44d57a0cf7553f3c791d3b2f06b5421986470463
javascript_obj0166_000.js pdf-javascript-stream PDF /JS object 166 at offset 0x47B7D 2798 bytes
SHA-256: 922f7942d25f53e6e6eedc1b3a95c47a757faab3be4838fa02db0dbea2c4dbcc
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
javascript_obj0167_001.js pdf-javascript-stream PDF /JS object 167 at offset 0x47E45 870 bytes
SHA-256: 4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 7.0)
{
   ADBE.Reader_Need_Version = 7.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 7.0)
{
   ADBE.Viewer_Need_Version = 7.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
javascript_obj0168_002.js pdf-javascript-stream PDF /JS object 168 at offset 0x47F9E 1535 bytes
SHA-256: 04ceb4c2218e7db19a6e007ca4ce846f92c17fff5eaf3a611e71bbd7a5726917
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.1)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 6.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_5x, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.viewerVersion < 7.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
               app.findComponent({cType:"App", cName:"Reader7", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
               app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
         else if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
javascript_obj-001_003.js pdf-javascript-stream PDF /JS object -1 at offset 0x413D 524288 bytes
SHA-256: 2a4a5cf599d1ea852ef9617ef267a5513dcc9a77f3b3567cf9b64f660c5a9c21
Preview script
First 1,000 lines of the extracted script
<template xmlns="http://www.xfa.org/schema/xfa-template/2.5/"
><?formServer allowRenderCaching 0?><?formServer formModel client?><subform layout="tb" locale="en_CA" name="Form"
><pageSet
><pageArea id="Page1" name="Page1"
><contentArea h="756pt" w="576pt" x="0.25in" y="0.25in"
></contentArea
><medium long="792pt" short="612pt" stock="letter"
></medium
><?templateDesigner expand 1?></pageArea
><?templateDesigner expand 1?></pageSet
><subform h="266.6312mm" locale="en_CA" name="InstructionsPage1" w="203.2mm"
><draw h="12.7mm" locale="en_CA" minW="136.8242mm" name="Title" x="26.8514mm"
><ui
><textEdit
></textEdit
></ui
><value
><exData contentType="text/html"
><body xmlns="http://www.w3.org/1999/xhtml" xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/" xfa:APIVersion="2.5.6290.0"
><p style="line-height:20pt;font-size:20pt"
>ADULT<span style="font-size:14pt"
> GENERAL PASSPORT APPLICATION</span
></p
><p style="font-size:12pt"
>for Canadians 16 years of age or over applying in Canada or from the USA</p
></body
></exData
></value
><font typeface="Arial" weight="bold"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><para hAlign="center"
></para
><assist
><speak priority="caption"
></speak
></assist
><traversal
><traverse ref="SubTitle[0]"
></traverse
></traversal
></draw
><draw h="4.5833mm" locale="en_CA" name="SubTitle" w="130.175mm" x="38.1mm" y="12.7mm"
><ui
><textEdit
></textEdit
></ui
><value
><text
>GENERAL INFORMATION</text
></value
><font size="12pt" typeface="Arial" weight="bold"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><para hAlign="center" lineHeight="14pt"
></para
><assist
><speak priority="caption"
></speak
></assist
><traversal
><traverse ref="OtherLanguage[0]"
></traverse
></traversal
><?renderCache.bounds 369000 12992 0 0 0 0 0 0?><?renderCache.textRun 19 GENERAL INFORMATION 0 111170 9475 0 0 0 "Arial" 1 0 12000 ISO-8859-1?></draw
><draw h="0.111111in" locale="fr_CA" name="OtherLanguage" w="1.761028in" x="79.235mm" y="16.7099mm"
><ui
><textEdit
></textEdit
></ui
><value
><text
>Aussi disponible en français</text
></value
><font size="8pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><para hAlign="center"
></para
><assist
><speak priority="caption"
></speak
></assist
><traversal
