PDF static analysis report

Static analysis result for SHA-256 723833ddc5b0fc21…

CLEAN

PDF

755.4 KB Created: 2010-06-25 11:24:37 -05:00 Authoring application: iText by lowagie.com (r1.02b;p128) First seen: 2026-05-11
MD5: f709e33242e1368fbacf82ef1432aaed SHA-1: 21daf3f20c830962a8f7eb90583e659c95e831c8 SHA-256: 723833ddc5b0fc2152eaf0a454a8b183778ff90cdfb3a2186456e39aa3acd52c
16 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF document contains embedded JavaScript, indicated by multiple heuristic firings and the presence of a javascript_obj0454_000.js file. The JavaScript code, though minimal, is likely intended to perform malicious actions such as downloading a second-stage payload or redirecting the user to a malicious site. The PDF structure also shows signs of obfuscation and potential exploit indicators.

Machine Learning

  • Nyx PDF Classifier clean score 0.0780

Heuristics 5

  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • JavaScript action info 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream info PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype In PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0454_000.js pdf-javascript-stream PDF /JS object 454 at offset 0xB9AF5 33 bytes
SHA-256: b49875e7a786cc7d62191be88c49afc7a7f53551d4ec30ddf24c3fd7583d7233
Preview script
First 1,000 lines of the extracted script
AFDate_KeystrokeEx("mm/dd/yyyy");
stream_060_off00036210.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x36210 4603 bytes
SHA-256: 3a6fa31bd7bc58a5e0d1bb40045a8f1578295b5d0a50b1a2b5df9dac2e157eb8
stream_109_off0006d7be.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6D7BE 367087 bytes
SHA-256: b8e2518b116c26bab0e9f8c1672daf405dedad561157502b657e9005be2029aa
icc_00_off00062eca.icc pdf-icc-profile PDF ICC profile at offset 0x62ECA 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_cff_off0000804e.bin pdf-font-stream PDF embedded font (cff) at offset 0x804E 6749 bytes
SHA-256: 85239cd24b89ce7c399afa4ab7ba067f7737bd17bcadf7ea0847b912dc65002a
font_01_cff_off00009b9c.bin pdf-font-stream PDF embedded font (cff) at offset 0x9B9C 4651 bytes
SHA-256: 4255dfc2a9b0631dacf6925699a323a4dbd9ed1a64d33b82b313f8ebbd7b0fc5
font_02_cff_off0000af91.bin pdf-font-stream PDF embedded font (cff) at offset 0xAF91 5990 bytes
SHA-256: a966ec4b314b03846bfdac6d3d6326f8f28c0cba1408cea89639f6eea3e221cb
font_03_cff_off0000f744.bin pdf-font-stream PDF embedded font (cff) at offset 0xF744 2158 bytes
SHA-256: bd27d01fa6fca113f6a72d74de5cd809d07966e2aac715833c8acb2727670278
font_04_cff_off0001020d.bin pdf-font-stream PDF embedded font (cff) at offset 0x1020D 4952 bytes
SHA-256: 205da7482f44ac0df31aa359516cea40c541d20914f57f09693ef7f7af09e100
font_05_cff_off00012918.bin pdf-font-stream PDF embedded font (cff) at offset 0x12918 784 bytes
SHA-256: 61b06f0743b0dc24a31f6490e67961751fd2a208dbe6e6f5029a253729b11b10
font_06_cff_off00012e46.bin pdf-font-stream PDF embedded font (cff) at offset 0x12E46 6454 bytes
SHA-256: a56b1661419a590fe348e306f8f1938df8ec24b5799db8eb43c519b8173d3ba6
font_07_cff_off00014884.bin pdf-font-stream PDF embedded font (cff) at offset 0x14884 4531 bytes
SHA-256: 8ff3b24a04bf018cfde63516868c4767d922b0d9262429ba50084fd8f7b00774
font_08_cff_off00015b28.bin pdf-font-stream PDF embedded font (cff) at offset 0x15B28 4065 bytes
