Malicious PDF — malware analysis report

Static analysis result for SHA-256 97d0d68d1be97436…

MALICIOUS

PDF

336.3 KB Created: 2006-04-24 14:53:59 UTC Authoring application: PScript5.dll Version 5.2 (via FDFMerge 5.0.4 Linux 7 SPDF_1096+ May 3 2004) First seen: 2026-05-11
MD5: 90895a80840b64a06733084773776a7c SHA-1: b064bb973d6946837a6fa1d042f688e3d778a1c5 SHA-256: 97d0d68d1be97436ed38c7e089706b7ea4a474c4b43f3a15c592659a4696f2a7
136 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains multiple JavaScript streams, with one particularly large stream (javascript_obj0021_007.js) indicating complex or obfuscated code. The presence of PDF_JAVASCRIPT, PDF_JS, and PDF_EVAL heuristics, specifically an eval() call, strongly suggests that the embedded JavaScript is designed to execute arbitrary code. This execution is likely intended to download and run a second-stage payload, a common technique for malware delivery. The obfuscation indicators further support this assessment.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3718

Heuristics 6

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
        {
  strTemp1 = String.fromCharCode(eval(i))
       Code128bCharSeta += strTemp1;
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comhttp://www.monotype.com/html/type/license.html Referenced by PDF JavaScript
    • http://www.monotype.comMonotypeReferenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONReferenced by PDF JavaScript
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 12

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0158_000.js pdf-javascript-stream PDF /JS object 158 at offset 0x4DD10 55 bytes
SHA-256: 9ce8e999a7f077bf80b8be89d07d5ff68632cae2aa595a4d7844509360f837e2
Preview script
First 1,000 lines of the extracted script
for (i = this.numPages - 1; i >= 0; i--)
this.print(i);
javascript_obj0161_001.js pdf-javascript-stream PDF /JS object 161 at offset 0x4E063 72 bytes
SHA-256: 73e83df5dcb45dc9bd4e213fc19b421b9a63f7a9ed1ee55ff111dd894f4547b0
Preview script
First 1,000 lines of the extracted script
furl = getField("submitURL");
this.submitForm(furl.value, false, false);
javascript_obj0168_004.js pdf-javascript-stream PDF /JS object 168 at offset 0x4FA0C 33 bytes
SHA-256: b49875e7a786cc7d62191be88c49afc7a7f53551d4ec30ddf24c3fd7583d7233
Preview script
First 1,000 lines of the extracted script
AFDate_KeystrokeEx("mm/dd/yyyy");
javascript_obj0020_006.js pdf-javascript-stream PDF /JS object 20 at offset 0x27B7C 953 bytes
SHA-256: c7c78022d4d68df1c6d5823fff77aa65840b148e3779f50598ae1f4204228e49
Preview script
First 1,000 lines of the extracted script
var WWCC =["HC87"," ","HC71","HC62","HC64","HC64","HC60","HC58","HC65","HC66","HC65","HC66","HC36","HC80","HC80","HC70","HC69","HC71","HH30","HC73","HC75","HC91","HC78","HC76","HC84","HC79","HC91","HC74","HC81","HB58","HC83","HC84","HC74","HC74"," ","HC94","HB44","HH83"];

var  WWUnit=["2D","2E","2EI","2N","2NI","2NS","2R","2W","3E","3EI","3W","3WI","4E","4EI","4SI","4W","4WC","4WI","5E","5W","6E","6EI","6W","7E","7EI","7W","7WI","8E","8W","1W","9F","9FI","10E","10W","3S","BCU","BSA","ECU"];

