PDF static analysis report

Static analysis result for SHA-256 70ecc0b78c614cc2…

CLEAN

PDF

268.2 KB Created: 2007-09-30 13:29:36 UTC Authoring application: PScript5.dll Version 5.2 (via GPL Ghostscript 8.15) First seen: 2026-05-10
MD5: 2fb0f5347d355388bfed1d29b07658da SHA-1: 4ee87fa5d276a46b2ee7af55d3c814d513bec9b9 SHA-256: 70ecc0b78c614cc2e1e401a06044f365fd5bd358e342f776dee83db0330d3651
22 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.1525

Heuristics 5

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/In PDF document text
    • http://www.adobe.com/products/acrobat/readstep2.htmlReferenced by PDF JavaScript
    • http://www.adobe.com/products/acrobat/readstep2.html\In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0645_006.js pdf-javascript-stream PDF /JS object 645 at offset 0x380D1 83 bytes
SHA-256: f73ce6dd1a2110a08b26033162e53bb03a59e674b07b367ccc78e6237926d78b
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("maakond3");
uppers.value = uppers.value.toUpperCase();
javascript_obj0646_007.js pdf-javascript-stream PDF /JS object 646 at offset 0x38152 80 bytes
SHA-256: b3bcf0eed2d8f5bf65f1caf33c77907519e3ba5df13382d43ab1c5635d83bc70
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("linn3");
uppers.value = uppers.value.toUpperCase();
javascript_obj0647_008.js pdf-javascript-stream PDF /JS object 647 at offset 0x381D0 82 bytes
SHA-256: 67ab1d21db5cd7450d5fa3a5e0c64b6021ff6e33b408b34002fba7ebf5791ccc
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("indeks3");
uppers.value = uppers.value.toUpperCase();
javascript_obj0648_009.js pdf-javascript-stream PDF /JS object 648 at offset 0x38250 80 bytes
SHA-256: 0cd0af6fafe29734bca8e1593c37ce9000a6a848714293a9cf80603935b299aa
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("maja3");
uppers.value = uppers.value.toUpperCase();
javascript_obj0649_010.js pdf-javascript-stream PDF /JS object 649 at offset 0x382CE 81 bytes
SHA-256: 7af72b7d5bc283db290c28837c663a789d32bacc5bbe0a46469867eb49cb55c2
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("tanav3");
uppers.value = uppers.value.toUpperCase();
javascript_obj0650_011.js pdf-javascript-stream PDF /JS object 650 at offset 0x3834D 83 bytes
SHA-256: 0acc8e719743c5faf2f69dbf06dfdacd92f33ec4ea97e2e7ae3527d7d7d230be
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("dokriik3");
uppers.value = uppers.value.toUpperCase();
javascript_obj0651_012.js pdf-javascript-stream PDF /JS object 651 at offset 0x383CE 81 bytes
SHA-256: 97bfad28d48d5304e855018abc8986be9ca0f68d541d2d6d78716b0b432fc053
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("doknr3");
uppers.value = uppers.value.toUpperCase();
javascript_obj0652_013.js pdf-javascript-stream PDF /JS object 652 at offset 0x3844D 86 bytes
SHA-256: f4562ed0bac03ef28e9067e6bc3ca19eae23ef37f111cc30a241bac3ddd09e7e
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("muudokliik3");
uppers.value = uppers.value.toUpperCase();
javascript_obj0656_014.js pdf-javascript-stream PDF /JS object 656 at offset 0x38585 141 bytes
SHA-256: f7a9a30bf351b140894a4b5c788b3521c5b111e1f16da8c71a10dd61f565b8d6
Preview script
First 1,000 lines of the extracted script
var v_isikukood1 = this.getField("isikukood3");