><traverse ref="Failure[0]"
></traverse
></traversal
><?renderCache.bounds 126794 8000 0 0 0 0 0 0?><?renderCache.textRun 29 Aussi disponible en français 0 13813 6316 0 0 0 "Arial" 0 0 8000 ISO-8859-1?></draw
><draw h="3.175mm" locale="en_CA" name="Failure" w="6.054389in" x="24.709mm" y="19.4263mm"
><ui
><textEdit
></textEdit
></ui
><value
><text
>Failure to complete all the required sections of this form will result in your application being refused.</text
></value
><font size="9pt" typeface="Arial" weight="bold"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><para hAlign="center"
></para
><assist
><speak priority="caption"
></speak
></assist
><traversal
><traverse ref="EntitlementtoACanadianPassport[0].Section[0].ID[0]"
></traverse
></traversal
><?renderCache.bounds 435916 9000 0 0 0 0 0 0?><?renderCache.textRun 105 Failure to complete all the required sections of this form will result in your application being refused. 0 2422 7106 0 0 0 "Arial" 1 0 9000 ISO-8859-1?></draw
><subform h="51.9554mm" locale="en_CA" name="EntitlementtoACanadianPassport" w="96.975mm" x="3.175mm" y="23.7581mm"
><draw h="0.236222in" locale="en_CA" name="Title" w="96.975mm" y="0.0004mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><value
><text
>Entitlement to a Canadian Passport</text
></value
><font baselineShift="0pt" posture="italic" size="11pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="1mm" rightInset="1mm" topInset="0mm"
></margin
><border
><edge
></edge
><corner thickness="0.176mm"
></corner
><fill
></fill
></border
><para hAlign="center" marginLeft="0pt" marginRight="0pt" spaceAbove="0pt" spaceBelow="0pt" textIndent="0pt" vAlign="middle"
></para
><traversal
><traverse ref="EntitlementtoACanadianPassport[0].StaticText66[0]"
></traverse
></traversal
><assist
><speak priority="caption"
></speak
></assist
><?renderCache.bounds 269220 17008 0 0 2835 0 0 0?><?renderCache.textRun 34 Entitlement to a Canadian Passport 0 50922 11721 0 0 0 "Arial" 0 1 11000 ISO-8859-1?></draw
><subform h="0.236222in" locale="en_CA" name="Section" w="0.236222in" x="3mm"
><draw h="6mm" locale="en_CA" name="Circle" w="6mm"
><value
><arc hand="right"
><edge
></edge
><fill
></fill
></arc
></value
><para hAlign="center" vAlign="middle"
></para
><ui
><defaultUi
></defaultUi
></ui
></draw
><draw h="0.200792in" locale="en_CA" name="ID" w="0.15125in" x="1.0792mm" y="0.9mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><value
><text
>A</text
></value
><font baselineShift="0pt" size="14pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><para hAlign="center" spaceAbove="0pt" vAlign="middle"
></para
><assist
><speak priority="caption"
></speak
></assist
><traversal
><traverse ref="EntitlementtoACanadianPassport[0].Title[0]"
></traverse
></traversal
><?renderCache.bounds 10890 14457 0 0 0 0 0 0?><?renderCache.textRun 1 A 0 776 11282 0 0 0 "Arial" 0 0 14000 ISO-8859-1?></draw
><?templateDesigner expand 1?></subform
><draw h="0.75mm" locale="en_CA" name="Circle11" w="0.75mm" x="2.8751mm" y="7.7908mm"
><value
><arc hand="right"
><fill
><color value="0,0,0"
></color
></fill
><edge
></edge
></arc
></value
><para hAlign="center" vAlign="middle"
></para
><ui
><defaultUi
></defaultUi
></ui
></draw
><draw h="0.430903in" locale="en_CA" name="StaticText66" w="3.489486in" x="4.7756mm" y="6.9608mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><value
><exData contentType="text/html"
><body xmlns="http://www.w3.org/1999/xhtml" xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/" xfa:APIVersion="2.5.6290.0"
><p
>A Canadian passport is the only reliable and universally</p
><p
>accepted travel and identification document for Canadians</p
><p
>who travel abroad.</p
></body
></exData
></value
><font size="9pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><traversal