//var  WWUnit=["2D","2E","2EI","2N","2NI","2NS","2R","2W","3E","3EI","3WI","4E","4EI","4SI","4W","4WC","4WI","5E","5W","6E","6EI","6W"];

var nursingUnit =this.getField("Message.nursingUnit");
var costCenter =this.getField("Message.costCenter");
if (nursingUnit.value !="") {
// costCenter.value= nursingUnit.value
for (var i=0; (costCenter.value =="" && i< WWUnit.length) ; i++) {
   if (nursingUnit.value == WWUnit[i])
   costCenter.value= WWCC[i];
}
}
javascript_obj0021_007.js pdf-javascript-stream PDF /JS object 21 at offset 0x27D41 5005 bytes
SHA-256: f73818a4f4923d902e721dcd73a34348991f5c3b0042c5e39fec025056106405
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 10 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function mrnBarcode()
{
}// 033777P.pdf
// Based on 828888H.pdf
// fix leading zero problem
// Sept 9, 2004
// extract visit date from PA4
// Set FormId to valueAsString 
// Sept 17, 2004
var PV = this.getField("Patient.VisitNo");
var PA6 = this.getField("Patient.addressograph6");
var PA1 = this.getField("Patient.addressograph1");
var PA2 = this.getField("Patient.addressograph2");
var PA3 = this.getField("Patient.addressograph3");

var PA4 = this.getField("Patient.addressograph4");

//var FormID = this.getField("Forms.FormID").value;

var FormID = this.getField("Forms.FormID").valueAsString;
// var PN1 = this.getField("Patient.name1");
var PfMRN = this.getField("Patient.facilityMRN");
// var PAge1 = this.getField("Patient.age");
var Pmrn = this.getField("Patient.mrn");
var PmrnBarcode = this.getField("Patient.mrnBarcode");
var PVisitNo = "";

// var BarcodeInput = this.getField("Barcode.Input");

// var PmrnBarcode1 = this.getField("Patient.mrnBarcode1");
if (PA6.value !="")
{
   //console.println(util.printd(2, d));
   var PVEnd = PA6.value.length;
   PV.value=PA6.value.substring(16,24);
   // PVisitNo = PA6.value.substring(11,4);
   // console.println ("Visit No : " + PVisitNo);

}

if (PA1.value !="")
{   
console.println ("PA1 [0:2] = " + PA1.valueAsString.substring(0,2) );

  if (PA1.valueAsString.substring(0,2) == "03") {
  var PA6String = PA6.valueAsString;
  var EnDate = "";
  var LocCode = "";
// console.println ("Out Patient detected");
// substring(ending_char + 1,starting_char)
PVisitNo = PA6String.substring(15,11);
console.println ("PA6String : " + PA6String);
  console.println ("Visit No : " + PVisitNo);
//  EnDate = PA6String.substring(33,21);
// substring(ending_char + 1,starting_char)
EnDate = PA4.value.substring(8,0);
// console.println ("EnDate : " + EnDate);
  LocCode = PA4.value.substring(14,9);
}
   // PfMRN.value=PA1.value.substring(4,14);
}

// if (PA2.value !="")
// {   
//   PN1.value=PA2.value;
// }

// if (PA3.value !="")
// {   
//   PAge1.value=PA3.value.substring(1,5);
// }

if (Pmrn.value !="")
{   
var BarcodeInputStr ="";
BarcodeInputStr = PA1.value.substring(4,5) + "|" + Pmrn.valueAsString + "|" + PVisitNo  + "|" + EnDate + "|" + LocCode + "|" + FormID; PmrnBarcode.value=gen_Code128B(BarcodeInputStr);
}



//working code 
function Code128bCharSet() 
{
    var i;
    var Code128bCharSeta = "";
    var strTemp1;
    for (i = 32; i <= 127; i++)
    {
		strTemp1 = String.fromCharCode(eval(i))
       Code128bCharSeta += strTemp1;
    }
    for (i = 193; i <= 199; i++)
    {
		strTemp1 = String.fromCharCode(eval(i))
       Code128bCharSeta += strTemp1;
    }    
	return Code128bCharSeta;
}
function gen_Code128B(BarcodeInput) {
 
var mappingSet=String.fromCharCode(204);
var strtmp="";
var bCharSet = Code128bCharSet();
console.println ("bCharSet = " + bCharSet);
for (var i= 33; i <=126; i++){ 
mappingSet = mappingSet + String.fromCharCode(i);
}

