Malicious PDF — malware analysis report

Static analysis result for SHA-256 7663fd9e7c1000ec…

MALICIOUS

PDF

321.1 KB Created: òsá U†=Ag¿V( Authoring application: ÷- B´5ßÏx$çMEFG¿¯ (via ÷- B´5ßÏx$çMEFþí—d 0+_¡“e@) First seen: 2026-05-10
MD5: 8494f10afa91da91aee28bcfab143044 SHA-1: f44c42e4a677588616c3d638ae4e4eeb243d5b04 SHA-256: 7663fd9e7c1000ec121c425aa46555fe8db3acc0dc4468511c3b36e2fb8b88ee
156 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

This PDF file was flagged as malicious by a machine learning classifier and exhibits JavaScript activity. The embedded JavaScript streams are designed to perform calculations on form fields, such as summing values or applying multipliers, which is often used in phishing or scam documents to present a seemingly legitimate calculation before requesting sensitive information. The PDF is also noted as being encrypted with JavaScript, hiding its full payload from static analysis.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9131

Heuristics 6

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0096_001.js pdf-javascript-stream PDF /JS object 96 at offset 0x4C11 79 bytes
SHA-256: 8f1ea47bad96bf7d7da10aa161e4739f16b559cecc1e359bd2a9648faedb7c17
Preview script
First 1,000 lines of the extracted script
a=this.getField("stdweltland");

event.value=Math.round(a.value*0.50*100)/100;
javascript_obj0097_002.js pdf-javascript-stream PDF /JS object 97 at offset 0x4C93 38 bytes
SHA-256: dd4e86ff46931388298d522a0c25afc2a74df361f28fb6ad9f104ffc1f5056c1
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "", true);
javascript_obj0098_003.js pdf-javascript-stream PDF /JS object 98 at offset 0x4CE7 41 bytes
SHA-256: 6aeb2fc8f6b0dba7b9d76914b437aa0140bcd183b4c2b0d2b66173e7a39a1974
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "", true);
javascript_obj0102_004.js pdf-javascript-stream PDF /JS object 102 at offset 0x4F1A 80 bytes
SHA-256: 9aa5b8ef8cd37b6d2a7d16a2b9c7269e59d93a158f3584ec97cf797075406626
Preview script
First 1,000 lines of the extracted script
a=this.getField("maxiweltland");

event.value=Math.round(a.value*0.70*100)/100;
javascript_obj0108_005.js pdf-javascript-stream PDF /JS object 108 at offset 0x522C 79 bytes
SHA-256: c5208f95ed1826fc34ec15450d73da475408314013f37afbdb9e8956014d119f
Preview script
First 1,000 lines of the extracted script
a=this.getField("stdweltluft");

event.value=Math.round(a.value*0.50*100)/100;
javascript_obj0114_006.js pdf-javascript-stream PDF /JS object 114 at offset 0x553D 79 bytes
SHA-256: dfe580dee9fe1f14c1aa82ca0822b26bb51d0798386134968d08d8ff1620dbbb
Preview script
First 1,000 lines of the extracted script
a=this.getField("maxiweltluft");

