Malicious PDF — malware analysis report

Static analysis result for SHA-256 a0428e57c65c790d…

MALICIOUS

PDF

2.77 MB Created: 2007-03-05 12:49:21 +01:00 Authoring application: PDFPublishing (via Adobe Acrobat 3D Toolkit 4.1.0.0) First seen: 2026-05-09
MD5: e1d191146acd3f95b2672e0ef0bf9500 SHA-1: 406a353e7ae3c556b87d10079c47215deb8a3204 SHA-256: a0428e57c65c790da3021da4242cb42fee396ade7a7b91703a0a9a8bf1a22d4c
384 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that utilizes eval() and unescape() functions, indicative of exploit code. It also references U3D content, a known vector for Adobe Reader exploits. The script attempts to download a payload from 'http://cgi.adobe.com/special/acrobat/update', which is a common lure for exploit kits.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9587

Heuristics 13

  • XFA form contains risky executable script high CVE related PDF_XFA_SCRIPT
    PDF embeds an XFA form whose script block contains exploit, submission/launch, or shell-execution primitives. Ordinary LiveCycle print/update scripts are left as generic XFA/JS signals unless stronger behavior is present.
  • U3D/3D content in PDF — Adobe Reader 3D parser CVE-family indicator high CVE related PDF_U3D_CVE_RELATED
    PDF contains U3D (Universal 3D) or 3D annotation content — CVE-2011-2462 and CVE-2009-3953 are critical vulnerabilities in Adobe Reader's U3D processing that allow arbitrary code execution. U3D content in PDFs is extremely rare in normal documents.
  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Embedded script payload in PDF stream info PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/xhtml In PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.your.domain.comIn PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.4/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.2/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In PDF document text
    • http://ns.adobe.com/xfdf/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 16