if(v_isikukood1.value)
{
    event.value = v_isikukood1.value.toString().substr(3,2);
}
javascript_obj0659_015.js pdf-javascript-stream PDF /JS object 659 at offset 0x386CF 141 bytes
SHA-256: 1e2374d130cd6745dc4ad2b00f0b6d5ba89df308e55aec996ae9a91e2c8c251f
Preview script
First 1,000 lines of the extracted script
var v_isikukood1 = this.getField("isikukood3");

if(v_isikukood1.value)
{
    event.value = v_isikukood1.value.toString().substr(5,2);
}
javascript_obj0662_016.js pdf-javascript-stream PDF /JS object 662 at offset 0x38819 83 bytes
SHA-256: b1b94606eba2e13bf638cd11a3b5d741a6d6be6f4a4e9700dd27026730718916
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("endnimi3");
uppers.value = uppers.value.toUpperCase();
javascript_obj0663_017.js pdf-javascript-stream PDF /JS object 663 at offset 0x3889A 89 bytes
SHA-256: 7f7a690415706a2183b85411b8ff72425ffc415965e98824b527dcf289857c5c
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("perekonnanimi3");
uppers.value = uppers.value.toUpperCase();
javascript_obj0664_018.js pdf-javascript-stream PDF /JS object 664 at offset 0x38921 83 bytes
SHA-256: 46a50a3d4264662a77ab4664e5c92d88f5053796a437c389cf61a6565161ad09
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("eesnimi3");
uppers.value = uppers.value.toUpperCase();
javascript_obj0666_019.js pdf-javascript-stream PDF /JS object 666 at offset 0x389DC 39 bytes
SHA-256: 6b7cde5083353dc94a728e784406248df1e3c34b8a1b86c325dca7d6822fc92b
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 1, 0, 0, "", false);
javascript_obj0667_020.js pdf-javascript-stream PDF /JS object 667 at offset 0x38A2D 42 bytes
SHA-256: d7feabbe96d6239a4e68846c17660c84111cd34df235720909593806041f8a24
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 1, 0, 0, "", false);
javascript_obj0682_021.js pdf-javascript-stream PDF /JS object 682 at offset 0x3C61A 84 bytes
SHA-256: 034e1a740297ef7d22772b9e825d7241ce544fe0aca2b7e25050a089d417606a
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("poliisnr2");
uppers.value = uppers.value.toUpperCase();
javascript_obj0683_022.js pdf-javascript-stream PDF /JS object 683 at offset 0x3C69C 84 bytes
SHA-256: e14fc31529bc60bf01a95deae0bbe4ef19cc5d52cd2d5d0cd32b962a717963b4
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("poliisnr1");
uppers.value = uppers.value.toUpperCase();
javascript_obj0714_023.js pdf-javascript-stream PDF /JS object 714 at offset 0x3CEDF 86 bytes
SHA-256: 4509fbf94cdce4531ec052df5ce8cb2a186e714a072843343d42ae89eedd976a
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("valjaandja2");
uppers.value = uppers.value.toUpperCase();
javascript_obj0721_024.js pdf-javascript-stream PDF /JS object 721 at offset 0x3D0F0 86 bytes
SHA-256: 7879bc9aee025953bd93a3847f13390413eedd8176f324195622176a5debeaa6
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("valjaandja1");
uppers.value = uppers.value.toUpperCase();
javascript_obj0722_025.js pdf-javascript-stream PDF /JS object 722 at offset 0x3D174 88 bytes
SHA-256: 877e6d3e5ab4246519df8ec087c1a5a742796152035f3639f5da67d158823692
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("dokvaljaandja");
uppers.value = uppers.value.toUpperCase();
javascript_obj0723_026.js pdf-javascript-stream PDF /JS object 723 at offset 0x3D1FA 82 bytes
SHA-256: 1cd39b377f367a8cb374faf77e3f6272265239b0c6cfadfc825f6d7787c94cfe
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("dokriik");
uppers.value = uppers.value.toUpperCase();
javascript_obj0736_027.js pdf-javascript-stream PDF /JS object 736 at offset 0x3D594 80 bytes
SHA-256: cd4e641897e33fc2f41010428d00f93a155b6a0608d9cc8e603a146970688894
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("doknr");
uppers.value = uppers.value.toUpperCase();
javascript_obj0737_028.js pdf-javascript-stream PDF /JS object 737 at offset 0x3D612 85 bytes
SHA-256: 42a487437f06809c387532969fb7bfc082446c9b6ab30a5313ab6e082074b411
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("muudokliik");
uppers.value = uppers.value.toUpperCase();
javascript_obj0751_029.js pdf-javascript-stream PDF /JS object 751 at offset 0x41282 84 bytes
SHA-256: 0b9d13d9643c2245fad613b12639a85bc31015946e3df8f452654eee4381aaae
Preview script
First 1,000 lines of the extracted script
var uppers = this.getField("synniriik");
uppers.value = uppers.value.toUpperCase();
javascript_obj0054_030.js pdf-javascript-stream PDF /JS object 54 at offset 0x5FD2 304 bytes
SHA-256: 5320c957afe3bb36e0fbcd438cd7db410cc761b60b22da3c61f86155df1a13c2
Preview script
First 1,000 lines of the extracted script
var y = event.value.toString().length;
if(y>6)
{
    var s = parseInt(event.value.toString().substr(0,1));
    var check_sugu = this.getField("sugu3");