><traverse ref="EntitlementtoACanadianPassport[0].StaticText66[1]"
></traverse
></traversal
><assist
><speak priority="caption"
></speak
></assist
><?renderCache.bounds 251243 31025 0 0 0 0 0 0?><?renderCache.textRun 57 A Canadian passport is the only reliable and universally  0 0 7106 0 0 0 "Arial" 0 0 9000 ISO-8859-1?><?renderCache.textRun 58 accepted travel and identification document for Canadians  0 0 17906 0 0 0 "Arial" 0 0 9000 ISO-8859-1?><?renderCache.textRun 18 who travel abroad. 0 0 28706 0 0 0 "Arial" 0 0 9000 ISO-8859-1?></draw
><draw h="0.75mm" locale="en_CA" name="Circle11" w="0.75mm" x="2.875mm" y="19.7955mm"
><value
><arc hand="right"
><fill
><color value="0,0,0"
></color
></fill
><edge
></edge
></arc
></value
><para hAlign="center" vAlign="middle"
></para
><ui
><defaultUi
></defaultUi
></ui
></draw
><draw h="10.795mm" locale="en_CA" name="StaticText66" w="3.501458in" x="4.6002mm" y="18.9653mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><value
><text
>Issued to Canadian citizens only, a Canadian passport reflects the identity of the applicant as determined by documentary evidence of citizenship and documents to support identity.</text
></value
><font size="9pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><traversal
><traverse ref="EntitlementtoACanadianPassport[0].StaticText67[0]"
></traverse
></traversal
><assist
><speak priority="caption"
></speak
></assist
><?renderCache.bounds 252105 30600 0 0 0 0 0 0?><?renderCache.textRun 63 Issued to Canadian citizens only, a Canadian passport reflects  0 0 7106 0 0 0 "Arial" 0 0 9000 ISO-8859-1?><?renderCache.textRun 59 the identity of the applicant as determined by documentary  0 0 17906 0 0 0 "Arial" 0 0 9000 ISO-8859-1?><?renderCache.textRun 58 evidence of citizenship and documents to support identity. 0 0 28706 0 0 0 "Arial" 0 0 9000 ISO-8859-1?></draw
><draw h="0.75mm" locale="en_CA" name="Circle11" w="0.75mm" x="2.875mm" y="31.6501mm"
><value
><arc hand="right"
><fill
><color value="0,0,0"
></color
></fill
><edge
></edge
></arc
></value
><para hAlign="center" vAlign="middle"
></para
><ui
><defaultUi
></defaultUi
></ui
></draw
><draw h="7.7805mm" locale="en_CA" name="StaticText67" w="3.638847in" x="4.5999mm" y="30.8201mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><value
><exData contentType="text/html"
><body xmlns="http://www.w3.org/1999/xhtml" xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/" xfa:APIVersion="2.5.6290.0"
><p
>Children under 16 years of age must have an individual passport.</p
><p
>Use form PPTC 155,<span style="xfa-spacerun:yes"
> </span
><span style="font-style:italic"
>Child General Passport Application</span
>.</p
></body
></exData
></value
><font size="9pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><traversal
><traverse ref="EntitlementtoACanadianPassport[0].StaticText68[0]"
></traverse
></traversal
><assist
><speak priority="caption"
></speak
></assist
><?renderCache.bounds 261997 22055 0 0 0 0 0 0?><?renderCache.textRun 65 Children under 16 years of age must have an individual passport.  0 0 7106 0 0 0 "Arial" 0 0 9000 ISO-8859-1?><?renderCache.textRun 19 Use form PPTC 155,  0 0 17932 0 0 0 "Arial" 0 0 9000 ISO-8859-1?><?renderCache.textRun 34 Child General Passport Application 0 85526 17932 0 0 0 "Arial" 0 1 9000 ISO-8859-1?><?renderCache.textRun 1 . 0 225101 17932 0 0 0 "Arial" 0 0 9000 ISO-8859-1?></draw
><draw h="0.75mm" locale="en_CA" name="Circle11" w="0.75mm" x="2.875mm" y="40.4905mm"
><value
><arc hand="right"
><fill
><color value="0,0,0"
></color
></fill
><edge
></edge
></arc
></value
><para hAlign="center" vAlign="middle"
></para
><ui
><defaultUi
></defaultUi
></ui
></draw
><draw locale="en_CA" name="StaticText68" w="3.487111in" x="4.5999mm" y="39.6602mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><value
><text