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0008.bin pdf-embedded-file PDF EmbeddedFile object 8 at offset 0x19448F 85 bytes
SHA-256: c06dcd026a7ea0536b63e07ce688691b585339a3ab7ff59065e546b56308c7bb
embedded_file_obj0009.bin pdf-embedded-file PDF EmbeddedFile object 9 at offset 0x194540 1333 bytes
SHA-256: a52b82794b2ba40374c792119eaacd1948b550eac1e6dd2673e3648cb6959149
embedded_file_obj0010.bin pdf-embedded-file PDF EmbeddedFile object 10 at offset 0x1947C2 66979 bytes
SHA-256: 53d686b52276fc65cd816534aa6c78b3a153cf34028bed6d3e4de9deca80100c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 17 eval/decoder/string-building token(s).
embedded_file_obj0011.bin pdf-embedded-file PDF EmbeddedFile object 11 at offset 0x19EAD2 2262 bytes
SHA-256: 5f46a4aa50bf20cf566ff569220627bd3d337eb0f82d34eb699337756ad09c73
embedded_file_obj0012.bin pdf-embedded-file PDF EmbeddedFile object 12 at offset 0x19EDB5 142 bytes
SHA-256: e45851fdfd997f7b3eae0f62d6f4820fe7801f3abb9b20f7bb34e90c22f8e732
embedded_file_obj0013.bin pdf-embedded-file PDF EmbeddedFile object 13 at offset 0x19EE7B 724 bytes
SHA-256: 66d8a74dff255b9199ca501fdac605ddf6ab59cd1e319e3123eed98124d9abea
embedded_file_obj0014.bin pdf-embedded-file PDF EmbeddedFile object 14 at offset 0x19F05A 85 bytes
SHA-256: a60265344cf1a9e94da34c8f587f64a4297e2fa417c895852209903ab7588bcc
disclaimer.pdf pdf-embedded-file PDF EmbeddedFile object 16 at offset 0x19F209 10232 bytes
SHA-256: 890cb280c647c2743048717ed8c46eb42225594f115f08c85db53169c8ea46b5
24563-432.stp pdf-embedded-file PDF EmbeddedFile object 17 at offset 0x1AA658 4194304 bytes
SHA-256: e03d21118e203dca811b1c432871fab224cb9767a5bfd2094ab8a0b978a8fec7
javascript_obj0029_000.js pdf-javascript-stream PDF /JS object 29 at offset 0x8D8 1528 bytes
SHA-256: c876171bd867b66b7671fb337ff9e57d18cd15b43d344cf5a7243821300a408a
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.0)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 6.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_5x, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.viewerVersion < 7.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
               app.findComponent({cType:"App", cName:"Reader7", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
               app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
            ADBE.Reader_Value_Asked = true;
         }
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
         else if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
javascript_obj0030_001.js pdf-javascript-stream PDF /JS object 30 at offset 0xABC 870 bytes
SHA-256: 4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 7.0)
{
   ADBE.Reader_Need_Version = 7.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 7.0)
{
   ADBE.Viewer_Need_Version = 7.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
javascript_obj0031_002.js pdf-javascript-stream PDF /JS object 31 at offset 0xC11 3843 bytes
SHA-256: c2d25683b87f35b2c97fd55b4b4d3fb2c8e428989cc7f8de755a12031e1ce557
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7";
ADBE.Reader_string_Need_New_Version_Msg = "Diese PDF-Datei erfordert einen höhere Version von Adobe Reader. Drücken Sie OK, um die neueste Version herunterzuladen, oder wenden Sie sich an Ihren Systemadministrator.";
ADBE.Viewer_Form_string_Reader_601 = "Für dieses PDF-Formular ist eine neuere Version von Adobe Reader erforderlich. Selbst wenn das Formular ordnungsgemäß zu funktionieren scheint, funktionieren einige Elemente möglicherweise nicht einwandfrei oder werden überhaupt nicht angezeigt. Klicken Sie auf "OK", um ein Online-Update zu initiieren, oder wenden Sie sich an den Systemadministrator.";
ADBE.Viewer_Form_string_Reader_Older = "Für dieses PDF-Formular ist eine neuere Version von Adobe Reader erforderlich. Selbst wenn das Formular ordnungsgemäß zu funktionieren scheint, funktionieren einige Elemente möglicherweise nicht einwandfrei oder werden überhaupt nicht angezeigt. Klicken Sie auf "OK", um Informationen über Online-Downloads abzurufen, oder wenden Sie sich an den Systemadministrator.";
ADBE.Viewer_Form_string_Viewer_601 = "Für dieses PDF-Formular ist eine neuere Version von Adobe Acrobat erforderlich. Selbst wenn das Formular ordnungsgemäß zu funktionieren scheint, funktionieren einige Elemente möglicherweise nicht einwandfrei oder werden überhaupt nicht angezeigt. Klicken Sie auf "OK", um ein Online-Update zu initiieren, oder wenden Sie sich an den Systemadministrator.";
ADBE.Viewer_Form_string_Viewer_60 = "Für dieses PDF-Formular ist eine neuere Version von Adobe Acrobat erforderlich. Selbst wenn das Formular ordnungsgemäß zu funktionieren scheint, funktionieren einige Elemente möglicherweise nicht einwandfrei oder werden überhaupt nicht angezeigt. Weitere Informationen erhalten Sie, wenn Sie die folgende Internetadresse aufrufen (indem Sie die URL durch Drücken von STRG+C [Win] oder Befehlstaste+C [Mac] kopieren und in die Adressleiste Ihres Browsers einfügen). Sie können sich auch an Ihren Systemadministrator wenden.";
ADBE.Viewer_Form_string_Viewer_Older = "Für diese PDF-Datei ist eine neuere Version von Adobe Acrobat erforderlich. Kopieren Sie diese URL, und fügen Sie sie in Ihren Browser ein, oder wenden Sie sich an den Systemadministrator.";
ADBE.Viewer_Form_string_Reader_5x = "Dieses PDF-Formular kann nur in einer neueren Adobe Reader-Version verwendet werden. In einer älteren Version wird das Formular zwar angezeigt, doch es funktioniert möglicherweise nicht einwandfrei. Einige Formularelemente werden u. U. überhaupt nicht angezeigt. Wenn eine Internetverbindung zur Verfügung steht, klicken Sie auf "OK", um in Ihrem Browser eine Web-Seite zu öffnen, auf der die aktuelle Version erhältlich ist.";
ADBE.Viewer_Form_string_Reader_6_7x = "Dieses PDF-Formular kann nur in einer neueren Adobe Reader-Version verwendet werden. In einer älteren Version wird das Formular zwar angezeigt, doch es funktioniert möglicherweise nicht einwandfrei. Einige Formularelemente werden u. U. überhaupt nicht angezeigt. Wenn eine Internetverbindung zur Verfügung steht, klicken Sie auf "OK", um die aktuelle Version herunterzuladen und zu installieren";
ADBE.Viewer_Form_string_Viewer_7x = "Dieses PDF-Formular kann nur in einer neueren Adobe Acrobat-Version verwendet werden. In einer älteren Version wird das Formular zwar angezeigt, doch es funktioniert möglicherweise nicht einwandfrei. Einige Formularelemente werden u. U. überhaupt nicht angezeigt. Wenn eine Internetverbindung zur Verfügung steht, klicken Sie auf "OK", um die aktuelle Version herunterzuladen und zu installieren";
javascript_obj0068_003.js pdf-javascript-stream PDF /JS object 68 at offset 0x1929A8 28388 bytes
SHA-256: ea238b8411ff1778f7d753773cf7385e1f004be621419e4a838668af339ad28a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 26 long hex-escaped blob(s).
Preview script
First 1,000 lines of the extracted script
// ==== there placed model meta-data ====
// global arrays

var g_root_assembly = 0;	//workaround for Abbott parts in templates
var g_first_assembly = -1;
var g_active_range = -1;
var g_objects = new Array();
var g_parts = new Array();
var g_cameras = new Array();
var g_boms = new Array();
var g_ranges = new Array();
var g_views = new Array();

