PDF static analysis report

Static analysis result for SHA-256 6f0170608cfe7f4e…

SUSPICIOUS

PDF

162.8 KB First seen: 2026-05-10
MD5: 7598e79197505ef3f80f68bb89d8328d SHA-1: f707b986f71d8e62673e9468804cfed379d71d45 SHA-256: 6f0170608cfe7f4e1e8cc3381514f31c2a96ae069972051b6c671c08287295d6
36 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains embedded JavaScript that is obfuscated and attempts to download a second-stage payload from a URL. The presence of XFA form elements and embedded files further indicates malicious intent. The JavaScript action is the primary indicator of malicious activity, likely leading to the execution of further malware.

Machine Learning

  • Nyx PDF Classifier clean score 0.0844

Heuristics 6

  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic (matched inside decoded stream)
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ec.europa.eu/social-security-directory/ In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/g/img/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xmp/InDesign/privateIn PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In extracted file (embedded_file_obj0006.bin)
    • http://www.xfa.org/schema/xci/1.0/In extracted file (embedded_file_obj0007.bin)
    • http://www.xfa.org/schema/xci/2.8/In extracted file (embedded_file_obj0007.bin)
    • http://www.xfa.org/schema/xfa-template/2.5/In extracted file (embedded_file_obj0008.bin)
    • http://www.xfa.org/schema/xfa-data/1.0/In extracted file (embedded_file_obj0009.bin)
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In extracted file (embedded_file_obj0010.bin)
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In extracted file (embedded_file_obj0010.bin)
    • http://ns.adobe.com/xtd/In extracted file (embedded_file_obj0011.bin)
    • http://ns.adobe.com/xfdf/In extracted file (embedded_file_obj0013.bin)
    • http://www.xfa.org/schema/xfa-form/2.8/In extracted file (embedded_file_obj0014.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 19

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0006.bin pdf-embedded-file PDF EmbeddedFile object 6 at offset 0xB773 86 bytes
SHA-256: f7ee3ef2f8f35d669a6c2b8b0b0ee89655bbc3d04b107a8d22531830f6fc28a1
embedded_file_obj0007.bin pdf-embedded-file PDF EmbeddedFile object 7 at offset 0xB826 1510 bytes
SHA-256: 44f777708d01d8ab19c2f3a2285ab58b963adbfc93c3c120f228965ade50ca6a
embedded_file_obj0008.bin pdf-embedded-file PDF EmbeddedFile object 8 at offset 0xBAFC 11794 bytes
SHA-256: 7253870c4d2af43807cb03d69fd493d934b753c15ac9513a7fad17e1790eea54
embedded_file_obj0009.bin pdf-embedded-file PDF EmbeddedFile object 9 at offset 0xC341 460 bytes
SHA-256: e6efd8dd9aac3633632107e9a6b43f6d5a373b70a3b617da773b6e224e39646e
embedded_file_obj0010.bin pdf-embedded-file PDF EmbeddedFile object 10 at offset 0xC493 5720 bytes
SHA-256: c2c9679605620007f3dbf29accd072b75dc4eb66dd4e3a337b290939b584746b
embedded_file_obj0011.bin pdf-embedded-file PDF EmbeddedFile object 11 at offset 0xC946 200 bytes
SHA-256: 4cb349134bdb5f1a1c03281df9b53128ebe947f235398a912a4f0a9f638b24d5
embedded_file_obj0012.bin pdf-embedded-file PDF EmbeddedFile object 12 at offset 0xCA3C 98323 bytes
SHA-256: 8e7749cf60ad6a8d3ad642e0a1854ce7f4ad916e59e8e107292596981c888710
Detection
ClamAV: No threats found
Obfuscation or payload: likely
397 of 716 identifiers look randomly generated (e.g. 'FbFCI8FS0eEzFmLwJHKC8SVDNFOSorJjc8I1RCeT'); 4 string-concatenation chain(s) — consistent with name-mangling obfuscation.
embedded_file_obj0013.bin pdf-embedded-file PDF EmbeddedFile object 13 at offset 0xFA34 80 bytes
SHA-256: 2ebdd7efeaa1190ff6bad8cbd649b313e3969564018f204e7385b97c2fab1e19
embedded_file_obj0014.bin pdf-embedded-file PDF EmbeddedFile object 14 at offset 0xFADE 56 bytes
SHA-256: 4a60a9864cdf7382475d51051a03fdc43b32c31eb508893ccfccece34957f9f1
stream_002_off0000046e.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x46E 1532 bytes
SHA-256: f574e4d51594d1a8fd22e125b109b827c437aa898edc78babb62dbb93f8744f8
stream_003_off00000659.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x659 870 bytes
SHA-256: 4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb
objstm_0069_00.bin pdf-objstm-decoded PDF /ObjStm 69 0 obj (inflated) 12148 bytes
SHA-256: a0c7236fed75f9bd117511fafb03279cd3b014a91e86b224c1cd0a72b2795ae0
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 long base64-like blob(s).
font_00_cff_off00005258.bin pdf-font-stream PDF embedded font (cff) at offset 0x5258 4609 bytes
SHA-256: 3c68dc42febab880457662e5b29b9fdc287123ac4ed62119babe8a5b97b560e5
font_01_cff_off00006c2e.bin pdf-font-stream PDF embedded font (cff) at offset 0x6C2E 2477 bytes
SHA-256: 79df8dcf44e4ab685724d72530807c7178e014e5db5daa7a020a2795ee93918e
font_02_cff_off00007510.bin pdf-font-stream PDF embedded font (cff) at offset 0x7510 1738 bytes
SHA-256: a236fc8d89f1895cf20a68bc7addf2cfcdd439871193bc002f7f076ce44040f9
font_03_cff_off00007b8e.bin pdf-font-stream PDF embedded font (cff) at offset 0x7B8E 708 bytes
SHA-256: 8529d1563b466d7c7b9fcd77f16c8c995db98f5347e34ad45209ab1bd1d08ffe
font_04_sfnt_off00007edd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7EDD 6187 bytes
SHA-256: 5d3ca7c964c84e3ba9d6577a43d003b5f34954437a016d1c6387aa7d74e29751
font_05_cff_off00008d38.bin pdf-font-stream PDF embedded font (cff) at offset 0x8D38 3417 bytes
SHA-256: 3923c1bfe098a7dea9ca8d4fe2afe52c6653986750356883ed181d6d5f7e9574
font_06_cff_off00009b87.bin pdf-font-stream PDF embedded font (cff) at offset 0x9B87 2401 bytes
SHA-256: 9fcf634e0083182d90f529a4507e6244a7acef479c78162d8fd2c84c829ecce5

Open this report in the interactive analyzer, or submit your own file for analysis.