>The bearer of a previous Canadian passport may be eligible to apply for a passport through the simplified renewal application process. Consult our website at www.passportcanada.gc.ca.</text
></value
><font baselineShift="0pt" size="9pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><assist
><speak priority="caption"
></speak
></assist
><para marginLeft="0pt" marginRight="0pt" spaceAbove="0pt" spaceBelow="0pt" textIndent="0pt"
></para
><traversal
><traverse ref="EntitlementtoACanadianPassport[0].hideURL[0]"
></traverse
></traversal
></draw
><field h="3.822mm" locale="en_CA" name="hideURL" w="39mm" x="49.5752mm" y="46.6334mm"
><?templateDesigner isResetFieldsObject true?><ui
><button highlight="none"
></button
></ui
><font typeface="Myriad Pro"
></font
><border hand="right"
><edge presence="hidden"
></edge
></border
><bind match="none"
></bind
><traversal
><traverse ref="RequirementsChecklist[0].Section[0].ID[0]"
></traverse
></traversal
><assist
><speak priority="toolTip"
></speak
><toolTip
>www.passportcanada.gc.ca</toolTip
></assist
><event activity="click"
><script contentType="application/x-javascript"
>// links become active when forms are Reader Extended
// this button covers the entire link and when clicked, forces the browser/application to open the link in a new window (thus preventing content from being lost)
app.launchURL("http://www.passportcanada.gc.ca", true);</script
></event
></field
><border
><edge
></edge
><corner join="round" radius="2mm" thickness="0.176mm"
></corner
></border
><margin bottomInset="1.5mm"
></margin
><?templateDesigner expand 1?></subform
><subform h="63.6768mm" locale="en_CA" name="RequirementsChecklist" w="96.975mm" x="3.175mm" y="76.8703mm"
><draw h="0.236222in" locale="en_CA" name="Title" w="96.975mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><value
><text
>Requirements Checklist</text
></value
><font posture="italic" size="11pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="1mm" rightInset="1mm" topInset="0mm"
></margin
><para hAlign="center" vAlign="middle"
></para
><border
><edge
></edge
><corner thickness="0.176mm"
></corner
><fill
></fill
></border
><traversal
><traverse ref="RequirementsChecklist[0].StaticText75[0]"
></traverse
></traversal
><assist
><speak priority="caption"
></speak
></assist
><?renderCache.bounds 269220 17008 0 0 2835 0 0 0?><?renderCache.textRun 22 Requirements Checklist 0 79367 11721 0 0 0 "Arial" 0 1 11000 ISO-8859-1?></draw
><subform h="0.236222in" locale="en_CA" name="Section" w="0.236222in" x="3mm"
><draw h="6mm" locale="en_CA" name="Circle" w="6mm"
><value
><arc hand="right"
><edge
></edge
></arc
></value
><para hAlign="center" vAlign="middle"
></para
><ui
><defaultUi
></defaultUi
></ui
></draw
><draw h="0.200792in" locale="en_CA" name="ID" w="0.15125in" x="1.0792mm" y="0.9mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><value
><text
>B</text
></value
><font baselineShift="0pt" size="14pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><para hAlign="center" spaceAbove="0pt" vAlign="middle"
></para
><assist
><speak priority="caption"
></speak
></assist
><traversal
><traverse ref="RequirementsChecklist[0].Title[0]"
></traverse
></traversal
><?renderCache.bounds 10890 14457 0 0 0 0 0 0?><?renderCache.textRun 1 B 0 776 11282 0 0 0 "Arial" 0 0 14000 ISO-8859-1?></draw
><?templateDesigner expand 1?></subform
><draw h="2mm" locale="en_CA" name="Rectangle1" w="2mm" x="3mm" y="8.275mm"
><value
><rectangle
><edge
></edge
></rectangle
></value
></draw
><draw h="7.082mm" locale="en_CA" name="StaticText75" w="88.2498mm" x="7.0002mm" y="7.7001mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><value
><exData contentType="text/html" maxLength="0"
><body xmlns="http://www.w3.org/1999/xhtml" xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/" xfa:APIVersion="2.5.6290.0"
><p
