Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ab5af56b587588d…

MALICIOUS

PDF

642.3 KB First seen: 2026-05-08
MD5: 534522f980282c31785930d291104fbf SHA-1: 922c68dc7315bb247339cd68e6bb036ae8fe0c0c SHA-256: 7ab5af56b587588d81ee3da37d50d07748e428b8ba7eed6410358d2eb3da5aa7
216 Risk Score

🔏 Digital signature Modified after signing

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

This PDF file contains JavaScript that leverages the CVE-2023-26369 vulnerability. The JavaScript uses String.fromCharCode, a common obfuscation technique, and is associated with exploit clusters. The presence of embedded scripts and the exploit cluster heuristic indicate that the primary function of this document is to execute malicious code, likely to download and run a secondary payload. The document was digitally signed but modified after signing, which is a common tactic to bypass security checks.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6769

Heuristics 11

  • TrueType bitmap font + active content — CVE-2023-26369 related high CVE related PDF_CVE_2023_26369_RELATED
    PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
       if (randomNumber < NUMBERS) {
    code += String.fromCharCode(randomNumber + NUMBER_POS);
   } else {
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Active content added after the PDF was signed medium PDF_SIGNATURE_POST_SIGN_MODIFICATION
    An incremental update appended AFTER the signed byte range introduces active content (/EmbeddedFile, /Catalog). Some of this can occur in legitimate form-fill (field scripts, a rewritten /Catalog), so it is suspicious rather than damning — but it is content the signer did not approve.
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype In PDF document text
    • http://ocsp.verisign.com0In PDF document text
    • http://www.monotype.comHowardIn PDF document text
    • http://www.adobe.com/products/acrobat/readstep2.htmlIn PDF document text
    • http://www.adobe.com/support/products/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/In PDF document text
    • http://www.adobe.com/supporIn PDF document text
    • http://www.xfa.org/schema/xfa-template/3.0/Referenced by PDF JavaScript
    • http://www.w3.org/1999/xhtmlReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.8/Referenced by PDF JavaScript
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-form/2.8/Referenced by PDF JavaScript
    • http://www.bde.es/IntDescExcIn PDF document text
    • http://ns.adobe.com/data-description/In PDF document text
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/3.0/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.8/\In PDF document text
    • http://www.w3.org/1999/xhtml\In PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/\In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In PDF document text
    • http://www.xfa.org/schema/xfa-connection-set/2.8/In PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • http://crl.verisign.com/tss-ca.crl0In PDF document text
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In PDF document text
    • http://logo.verisign.com/vslogo.gif0In PDF document text
    • http://csc3-2010-crl.verisign.com/CSC3-2010.crl0DIn PDF document text
    • http://csc3-2010-aia.verisign.com/CSC3-2010.cer0In PDF document text
    • https://www.verisign.com/cps0*In PDF document text
    • http://logo.verisign.com/vslogo.gif04In PDF document text
    • http://crl.verisign.com/pca3-g5.crl04In PDF document text
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlIn PDF document text
    • https://www.verisign.com/repository/RPA0In PDF document text
    • https://www.verisign.com/repository/CPS��In PDF document text
    • https://www.verisign.comIn PDF document text
    • https://www.verisign.com/repository/verisignlogo.gif0�In PDF document text
    • https://www.verisign.com/CPSIn PDF document text
    • https://www.verisign.com/repository/CPSIn PDF document text
    • http://www.microsoft.com/truetype/0In PDF document text
    • http://www.monotype.com/html/mtname/ms_couriernew.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 15

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0077.bin pdf-embedded-file PDF EmbeddedFile object 77 at offset 0x9ECE1 8296 bytes
SHA-256: 5e3f60e2bb2d080b3200d4ffe0e8185c8a0e4f00a0aa40f63e3a52edc8308900
embedded_file_obj0109.bin pdf-embedded-file PDF EmbeddedFile object 109 at offset 0x9F795 162 bytes
SHA-256: c032824d9b04753bd5d8f7dd4b59469a94470ffc86127995c74d17d25b1cbcef
embedded_file_obj0110.bin pdf-embedded-file PDF EmbeddedFile object 110 at offset 0x9F888 25115 bytes
SHA-256: c0459c5a06b9743dab178698d038c3a52ce9de6a43c8528612f1534d0e38ad65
stream_001_off00000122.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x122 2550 bytes
SHA-256: 654930abd1897fbdd571fb1cd162a706fa3ef255e52d25ba6d68078cf44815b4
stream_002_off00000511.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x511 322727 bytes
SHA-256: 52ab6f58c71b50988b0ac1088494687d67a27cdf2109e3541e84f033379d1a36
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).
stream_003_off00016412.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x16412 2893 bytes
SHA-256: 984e33597cee6a139b4eb9668deb8ae3fd023cb2f29b1dac2e77dd6be0d9a93d
stream_005_off000169b4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x169B4 382 bytes
SHA-256: 36ab3c7d4b747eee0de0d789230a35892487c262dddf70e16382d374eebb246e
stream_006_off00016af9.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x16AF9 6836 bytes
SHA-256: 4bc72bfba3b758008fd6db4cb32a57bb859ad78f238af9c6dbe5806548ee2ae7
stream_010_off00066279.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x66279 367087 bytes
SHA-256: b8e2518b116c26bab0e9f8c1672daf405dedad561157502b657e9005be2029aa
stream_012_off0009aada.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9AADA 1363 bytes
SHA-256: 529357503ec67b623d2a12816cdeea62bd639f2b4ff4e568b01c96cc3f5bfc6f
stream_013_off0009acb8.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9ACB8 902 bytes
SHA-256: e985b5df65c8c3cf732a9074b575fbc594c1c7f0bccc0994182ec7e5c0f7308a
objstm_0013_00.bin pdf-objstm-decoded PDF /ObjStm 13 0 obj (inflated) 14639 bytes
SHA-256: da0e75d773909ae118d275df8727a5d6152b94fa96d37283db9d67452d5c60f1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
font_00_sfnt_off00016e2a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16E2A 96552 bytes
SHA-256: bb2941ec4287d456b111082246b159a552fabcbd95c93efecdf11c9146f57370
font_01_sfnt_off0002727c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2727C 98046 bytes
SHA-256: b8a01f1bf52ef962d6ee77e0a9299704d38617565ea12f2a6dc7a39cdb0062eb
font_02_sfnt_off00037ac9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x37AC9 303274 bytes
SHA-256: 242d459e0deb90ab41a2a5c871a8249111bc7b82bf1632e3e6e90d9746134bd5

Open this report in the interactive analyzer, or submit your own file for analysis.