    if(s == 1 || s==3 || s==5)
    {
        check_sugu.value = "mees";
    }
    else 
    {
        check_sugu.value = "naine";
    }
}
javascript_obj0055_031.js pdf-javascript-stream PDF /JS object 55 at offset 0x60CF 280 bytes
SHA-256: fef7c1e43dbce649129a4e6846084b064efcbb524c23f579676e865d1946facd
Preview script
First 1,000 lines of the extracted script
�� v a r   c   =   e v e n t . v a l u e ; 
 
 i f ( c . t o S t r i n g ( ) . l e n g t h = = 1 1 ) 
 
 { 
 
         i f ( i k ( c ) = = f a l s e ) 
 
         { 
 
                 a p p . a l e r t ( " I s i k u k o o d   p o l e   k o r r e k t n e " ) ; 
 
         } 
 
 }
javascript_obj0056_032.js pdf-javascript-stream PDF /JS object 56 at offset 0x61B9 379 bytes
SHA-256: 1a5fa5e8cc1db809ee9fbaf04f78fc19911eacd0aef9cd063e8833eb1e4edfea
Preview script
First 1,000 lines of the extracted script
var c = getField("isikukood3");
if (c.value.toString().length==11){

    if (c.value.toString().substr(0,1)%2==0){
        event.value = 1800 + 50*((c.value.toString().substr(0,1)*1-2)) 
+    c.value.toString().substr(1,2)*1;
    }
    else {
        event.value = 1800 + 50*((c.value.toString().substr(0,1)*1-1)) 
+         c.value.toString().substr(1,2)*1;
    }
}
stream_000_off00000060.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x60 19622 bytes
SHA-256: 9b9695e790d5df6ff55a0d9ab294deb3df843d2df29ff2df524d154751dc4eeb
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 8 long base64-like blob(s).
stream_131_off00018af2.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x18AF2 5942 bytes
SHA-256: 8258b28a091591d414ed3a8da724190f6a157fdd1fb8d6255a4e5eb535db4a6c
stream_142_off00034a90.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x34A90 5427 bytes
SHA-256: efcb038f740ccad4f519013901b3ff01f0a6151f4a3cd89b3999b8eb13f3128d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.42, consistent with packed or encrypted content.
stream_144_off00036ff8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x36FF8 4879 bytes
SHA-256: 71bac87b39f76a74be0ab818ca8482065bdd1351c4de6dbb94a744129d5365b3
stream_164_off000060cf.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x60CF 139 bytes
SHA-256: 9080686a871effecc772a6e2dce705f7294deca796fcba733c94523a9583e0ba

Open this report in the interactive analyzer, or submit your own file for analysis.