>All<span style="xfa-spacerun:yes"
> </span
><span style="font-weight:bold"
>three (3)</span
> pages of the application form completed</p
><p
>and signed within the last 12 months.</p
></body
></exData
></value
><font baselineShift="0pt" size="8pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><traversal
><traverse ref="RequirementsChecklist[0].StaticText76[0]"
></traverse
></traversal
><para marginLeft="0pt" marginRight="0pt" spaceAbove="0pt" spaceBelow="0pt" textIndent="0pt" vAlign="middle"
></para
><assist
><speak priority="caption"
></speak
></assist
><?renderCache.bounds 250157 20075 0 0 0 0 0 0?><?renderCache.textRun 4 All  0 0 7553 0 0 0 "Arial" 0 0 8000 ISO-8859-1?><?renderCache.textRun 9 three (3) 0 11113 7553 0 0 0 "Arial" 1 0 8000 ISO-8859-1?><?renderCache.textRun 41  pages of the application form completed  0 42676 7553 0 0 0 "Arial" 0 0 8000 ISO-8859-1?><?renderCache.textRun 37 and signed within the last 12 months. 0 0 17153 0 0 0 "Arial" 0 0 8000 ISO-8859-1?></draw
><draw h="2mm" locale="en_CA" name="Rectangle1" w="2mm" x="3mm" y="15.817mm"
><value
><rectangle
><edge
></edge
></rectangle
></value
><ui
><defaultUi
></defaultUi
></ui
></draw
><draw h="4.6429mm" locale="en_CA" name="StaticText76" w="88.2498mm" x="7.0002mm" y="15.2421mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><value
><exData contentType="text/html" maxLength="0"
><body xmlns="http://www.w3.org/1999/xhtml" xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/" xfa:APIVersion="2.5.6290.0"
><p style="font-weight:bold;text-decoration:none"
>Two (2)<span style="font-weight:normal"
> identical passport photos taken within the last 12 months.</span
></p
></body
></exData
></value
><font size="8pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><traversal
><traverse ref="RequirementsChecklist[0].StaticText78[0]"
></traverse
></traversal
><para vAlign="middle"
></para
><assist
><speak priority="caption"
></speak
></assist
><?renderCache.bounds 250157 13161 0 0 0 0 0 0?><?renderCache.textRun 7 Two (2) 0 0 8896 0 0 0 "Arial" 1 0 8000 ISO-8859-1?><?renderCache.textRun 59  identical passport photos taken within the last 12 months. 0 27996 8896 0 0 0 "Arial" 0 0 8000 ISO-8859-1?></draw
><draw h="2mm" locale="en_CA" name="Rectangle1" w="2mm" x="3mm" y="21.035mm"
><value
><rectangle
><edge
></edge
></rectangle
></value
><ui
><defaultUi
></defaultUi
></ui
></draw
><draw h="3.8798mm" locale="en_CA" name="StaticText78" w="3.474403in" x="7.0002mm" y="20.5001mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><value
><text
>Application form and one of the photos certified by your guarantor.</text
></value
><font size="8pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><traversal
><traverse ref="RequirementsChecklist[0].StaticText260[0]"
></traverse
></traversal
><para vAlign="middle"
></para
><assist
><speak priority="caption"
></speak
></assist
><?renderCache.bounds 250157 10998 0 0 0 0 0 0?><?renderCache.textRun 67 Application form and one of the photos certified by your guarantor. 0 0 7815 0 0 0 "Arial" 0 0 8000 ISO-8859-1?></draw
><draw h="2mm" locale="en_CA" name="Rectangle1" w="2mm" x="3mm" y="25.3512mm"
><value
><rectangle
><edge
></edge
></rectangle
></value
><ui
><defaultUi
></defaultUi
></ui
></draw
><draw h="0.126736in" locale="en_CA" name="StaticText260" w="3.405083in" x="7.0002mm" y="24.8662mm"
><ui
><textEdit
></textEdit
></ui
><value
><text
>Proof of Canadian citizenship (original only).</text
></value
><font size="8pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><assist
><speak priority="caption"
></speak
></assist
><traversal
><traverse ref="RequirementsChecklist[0].StaticText261[0]"
></traverse
></traversal
><?renderCache.bounds 245166 9125 0 0 0 0 0 0?><?renderCache.textRun 46 Proof of Canadian citizenship (original only). 0 0 6316 0 0 0 "Arial" 0 0 8000 ISO-8859-1?></draw