// objects of meta-data

function cObject(p_is_assembly, p_name, p_original_name, p_attributes, p_markup_names)
{
	this.is_assembly = p_is_assembly;
	this.name = p_name;
	this.original_name = p_original_name;
	this.attributes = p_attributes;
	this.markup_names = p_markup_names;
}

function AddObject(p_page_idx, p_model_idx, p_is_assembly, p_name, p_original_name, p_attributes, p_markup_names)
{
 	g_objects.push(new cObject(p_is_assembly, p_name, p_original_name, p_attributes, p_markup_names) );
}

function cPart(p_name, p_count, p_child_ids)
{
	this.name = p_name;
	this.count = p_count;
	this.child_ids = p_child_ids;
}

function AddPart(p_page_idx, p_model_idx, p_name, p_count, p_child_ids)
{
	g_parts.push(new cPart(p_name, p_count, p_child_ids) );
}

function cCamera(p_default, p_private, p_name, p_original_name, p_org, p_target, p_up)
{
	this.is_default = p_default;
	this.is_private = p_private;
	this.name = p_name;
	this.original_name = p_original_name;
	this.org = p_org;
	this.target = p_target;
	this.up = p_up;
}

function AddCamera(p_page_idx, p_model_idx, p_default, p_private, p_name, p_original_name, p_org, p_target, p_up)
{
	g_cameras.push(new cCamera(p_default, p_private, p_name, p_original_name, p_org, p_target, p_up) );
}

function cBOM(p_object_id, p_name, p_count, p_child_ids)
{
	this.object_id = p_object_id;
	this.name = p_name;
	this.count = p_count;
	this.child_ids = p_child_ids;
}

function AddBOM(p_page_idx, p_model_idx, p_object_id, p_name, p_count, p_child_ids)
{
	g_boms.push(new cBOM(p_object_id, p_name, p_count, p_child_ids) );
}

function cRange(p_name, p_start, p_end, p_fps)
{
	this.name = p_name;
	this.start = p_start;
	this.end = p_end;
	this.fps = p_fps;
}

function AddRange(p_page_idx, p_model_idx, p_name, p_start, p_end, p_fps)
{
	g_ranges.push(new cRange(p_name, p_start, p_end, p_fps) );
}

function cView(p_is_step, p_name, p_desc, p_object_id, p_camera_id, p_object_names, p_ranges_ids)
{
	this.is_step = p_is_step;
	this.name = p_name;
	this.description = p_desc;
	this.object_id = p_object_id;
	this.camera_id = p_camera_id;
	this.object_names = p_object_names;
	this.step_ids = p_ranges_ids;
}

function AddView(p_page_idx, p_model_idx, p_is_step, p_name, p_desc, p_object_id, p_camera_id, p_object_names, p_ranges_ids)
{
	g_views.push(new cView(p_is_step, p_name, p_desc, p_object_id, p_camera_id, p_object_names, p_ranges_ids) );
}

// filling the meta-data structures
AddObject(0, 0, false,
	"r2",
	"R2",
	{

	},
	[

	] );
AddObject(0, 0, false,
	"r21",
	"R21",
	{

	},
	[

	] );
AddObject(0, 0, false,
	"r210",
	"R210",
	{

	},
	[

	] );
AddObject(0, 0, false,
	"r211",
	"R211",
	{

	},
	[

	] );
AddObject(0, 0, false,
	"r212",
	"R212",
	{

	},
	[

	] );
AddObject(0, 0, false,
	"r213",
	"R213",
	{

	},
	[

	] );
AddObject(0, 0, false,
	"r214",
	"R214",
	{

	},
	[

	] );
AddObject(0, 0, false,
	"r215",
	"R215",
	{

	},
	[

	] );
AddObject(0, 0, false,
	"r216",
	"R216",
	{

	},
	[

	] );
AddObject(0, 0, false,
	"r22",
	"R22",
	{

	},
	[

	] );
AddObject(0, 0, false,
	"r23",
	"R23",
	{

	},
	[

	] );
AddObject(0, 0, false,
	"r24",
	"R24",
	{

	},
	[

	] );
AddObject(0, 0, false,
	"r25",
	"R25",
	{

	},
	[

	] );
AddObject(0, 0, false,
	"r26",
	"R26",
	{

	},
	[

	] );
AddObject(0, 0, false,
	"r27",
	"R27",
	{

	},
	[

	] );
AddObject(0, 0, false,
	"r28",
	"R28",
	{

	},
	[

	] );
AddObject(0, 0, false,
	"r29",
	"R29",
	{

	},
	[

	] );

g_first_assembly = 17;

AddObject(0, 0, true,
	"24563_432_o",
	"24563-4
... (truncated)
stream_013_off00024ccb.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x24CCB 2594988 bytes
SHA-256: 58784d0900e72d495a2d6189537e9724676a089a72396799214dbfff7f670848
font_00_cff_off000070be.bin pdf-font-stream PDF embedded font (cff) at offset 0x70BE 66185 bytes
SHA-256: 28345a751bc247acbf8155171a43d69e366aa8df344a8a0a8a8304436513e01c
font_01_cff_off00012532.bin pdf-font-stream PDF embedded font (cff) at offset 0x12532 64586 bytes
SHA-256: 96161e3d15cf67591ef2a1c87940c8dc0af59a94fcfab5d6bfcf4cb992a24af8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.45, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.