Malicious PDF — malware analysis report

Static analysis result for SHA-256 7538b856fe361501…

MALICIOUS

PDF

226.8 KB Created: 2009-12-02 13:53:19 UTC Authoring application: Amgraf OneForm Designer Plus (via OneForm Designer Plus PDF Forms Generator) First seen: 2026-05-11
MD5: f4a6b042a44ccb7bd1e111c99b5034d1 SHA-1: aca080f7b24c2e8964c23e0c07d74fbf65252911 SHA-256: 7538b856fe3615010720abee49bc624edaaa4fabf60f2aff5fd179379a3a3e99
606 Risk Score

🔏 Digital signature Modified after signing

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF document contains a digital signature that has been tampered with after signing, indicating malicious intent. It leverages a JavaScript action and a launch action to execute cmd.exe and export a file named 'fw4.pdf'. This exported file is identified as a Windows executable payload by ClamAV, with the signature Win.Trojan.SpyEye-7465744-1. The combination of these factors strongly suggests an attempt to deliver and execute a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9652

Heuristics 16

  • Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240
    PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
  • ClamAV: Pdf.Tool.Agent-1388586 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Tool.Agent-1388586
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOAD
    PDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\fw4.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • Embedded attachment masquerades: declared document, content is windows-executable critical PDF_EMBEDDED_FILESPEC_CONTENT_MISMATCH
    An /EmbeddedFile attachment's declared filename extension or /Subtype MIME type contradicts the magic bytes of its decompressed content. The attachment is declared as a benign document or image but the bytes are an executable or executable-bearing archive. This is a deliberate deception used to hide droppers in PDF attachments and is a generic indicator of embed-and-drop weaponisation, independent of any specific CVE.
  • Auto-executing content added after the PDF was signed high PDF_SIGNATURE_POST_SIGN_MODIFICATION
    An incremental update appended AFTER the signed byte range introduces auto/external-execute content (/OpenAction, /Launch). This is the documented PDF 'shadow attack': the viewer still shows the original signature as valid while executing content the signer never approved. Benign re-signing/form-fill does not add these objects.
  • /Launch action paired with attachment-dropping JS API high PDF_LAUNCH_PLUS_DROPPER_JS
    PDF combines a /Launch action with a JavaScript API call that writes or opens an attached/external resource — the canonical shape of the CVE-2010-1240 /Launch + exportDataObject family. Benign PDFs do not pair these surfaces; the combination indicates a drop-and-execute chain regardless of the specific JS API knobs or /Launch target.
  • JBIG2Decode filter medium PDF_JBIG2
    JBIG2 image decoder present — historically used in zero-click exploits
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
🗂 Part of campaign: ggobi.org 10 samples

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 16

Files carved from inside the sample during analysis.