><draw h="2mm" locale="en_CA" name="Rectangle1" w="2mm" x="3mm" y="29.0303mm"
><value
><rectangle
><edge
></edge
></rectangle
></value
><ui
><defaultUi
></defaultUi
></ui
></draw
><draw h="0.126736in" locale="en_CA" name="StaticText261" w="3.385833in" x="7.0002mm" y="28.5452mm"
><ui
><textEdit
></textEdit
></ui
><value
><text
>Documents to support identity.</text
></value
><font size="8pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><assist
><speak priority="caption"
></speak
></assist
><traversal
><traverse ref="RequirementsChecklist[0].StaticText262[0]"
></traverse
></traversal
><?renderCache.bounds 243780 9125 0 0 0 0 0 0?><?renderCache.textRun 30 Documents to support identity. 0 0 6316 0 0 0 "Arial" 0 0 8000 ISO-8859-1?></draw
><draw h="2mm" locale="en_CA" name="Rectangle1" w="2mm" x="3mm" y="32.8792mm"
><value
><rectangle
><edge
></edge
></rectangle
></value
><ui
><defaultUi
></defaultUi
></ui
></draw
><draw locale="en_CA" name="StaticText262" w="89.96mm" x="7.0002mm" y="32.3941mm"
><ui
><textEdit
></textEdit
></ui
><value
><exData contentType="text/html"
><body xmlns="http://www.w3.org/1999/xhtml" xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/" xfa:APIVersion="2.5.6290.0"
><p
>Any Canadian passport or travel document issued to you within the</p
><p
>last<span style="xfa-spacerun:yes"
> </span
><span style="font-weight:bold"
>five (5)</span
> years.</p
></body
></exData
></value
><font size="8pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><assist
><speak priority="caption"
></speak
></assist
><traversal
><traverse ref="RequirementsChecklist[0].StaticText79[0]"
></traverse
></traversal
></draw
><draw h="2mm" locale="en_CA" name="Rectangle1" w="2mm" x="3mm" y="40.6812mm"
><value
><rectangle
><edge
></edge
></rectangle
></value
><ui
><defaultUi
></defaultUi
></ui
></draw
><draw h="3.9306mm" locale="en_CA" name="StaticText79" w="3.385833in" x="7.0002mm" y="40.1962mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><value
><text
>The fees.</text
></value
><font size="8pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><traversal
><traverse ref="RequirementsChecklist[0].StaticText79[1]"
></traverse
></traversal
><para lineHeight="9.125pt" vAlign="middle"
></para
><assist
><speak priority="caption"
></speak
></assist
><?renderCache.bounds 243780 11142 0 0 0 0 0 0?><?renderCache.textRun 9 The fees. 0 0 8124 0 0 0 "Arial" 0 0 8000 ISO-8859-1?></draw
><draw h="2mm" locale="en_CA" name="Rectangle1" w="2mm" x="3.0819mm" y="45.6166mm"
><value
><rectangle
><edge
></edge
></rectangle
></value
><ui
><defaultUi
></defaultUi
></ui
></draw
><draw h="0.377778in" locale="en_CA" name="StaticText79" w="3.385833in" x="6.985mm" y="44.7498mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><value
><exData contentType="text/html"
><body xmlns="http://www.w3.org/1999/xhtml" xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/" xfa:APIVersion="2.5.6290.0"
><p style="font-family:Arial;text-decoration:none"
>All documents submitted throughout the passport application</p
><p style="font-family:Arial;text-decoration:none"
>process that are written in a language other than English or French</p
><p style="font-family:Arial;text-decoration:none"
>must be translated by a certified translator.</p
></body
></exData
></value
><font baselineShift="0pt" size="8pt"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><traversal
><traverse ref="RequirementsChecklist[0].StaticText80[0]"
></traverse
></traversal
><para marginLeft="0pt" marginRight="0pt" spaceAbove="0pt" spaceBelow="0pt" textIndent="0pt"
></para
><assist
><speak priority="caption"
></speak
></assist
