PDF static analysis report

Static analysis result for SHA-256 8952168c2cbf7dd6…

CLEAN

PDF

45.9 KB Created: 2006-04-28 22:10:35 +09:00 Authoring application: Illustrator (via Adobe PDF library 7.77) First seen: 2014-07-06
MD5: b7dc9f116cee7ba6386e80ec0ef8292b SHA-1: 7e506e1af5fb2e6536a6a1d757b42482232c6905 SHA-256: 8952168c2cbf7dd6e1fef427eee826ca1563723e84a9262153436e9ef7e032e1
20 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3167

Heuristics 4

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0031_000.js pdf-javascript-stream PDF /JS object 31 at offset 0x3313 537 bytes
SHA-256: d8a30cc4ec91fa5aeb9a6c9a9847825600f745abc24220350e6d35be68083481
Preview script
First 1,000 lines of the extracted script
var m =
{
	fu: function() { return identity.lastName + identity.firstName; },
	gr: function() { return identity.department; },
	ti: function() { return identity.title; },
	cp: function() { return identity.corpAbbrev; },
	cd: function() { return util.printd("yyyy.mm.dd", new Date()); },
	x: function() { return "***placeholder***"; }
};
var i = event.target.name.match(/\((.*)\)\.(v?)(.)/);
var p = i[1].split(/;/);
var mp = p[(1 * i[3]) - 1];
var v = m[mp]();

event.value = i[2] ? v.replace(/(?=.)(.)(?=.)/g, "$1\n") : v;
font_00_cff_off000023a3.bin pdf-font-stream PDF embedded font (cff) at offset 0x23A3 1205 bytes
SHA-256: 7ed4caf79fe1766451134ebe5af19de1d45a308c1e056333327b08bddde9e982

Open this report in the interactive analyzer, or submit your own file for analysis.