FilenameKindSourceSize
fw4.pdf pdf-embedded-file PDF EmbeddedFile object 269 at offset 0x28FF0 82432 bytes
SHA-256: 27e919fa61a1e8bc4159d9f16f9fc63ddf9e5fb49a96fbebe70d765699dbaae6
Detection
ClamAV: Win.Trojan.SpyEye-7465744-1
Obfuscation or payload: likely
actual_type=PE; declared_or_context_type=PDF; filename=fw4.pdf; kind=pdf-embedded-file Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS, SC_GETPC_CALL, SC_STR_VIRTUALALLOC Static shellcode analysis recovered API/import strings: LoadLibraryA, GetProcAddress, VirtualAlloc, VirtualProtect
javascript_obj0115_000.js pdf-javascript-stream PDF /JS object 115 at offset 0x92AE 159 bytes
SHA-256: 8a99471ad514cd4a8fba73b4458f4efb842426bc4d8617c65cc602254f90a2ea
Preview script
First 1,000 lines of the extracted script
var fld = this.getField ("c1_01b(0)");
if (fld.isBoxChecked(0)) {
   fld.checkThisBox (0, true);
}
else {
   fld.checkThisBox (0, false);
}
MainCalculation();
javascript_obj0116_001.js pdf-javascript-stream PDF /JS object 116 at offset 0x938B 159 bytes
SHA-256: 948f172f7bbd960394bbbc0fd6208c5a9e2f0af22005a55a36ed2c63e0c47be3
Preview script
First 1,000 lines of the extracted script
var fld = this.getField ("c1_01a(0)");
if (fld.isBoxChecked(0)) {
   fld.checkThisBox (0, true);
}
else {
   fld.checkThisBox (0, false);
}
MainCalculation();
javascript_obj0117_002.js pdf-javascript-stream PDF /JS object 117 at offset 0x9468 158 bytes
SHA-256: 8840c520772591c599e3567caac0b09a587e50d1f46a93fede4c8c098993d4da
Preview script
First 1,000 lines of the extracted script
var fld = this.getField ("c1_01(0)");
if (fld.isBoxChecked(0)) {
   fld.checkThisBox (0, true);
}
else {
   fld.checkThisBox (0, false);
}
MainCalculation();
javascript_obj0270_003.js pdf-javascript-stream PDF /JS object 270 at offset 0x385EB 52 bytes
SHA-256: 1cd6cc559f5ea17ba190dc16c19031282806141ce8c20dc93d36fc100ad38528
Preview script
First 1,000 lines of the extracted script
this.exportDataObject({ cName: "fw4", nLaunch: 0 });
jbig2_00_off0001a063.bin pdf-jbig2-stream PDF JBIG2 stream at offset 0x1A063 530 bytes
SHA-256: 3012865fb1ca53bfde48cc8f1d1992177ebb200f846e886555183b7c2aa05d86
font_00_cff_off00004938.bin pdf-font-stream PDF embedded font (cff) at offset 0x4938 424 bytes
SHA-256: f688a5a3bb605a72a8585771ba01d03766ceb3d42adb57ee11b7c06332e8d479
font_01_cff_off000070f4.bin pdf-font-stream PDF embedded font (cff) at offset 0x70F4 5615 bytes
SHA-256: 072457ac842d861919cf168aa62b12d1c56f243c75e14e1dabac466496d887f8
font_02_cff_off00008321.bin pdf-font-stream PDF embedded font (cff) at offset 0x8321 4772 bytes
SHA-256: 41a0994457079087ae1e5fcb2cf4fab35bdc7311bac94e857af96af283df6875
font_03_type1_off00009bf4.bin pdf-font-stream PDF embedded font (type1) at offset 0x9BF4 27352 bytes
SHA-256: 3790fecdd785504436b8083d299979acbba9334ca25bc89301b489fbd1cd66b4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.90, consistent with packed or encrypted content.
font_04_type1_off0000ffe3.bin pdf-font-stream PDF embedded font (type1) at offset 0xFFE3 28146 bytes
SHA-256: cf694c5d3fe2ba3fbf181107ef9d13f31c3390cd6d641be6c459e6add02c8d42
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.91, consistent with packed or encrypted content.
font_05_cff_off000166ff.bin pdf-font-stream PDF embedded font (cff) at offset 0x166FF 2861 bytes
SHA-256: 78541ae302944e819f6a30beeed6e8b4677992c02c53447b5e8b575668f3a1d8
font_06_cff_off000172f4.bin pdf-font-stream PDF embedded font (cff) at offset 0x172F4 315 bytes
SHA-256: 4fe5479003937b5d7434daef2814b27f73741d27492a8c1082f1235c7f812331
font_07_cff_off0001766e.bin pdf-font-stream PDF embedded font (cff) at offset 0x1766E 619 bytes
SHA-256: de3d40a98cbe84e8ed70644e521a5aac057226347fcef5723d059b11ff230e76
font_08_cff_off0001928a.bin pdf-font-stream PDF embedded font (cff) at offset 0x1928A 2070 bytes
SHA-256: 90681e988afc070a6a4bf541272d54c2e3a3dd939747f6fbd40af826cdd22b4d
font_09_cff_off00019b32.bin pdf-font-stream PDF embedded font (cff) at offset 0x19B32 982 bytes
SHA-256: 8db89dd537c665c4973c30046f0d08a67304b45167b7368c032ec661e3f24bb9

Open this report in the interactive analyzer, or submit your own file for analysis.