Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1e31c216b41dfeb…

MALICIOUS

PDF

205.9 KB First seen: 2026-05-09
MD5: e395791e8d8cc8bd6daf042c682c9730 SHA-1: ed56de7dd19abf896042f063b5f154aa254c2305 SHA-256: a1e31c216b41dfeb9722d5ec1dbcd103726617bd08cae2d1f60ad887811004a8
190 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by multiple PDF_JAVASCRIPT and PDF_JS heuristics. A high-confidence PDF_EVAL heuristic firing suggests that the JavaScript is being executed, and the PDF_JS_PROTOTYPE_POLLUTION firing points to a specific JavaScript exploitation technique. The presence of a large embedded script payload (stream_009_off000012b6.js) further supports this. The script likely downloads and executes a second-stage payload. The URL http://www.irs.gov/efile was found, but it is confirmed benign and likely used as a lure.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3804

Heuristics 9

  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Prototype-pollution JavaScript pattern high CVE related PDF_JS_PROTOTYPE_POLLUTION
    PDF JavaScript mutates object prototypes while also referencing privileged or sensitive PDF APIs. This tracks a modern PDF exploit technique family without assigning an unverified CVE.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
                    j = eval('(' + text + ')');
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dorappstest/AdobeMessageEditor/editor.html Referenced by PDF JavaScript
    • http://([0-9.]{7,15})/soap/noserviceIn PDF document text
    • http://www.adobe.com/products/acrobat/readstep2.htmlReferenced by PDF JavaScript
    • http://www.adobe.com/support/products/In PDF document text
    • http://www.xfa.org/schema/xfa-form/2.8/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/In PDF document text
    • http://www.irs.gov/efileReferenced by PDF JavaScript
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/3.0/Referenced by PDF JavaScript
    • http://www.JSON.org/json2.jsReferenced by PDF JavaScript
    • http://www.JSON.org/js.htmlReferenced by PDF JavaScript
    • http://javascript.crockford.com/jsmin.htmlReferenced by PDF JavaScript
    • https://ww2.revenue.wi.govReferenced by PDF JavaScript
    • https://test.revenue.wi.govReferenced by PDF JavaScript
    • http://adobe.com/idp/servicesReferenced by PDF JavaScript
    • http://www.w3.org/1999/xhtmlReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript
    • http://www.w3.org/2001/XMLSchema-instanceReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xci/3.0/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.6/In PDF document text
    • http://www.xfa.org/schema/xfa-connection-set/2.8/In PDF document text
    • http://www.revenue.wi.gov/eserv/installmentagreementIn PDF document text
    • http://ns.adobe.com/data-description/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00000386.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x386 1363 bytes
SHA-256: 529357503ec67b623d2a12816cdeea62bd639f2b4ff4e568b01c96cc3f5bfc6f
stream_003_off00000563.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x563 902 bytes
SHA-256: e985b5df65c8c3cf732a9074b575fbc594c1c7f0bccc0994182ec7e5c0f7308a
stream_008_off00000ef8.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEF8 2216 bytes
SHA-256: 352c05d8bb10578bb0560e207b459b5d7c52c916d056a0a48879aae99356c291
stream_009_off000012b6.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x12B6 981480 bytes
SHA-256: dadd71ed7ba6754a38269d8c244f4a254ede7a281174391cc4ae9d4bb9632483
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s). Carved artifact contains 6 long base64-like blob(s).
stream_010_off0002c8bc.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2C8BC 5694 bytes
SHA-256: 66d744562f32240bf6bbcadd526d2ea3224217fe335fcfa6bb50d71b548be872
stream_011_off0002cc4a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2CC4A 348 bytes
SHA-256: 1077dc2166d3af98a257cd27a25f6ec6334bfdd4b7e12a6ea1c9ed2f28f65990
stream_012_off0002cd85.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2CD85 12814 bytes
SHA-256: fdb0bd2accba123a1340c33bfc1c2ab7cdea24aa635eba1fa49f8e718009100e
objstm_0053_00.bin pdf-objstm-decoded PDF /ObjStm 53 0 obj (inflated) 790 bytes
SHA-256: 9b69ee277c16dffbcfd62d1e7ca04a23c7188dcd40258e21ce7b5161ef4505a6

Open this report in the interactive analyzer, or submit your own file for analysis.