event.value=Math.round(a.value*0.70*100)/100;
javascript_obj0144_007.js pdf-javascript-stream PDF /JS object 144 at offset 0x6349 72 bytes
SHA-256: c2b974e7d08aad609bd20659ea5a35293e1f90433c8af7eb7724dc5dc71c1d98
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("stdweltlandz1", "stdweltlandz2"));
javascript_obj0150_008.js pdf-javascript-stream PDF /JS object 150 at offset 0x6650 72 bytes
SHA-256: 7294dd385288a1c150d30423fb0910237401e6508868ccb809eeb7b67c080c73
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("stdweltluftz1", "stdweltluftz2"));
javascript_obj0156_009.js pdf-javascript-stream PDF /JS object 156 at offset 0x6955 74 bytes
SHA-256: 230d4098eb3361ab8f69fc4aae9604fdc85e488c7128a42aa04676a4c1038613
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("maxiweltluftz1", "maxiweltluftz2"));
javascript_obj0162_010.js pdf-javascript-stream PDF /JS object 162 at offset 0x6C5E 74 bytes
SHA-256: aa74c4e33307069f44a1bd48b39bff379af06a178799418f8a3b03ae72a6bb68
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("maxiweltlandz1", "maxiweltlandz2"));
javascript_obj0168_011.js pdf-javascript-stream PDF /JS object 168 at offset 0x6F66 112 bytes
SHA-256: df52092fe8063e9fb13c2f285327d3dfa4c1b4481cdb587eac776044584d8829
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("stdweltlandent", "stdweltluftent", "maxiweltlandent", "maxiweltluftent"));
javascript_obj0174_012.js pdf-javascript-stream PDF /JS object 174 at offset 0x728A 66 bytes
SHA-256: cd35710079edb70100ca68a9fc298b298a37d3e641d00532c7603fbb4f85784a
Preview script
First 1,000 lines of the extracted script
event.value=Math.round((this.getField("ebf").value*2.05)*100)/100;
javascript_obj0183_013.js pdf-javascript-stream PDF /JS object 183 at offset 0x7756 67 bytes
SHA-256: bd92c49d945e04073764108531adbe2243fc4fa2b3966433940598fcd9e1b294
Preview script
First 1,000 lines of the extracted script
event.value=Math.round((this.getField("ebfr").value*1.80)*100)/100;
javascript_obj0192_014.js pdf-javascript-stream PDF /JS object 192 at offset 0x7C25 68 bytes
SHA-256: 59eade29e964e9169486c6240f3a6a85b900639eaba6305bb1a01e28fa531af1
Preview script
First 1,000 lines of the extracted script
event.value=Math.round((this.getField("eigen").value*1.80)*100)/100;
javascript_obj0201_015.js pdf-javascript-stream PDF /JS object 201 at offset 0x80F7 64 bytes
SHA-256: aa9daa2772f17a173c0a13e17c1be9c6a3886a7dcb31a05185bcf2e608d743b9
Preview script
First 1,000 lines of the extracted script
event.value=Math.round((this.getField("nn").value*4.0)*100)/100;
javascript_obj0210_016.js pdf-javascript-stream PDF /JS object 210 at offset 0x85C3 68 bytes
SHA-256: 59bc8a7bd37a9fb513b47ff4eacdc90a3b10db5e975aa71f4f6d9767bfd05489
Preview script
First 1,000 lines of the extracted script
event.value=Math.round((this.getField("eilint").value*5.5)*100)/100;
javascript_obj0219_017.js pdf-javascript-stream PDF /JS object 219 at offset 0x8A95 118 bytes
SHA-256: cac0bd56556d0676aefff38f5090df66236b0f0b848472e81f295baf55defce0
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("summeeingel", "ebfsumme", "ebfrsumme", "eigensumme", "eilintsumme", "nnsumme"));
javascript_obj0225_018.js pdf-javascript-stream PDF /JS object 225 at offset 0x8DBE 76 bytes
SHA-256: db34454f2d36b4fa04b7365f5907f701a56da457ee21f8cbab818cc5cf1ce52d
Preview script
First 1,000 lines of the extracted script
/**if(this.event.value>0) this.getField("frankier6").value="verstempelt";**/
javascript_obj0232_019.js pdf-javascript-stream PDF /JS object 232 at offset 0x90D2 67 bytes
SHA-256: 491d066d51ae0cd095198ac688e50f8525903af238191f5d3dae50f9080abb22