SHA-256: 193966c6d86ae761ea9f682c0710a4d14a85d36bd532efb63488dfdee3203945
font_09_sfnt_off0001859c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1859C 10017 bytes
SHA-256: 8821ee19bd3f7b989c0373692ac27a15d435db056f454d33e7c81d84fa5af64e
font_10_sfnt_off00027d18.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27D18 34412 bytes
SHA-256: 51a4b8d3ee5563428f78100b0a91300bb60811dd6c7a2abf7604acd347a79c5f
font_11_sfnt_off0002cd28.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2CD28 32336 bytes
SHA-256: 14bf4fe2a9cb0a19b7579e04a4803f3dc7c51d3c5265897dba10d86bf872186d
font_12_cff_off000319f5.bin pdf-font-stream PDF embedded font (cff) at offset 0x319F5 138 bytes
SHA-256: 9677fa215f86c54737c065293ef4394c1275c2dd3963594d04467cbf0cb85a3d
font_13_sfnt_off0003272a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3272A 10017 bytes
SHA-256: 254397cf029c90b4d9e6433322f1782a79ff9fb6d0bbcd0211ec29d6457c55e8
font_15_cff_off00037566.bin pdf-font-stream PDF embedded font (cff) at offset 0x37566 4773 bytes
SHA-256: fea6fd4e32a23195c8c4f1292e410a01855988537624f2b03afd0206671ef57e
font_16_sfnt_off000389ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x389AC 5284 bytes
SHA-256: a8678490550b24db5df968563bce87578712dc18c940caa21979bf756a337b4c
font_17_sfnt_off00039fd2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x39FD2 10017 bytes
SHA-256: 9bd299ef3094b5af1ec59381f465fe0ca6093d07d7ac5d4e988f2c5a7e502f71
font_18_sfnt_off0003daec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3DAEC 10017 bytes
SHA-256: ada20f54b67fe07c5594a98dee566de8f57ebfc9f2eb91b1ac8f9c040047676e
font_19_sfnt_off00041c82.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x41C82 10017 bytes
SHA-256: 262f244bd33db9379a91023e8663e210d31757fc29b363a29e53d4a916ce9f73
font_20_sfnt_off00045905.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x45905 10017 bytes
SHA-256: 485264197048ffa32e2a794557b9bcc4b85ddf54f68efac9e819f818f5baa9bc
font_21_sfnt_off0004a238.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4A238 5900 bytes
SHA-256: 64b62aec30d8f2dc35dfa620ddf8fc88749ff3034a6bf3fae0393dfb9d871662
font_22_sfnt_off0004afbc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4AFBC 39448 bytes
SHA-256: e2784506de8acddb60038c57e545b45afeeef5391c33d62c6fa5ebfb43563fcf
font_23_sfnt_off00050b9f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x50B9F 34260 bytes
SHA-256: 83a9ce123b2d84c9fb7ea4e72c41d546bfc89f3b9506e46b4799d0b242489da8
font_24_sfnt_off00056714.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x56714 6084 bytes
SHA-256: 42273fd9f6cbfe94826d62ac4d32dd33708b66ad14b4f6905ea9ba366e933111
font_25_cff_off00058f24.bin pdf-font-stream PDF embedded font (cff) at offset 0x58F24 5425 bytes
SHA-256: aea7013a855abf2a5e97b2f0158746652850de87e1bbf82f496891df9a27718f
font_26_cff_off0005a5ba.bin pdf-font-stream PDF embedded font (cff) at offset 0x5A5BA 2793 bytes
SHA-256: 81630acf7139b297deb2f9ff64430dfbf77ecefcd86d49487fe6484c8751c756
font_27_cff_off0005f761.bin pdf-font-stream PDF embedded font (cff) at offset 0x5F761 4126 bytes
SHA-256: 92254c3093f1ee4309a5442ce26076f594cb74fa406c41420e4a3d79efe28001
font_28_cff_off000608d5.bin pdf-font-stream PDF embedded font (cff) at offset 0x608D5 8161 bytes
SHA-256: b17bb391fe7285b8bcb478702d6770b52fd7283837b0114b78d6d9777a9a7f10

Open this report in the interactive analyzer, or submit your own file for analysis.