for (var i = 192;  i <=202; i++) {
mappingSet = mappingSet + String.fromCharCode(i);
}
console.println ("mappingSet = " + mappingSet);

console.println ("mappingSet length = " + mappingSet.length);
if (BarcodeInput !="")
{   
     strtmp = BarcodeInput;
 // fix leading 0 problem 
 // strtmp = "" + Pmrn.valueAsString;
console.println("Orginal String = " + BarcodeInput + " strtmp = " + strtmp );

console.println("length of strtmp = " + strtmp.length);

console.println("BarcodeInput.length = " + BarcodeInput.length);

var Code128b ="";
var checkSum = 104;
var charToEncode = "";


Code128b = strtmp;

//for ( var i=0; i<= 7; i=i+2) {
//charToEncode = strtmp.substring(i,i+2);
// console.println ("charToEncode  = " + charToEncode );
//j=charToEncode;
//console.println(" j = " + j);
//ss1 = mappingSet.substring(j - 1);  // get all the string starting at position j. 
//ss2 = ss1.substring(0,1);           // then get string at j only.

//Code128c= Code128c + ss2;

// console.println(" Extract code = " + Code128c);
}
// need convert to string
Code128b = "" + Code128b;
//calc check digit
charToEncode="";
console.println ("Code128b = " + Code128b);
console.println ("Code128b length =" + Code128b.length);
var charval;
var charPos = 0;

for ( var i=0; i< Code128b.length; i++) {
console.println ("Code128b = at " + i + " is " + Code128b);
// charToEncode = Code128b.substring( i, 1);
charToEncode=Code128b.charAt(i);

//charToEncode = Code128b.charAt(i);
console.println ("charToEncode = " + charToEncode);
charval = charToEncode.charCodeAt(0);
charPos = bCharSet.indexOf(charToEncode);
console.println ("charPos = " + charPos);
if (charPos > 0) {
//   checkSum = checkSum + (i+1)*(charPos - 1)
     checkSum += (i+1) * charPos;
}
console.println ("checkSum = " + checkSum);


}

// console.println checksum ;
checkSum = checkSum % 103;
console.println ("checkSum % 103 = " + checkSum );
checkDigit = mappingSet.charAt(checkSum);

var OutCode;
OutCode= String.fromCharCode(201) + Code128b + checkDigit + String.fromCharCode(203) + String.fromCharCode(205);

return OutCode;
}
stream_006_off000186ab.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x186AB 107773 bytes
SHA-256: f8b5634482dabaf0040161953b708d7648a1dc1459beb6e63bf997bafb4818f7
stream_043_off0004b815.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4B815 30627 bytes
SHA-256: 0a165ab3795ff2e8a147401c2a0430d30efe0a4e75a3d6091ec89324454faad8
font_00_sfnt_off000030bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x30BB 35680 bytes
SHA-256: cc4306895cc9c95ea88222838b79fc2d701926d2218b1c0cf16f96cd5307c526
font_01_sfnt_off00007b02.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7B02 20508 bytes
SHA-256: 57244fb0cef40aa8a9ae8e4ef3cacd38c5e226ea12007795d7a7479e6a0e5ef7
font_02_cff_off0000986f.bin pdf-font-stream PDF embedded font (cff) at offset 0x986F 1100 bytes
SHA-256: 2b477611defd46cc7a97c2db1525972cd346212a8b56450a0bbea906ed49cd12
font_03_sfnt_off00009f66.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9F66 89913 bytes
SHA-256: b169d256fd9d8d18305e6b0e92ffe9a2020765447a6abd6610452f1514b4ec93
font_05_sfnt_off0002bedd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2BEDD 77789 bytes
SHA-256: 8822adae4140ddd67ff121d14aa9d6068c461576cb57ed1ec4f496a4560f2fc7

Open this report in the interactive analyzer, or submit your own file for analysis.