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("freibetrag", "verstbetrag"));
javascript_obj0238_020.js pdf-javascript-stream PDF /JS object 238 at offset 0x94D4 86 bytes
SHA-256: f629d671aaa3128ea3766b26aa448483118f5589a619debf024258c8baa14d3d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
event.value=eval(this.getField("stdgesamt").value-this.getField("minusbetrag").value);
javascript_obj0248_022.js pdf-javascript-stream PDF /JS object 248 at offset 0x9A0A 108 bytes
SHA-256: ddda81c58978e73a81855e54023b88a6cbb87acd584b6adeece31b03e94d9d7e
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("maxiweltlandz2", "maxiweltluftz2", "stdweltlandz2", "stdweltluftz2"));
javascript_obj0249_023.js pdf-javascript-stream PDF /JS object 249 at offset 0x9AA7 39 bytes
SHA-256: cf3ef38cead83f4b1b39c7a061c8fef2c62d068861252a2b5ba7c0b959eec058
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "", false);
javascript_obj0250_024.js pdf-javascript-stream PDF /JS object 250 at offset 0x9AFD 42 bytes
SHA-256: a22e7a3e6dbfb6427839e3a2fdcab1be9d58bdd666536d5308358ec98c59feed
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "", false);
javascript_obj0254_025.js pdf-javascript-stream PDF /JS object 254 at offset 0x9D36 112 bytes
SHA-256: 5cb84cc552056d9cb62e53db147f957bfa72e43bbbc2c8c6ff8340316d1ec039
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("maxiweltlandgew", "maxiweltluftgew", "stdweltlandgew", "stdweltluftgew"));
javascript_obj0255_026.js pdf-javascript-stream PDF /JS object 255 at offset 0x9DD7 39 bytes
SHA-256: 0e9038242bfa0d40ceade6b7f9fdecf035b27851c43dc0afce04d94da78e0406
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(3, 2, 0, 0, "", false);
javascript_obj0256_027.js pdf-javascript-stream PDF /JS object 256 at offset 0x9E2D 42 bytes
SHA-256: 3612bc2429fdf52bde15586df93bf3b79f92893c5f2b5c72e5bf1cdbfe223e3a
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(3, 2, 0, 0, "", false);
javascript_obj0260_028.js pdf-javascript-stream PDF /JS object 260 at offset 0xA066 44 bytes
SHA-256: e607b9d044160c98f661ff7dd63de4a65a14e035439463d92fe411cf278ab090
Preview script
First 1,000 lines of the extracted script
event.value="St�ckgewicht in vollen Gramm:";
javascript_obj0266_031.js pdf-javascript-stream PDF /JS object 266 at offset 0xA5B2 108 bytes
SHA-256: b9164ca31416b8c2aa6f17b11873d6dcd1a24f045b0a7563b2c82e49717eac8d
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("maxiweltlandz1", "maxiweltluftz1", "stdweltlandz1", "stdweltluftz1"));
javascript_obj0272_032.js pdf-javascript-stream PDF /JS object 272 at offset 0xA8DE 100 bytes
SHA-256: b0f820a0cf31d6b524b4ec238670ab303b5959348377f10d0004516585f927f1
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("maxiweltland", "maxiweltluft", "stdweltland", "stdweltluft"));
javascript_obj0273_033.js pdf-javascript-stream PDF /JS object 273 at offset 0xA973 38 bytes
SHA-256: fefbea8a61fff6d2a5e8d7c764a407c92249644f8a10b0dec3cfae812883a2b7
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 2, 0, 0, "", true);
javascript_obj0274_034.js pdf-javascript-stream PDF /JS object 274 at offset 0xA9C8 41 bytes
SHA-256: 572a91fc51702643df28955aaeeb86dd1625f4e3544ee1ba29446fcedc17c93d
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 2, 0, 0, "", true);
javascript_obj0278_035.js pdf-javascript-stream PDF /JS object 278 at offset 0xABFF 81 bytes
SHA-256: 08cfb812169d8529d91e41e56feed83e6541742041a38569d54a3530234a4eb7
Preview script
First 1,000 lines of the extracted script
event.value=this.getField("kalksdg").value * this.getField("gramm").value / 1000;

Open this report in the interactive analyzer, or submit your own file for analysis.