><?renderCache.bounds 243780 27200 0 0 0 0 0 0?><?renderCache.textRun 60 All documents submitted throughout the passport application  0 0 6316 0 0 0 "Arial" 0 0 8000 ISO-8859-1?><?renderCache.textRun 68 process that are written in a language other than English or French  0 0 15916 0 0 0 "Arial" 0 0 8000 ISO-8859-1?><?renderCache.textRun 45 must be translated by a certified translator. 0 0 25516 0 0 0 "Arial" 0 0 8000 ISO-8859-1?></draw
><draw h="0.278819in" locale="en_CA" name="StaticText80" w="90.6773mm" x="3.0801mm" y="54.9871mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><value
><text
>Additional documents or information may be requested in support of this application.</text
></value
><font size="8pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><traversal
><traverse ref="ProcessingTimes[0].Section[0].ID[0]"
></traverse
></traversal
><para vAlign="middle"
></para
><assist
><speak priority="caption"
></speak
></assist
><?renderCache.bounds 257038 20075 0 0 0 0 0 0?><?renderCache.textRun 72 Additional documents or information may be requested in support of this  0 0 7553 0 0 0 "Arial" 0 0 8000 ISO-8859-1?><?renderCache.textRun 12 application. 0 0 17153 0 0 0 "Arial" 0 0 8000 ISO-8859-1?></draw
><border
><edge
></edge
><corner join="round" radius="2mm" thickness="0.176mm"
></corner
></border
><margin bottomInset="1.5mm"
></margin
><?templateDesigner expand 1?></subform
><subform h="19.6529mm" locale="en_CA" name="ProcessingTimes" w="96.975mm" x="3.175mm" y="141.7038mm"
><draw h="0.236222in" locale="en_CA" name="Title" w="96.975mm" y="0mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><value
><text
>Processing Times</text
></value
><font baselineShift="0pt" posture="italic" size="11pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="1mm" rightInset="1mm" topInset="0mm"
></margin
><para hAlign="center" marginLeft="0pt" marginRight="0pt" spaceAbove="0pt" spaceBelow="0pt" textIndent="0pt" vAlign="middle"
></para
><border
><edge
></edge
><corner thickness="0.176mm"
></corner
><fill
></fill
></border
><traversal
><traverse ref="ProcessingTimes[0].StaticText102[0]"
></traverse
></traversal
><assist
><speak priority="caption"
></speak
></assist
><?renderCache.bounds 269220 17008 0 0 2835 0 0 0?><?renderCache.textRun 16 Processing Times 0 93738 11721 0 0 0 "Arial" 0 1 11000 ISO-8859-1?></draw
><subform h="0.236222in" locale="en_CA" name="Section" w="0.236222in" x="3mm" y="0.0004mm"
><draw h="6mm" locale="en_CA" name="Circle" w="6mm"
><value
><arc hand="right"
><edge
></edge
></arc
></value
><para hAlign="center" vAlign="middle"
></para
><ui
><defaultUi
></defaultUi
></ui
></draw
><draw h="0.200792in" locale="en_CA" name="ID" w="0.15125in" x="1.0792mm" y="0.9mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><value
><text
>C</text
></value
><font baselineShift="0pt" size="14pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><para hAlign="center" spaceAbove="0pt" vAlign="middle"
></para
><assist
><speak priority="caption"
></speak
></assist
><traversal
><traverse ref="ProcessingTimes[0].Title[0]"
></traverse
></traversal
><?renderCache.bounds 10890 14457 0 0 0 0 0 0?><?renderCache.textRun 1 C 0 390 11282 0 0 0 "Arial" 0 0 14000 ISO-8859-1?></draw
><?templateDesigner expand 1?></subform
><draw h="11.4529mm" locale="en_CA" name="StaticText102" w="3.593278in" x="2.0997mm" y="6.7mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><value
><exData contentType="text/html" maxLength="0"
><body xmlns="http://www.w3.org/1999/xhtml" xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/" xfa:APIVersion="2.5.6290.0"
><p style="text-decoration:none"
>For information on current processing times, visit our<span style="xfa-spacerun:yes"
> </span
></p
><p style="text-decoration:none"
>website at www.passportcanada.gc.ca or contact us by phone</p
><p style="text-decoration:none"
>(see section H).</p
></body
></exData
></value
><font baselineShift="0pt" size="9pt" typeface="Arial"
></font
><margin bottomInset="0mm" leftInset="0mm" rightInset="0mm" topInset="0mm"
></margin
><traversal
><traverse ref="ProcessingTimes[0].hideURL[0]"
></traverse
></traversal
><assist
><speak priority="caption"
></speak
></assist
><para marginLeft="0pt" marginRight="0pt" spaceAbove="0pt" spaceBelow="0pt" textIndent="0pt"
></para
><?renderCache.bounds 258716 32465 0 0 0 0 0 0?><?renderCache.textRun 56 For information on current processing times, visit our   0 0 7106 0 0 0 "Arial" 0 0 9000 ISO-8859-1?><?renderCache.textRun 59 website at www.passportcanada.gc.ca or contact us by phone  0 0 17906 0 0 0 "Arial" 0 0 9000 ISO-8859-1?><?renderCache.textRun 16 (see section H). 0 0 28706 0 0 0 "Arial" 0 0 9000 ISO-8859-1?></draw
><border
><edge
></edge
><corner join="round" radius="2mm" thickness="0.176mm"
></corner
></border
><margin bottomInset="1.5mm"
></margin
><field h="3.822mm" locale="en_CA" name="hideURL" w="39mm" x="17.1749mm" y="10.1635mm"
><?templateDesigner isResetFieldsObject true?><ui
><button highlight="none"
></button
></ui
><font typeface="Myriad Pro"
></font
><border hand="right"
><edge presence="hidden"
></edge
></border
><bind match="none"
></bind
><traversal
><traverse ref="ApplyingInPerson[0].Section[0].ID[0]"
></traverse
></traversal
><assist
><speak priority="toolTip"
></speak
><toolTip
>www.passportcanada.gc.ca</toolTip
></assist
><event activity="click"
…
xfa_image_rawvalue_000.tif pdf-xfa-image-tiff XFA image/rawValue TIFF payload near offset 0x1C41D 4516 bytes
SHA-256: 885d94abc364f92820dc4ceaa613135a17a2d58102daf32ccca532c25b875fd4
xfa_image_rawvalue_001.tif pdf-xfa-image-tiff XFA image/rawValue TIFF payload near offset 0x1DDF0 2923 bytes
SHA-256: 63565274e03c5a2c507f7833ed49576ab76751cf857c7cb4733e3777bab151fc
xfa_image_rawvalue_002.tif pdf-xfa-image-tiff XFA image/rawValue TIFF payload near offset 0x5EA84 394 bytes
SHA-256: d589070265d0ff0743a44d477272981d0624cb4414e7f9362ff488b436d2415f
xfa_image_rawvalue_003.tif pdf-xfa-image-tiff XFA image/rawValue TIFF payload near offset 0x8B3F5 2902 bytes
SHA-256: c4930b7050e70e2da874cfad7223567ef4e89e78a4e07a02a20a37e1e538f25f
embedded_file_obj0366_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 366 at offset 0x343B7; filter decode failed 89 bytes
SHA-256: 9870ecafa9fb7c6da9ba704293b3bbd491431fd1db79f3c4a0a653f118a2a034
embedded_file_obj0367_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 367 at offset 0x3446C; filter decode failed 1174 bytes
SHA-256: 5cc9f4389576731d044b6b29bc4f49b09508c33b94d94a70445caf908509eb85
embedded_file_obj0368_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 368 at offset 0x34960; filter decode failed 228484 bytes
SHA-256: c92643722532c8d1f99ca995a96802bdd23eb616186de11e665d5c9993fb104d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 8.00, consistent with packed or encrypted content.
embedded_file_obj0369_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 369 at offset 0x6C640; filter decode failed 1006 bytes
SHA-256: 84a3ec83a0a8dd1ad27842f2207df7035e1e16f71df2215a34b4c20b769b2e4b
embedded_file_obj0370_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 370 at offset 0x6CA8A; filter decode failed 1409 bytes
SHA-256: 1b10c834154ecbf3f0bba739aabc41c79a1f59a6ca557bca93bf1ec96b544adf
embedded_file_obj0371_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 371 at offset 0x6D066; filter decode failed 439 bytes
SHA-256: b1d30a8fcc58ca25392248ff632a96195e1005c392adf4b2ed7bb4aa547b8011
embedded_file_obj0372_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 372 at offset 0x6D277; filter decode failed 86 bytes
SHA-256: 102705f712edc6bde53bd75f6ef1810dfac3021b7ccc2336bcaf7630035ea664
embedded_file_obj0373_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 373 at offset 0x6D328; filter decode failed 166 bytes
SHA-256: cd95f29429095ab7fee211c0d94b29b223c6a9adfe91a18e197ee7f364eb7271