Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1e5daa3d77e4eb1…

MALICIOUS

PDF

264.8 KB Created: ¨¼E³z»?J¾3Œî³a¦œuå’6 Authoring application: ¼Õñ#ÿ{Uëo؍ã$þÅ(Aõ—?0 (via ­åì(î{ ?æpÀS·ê3ÿŒråŒ$"‰Èz›b+êd¢) First seen: 2026-05-11
MD5: a62ae1864438d48409b8940f69b8df87 SHA-1: bd981b261a446e9a4eb6c37c202048a54038492a SHA-256: a1e5daa3d77e4eb1ba50b852ddeebf6b74814edd91e20931a52862e20482d26e
200 Risk Score

🔏 Digital signature Modified after signing

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

The PDF file contains multiple embedded JavaScript streams and is encrypted with JavaScript, indicating an attempt to obfuscate its true content and behavior. The presence of a Remote GoTo action and an AcroForm button with an action trigger further suggests malicious intent, likely to download and execute a second-stage payload. The document body is unreadable, reinforcing the idea that the malicious functionality is hidden within the scripts.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7717

Heuristics 10

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Active content added after the PDF was signed medium PDF_SIGNATURE_POST_SIGN_MODIFICATION
    An incremental update appended AFTER the signed byte range introduces active content (/AA). Some of this can occur in legitimate form-fill (field scripts, a rewritten /Catalog), so it is suspicious rather than damning — but it is content the signer did not approve.
  • Remote GoTo action medium PDF_GOTO_REMOTE
    PDF references a remote or embedded document via GoToR/GoToE with an extension-less or unresolved target
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype Referenced by PDF JavaScript
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0030_000.js pdf-javascript-stream PDF /JS object 30 at offset 0x7744 88 bytes
SHA-256: 3297eb72ffaedb9a53d6eff207fc5829bc4e91a86a2124bf4d24c1b28fc02841
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("F.1041", "F.1042", "F.1043", "F.1044", "F.1045"));
javascript_obj0031_001.js pdf-javascript-stream PDF /JS object 31 at offset 0x77CC 38 bytes
SHA-256: dd4e86ff46931388298d522a0c25afc2a74df361f28fb6ad9f104ffc1f5056c1
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "", true);
javascript_obj0032_002.js pdf-javascript-stream PDF /JS object 32 at offset 0x7820 41 bytes
SHA-256: 6aeb2fc8f6b0dba7b9d76914b437aa0140bcd183b4c2b0d2b66173e7a39a1974
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "", true);
javascript_obj0034_003.js pdf-javascript-stream PDF /JS object 34 at offset 0x79C8 79 bytes
SHA-256: a585b0a1c77e84b93d0edc71d3903f35330936fbe7e3723497da2630e07d4d8f
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("F.1047", "F.1048", "F.1049", "F.10410"));
javascript_obj0036_004.js pdf-javascript-stream PDF /JS object 36 at offset 0x7B97 104 bytes
SHA-256: df34390a194c5f85b1e488fa71af64f11c357e7337d861614af56913f9e8285a
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("F.10412", "F.10413", "F.10414", "F.10415", "F.10416", "F.10417"));
javascript_obj0038_005.js pdf-javascript-stream PDF /JS object 38 at offset 0x7D7F 115 bytes
SHA-256: c13ee821d5d686bd44845b0e0391347addaeaab533038480d459837b6fcbe7c0
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("F.10419", "F.10420", "F.10421", "F.10422", "F.10423", "F.10424", "F.10425"));
javascript_obj0040_006.js pdf-javascript-stream PDF /JS object 40 at offset 0x7F75 126 bytes
SHA-256: 6633aa8157314260bf5f2425c4927b494b12fbf6d5cf95975b28acb583faa013
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("F.10427", "F.10428", "F.10429", "F.10430", "F.10431", "F.10432", "F.10433", "F.10434"));
javascript_obj0042_007.js pdf-javascript-stream PDF /JS object 42 at offset 0x8175 98 bytes
SHA-256: 1a06b26a567b8e715f93f62f3600b9c65f71e1fed025d9f7bf2a3e2f32a2aa32
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("F.1131", "F.1132", "F.1133", "F.1134", "F.1135", "F.1136"));
javascript_obj0046_008.js pdf-javascript-stream PDF /JS object 46 at offset 0x8400 135 bytes
SHA-256: 33b36789a60428011af0d5fc66197405c80c6953b5271d7b5e2f07c0d6868c7d
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("F.1138", "F.1139", "F.11310", "F.11311", "F.11312", "F.11313", "F.11314", "F.11315", "F.11316"));
javascript_obj0048_009.js pdf-javascript-stream PDF /JS object 48 at offset 0x8605 82 bytes
SHA-256: 3e2fbb71d611ac41a63c766461cf4424e52c5d8278f652d5ccb839658d48edda
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("F.11318", "F.11319", "F.11320", "F.11321"));
javascript_obj0050_010.js pdf-javascript-stream PDF /JS object 50 at offset 0x87D5 137 bytes
SHA-256: 887d16a37f3002e60ae5ab726596b343216bf8ba136434716021bd67821b87bf
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("F.11323", "F.11324", "F.11325", "F.11326", "F.11327", "F.11328", "F.11329", "F.11330", "F.11331"));
javascript_obj0052_011.js pdf-javascript-stream PDF /JS object 52 at offset 0x89DC 131 bytes
SHA-256: 0b253caf5528536e67a4662825413f1b322ec4343274b5452be506e535c55f29
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("F.105", "F.1056", "F.10511", "F.10518", "F.10526", "F.114", "F.1147", "F.11417", "F.11422"));
javascript_obj0149_012.js pdf-javascript-stream PDF /JS object 149 at offset 0x26644 48 bytes
SHA-256: c9d3ff2f1e1eaf5a1b9c8e76722aeb35b2093f4d26cc7983905010475cb39437
Preview script
First 1,000 lines of the extracted script
// nix

AFNumber_Format(2, 2, 0, 0, "", false);
javascript_obj0288_014.js pdf-javascript-stream PDF /JS object 288 at offset 0x2A691 430 bytes
SHA-256: c1d4d4c34df24ae74199def2dc116771e02db2be52c0f43d9a66b93f88cbd0a6
Preview script
First 1,000 lines of the extracted script
if (this.ADBE == undefined)
    this.ADBE = new Object();
ADBE.LANGUAGE = "DEU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Acrobat - Reader 6.0.2 Update";
ADBE.Reader_string_Need_New_Version_Msg = "F�r diese PDF-Datei ist eine neuere Version von Adobe Reader erforderlich. Klicken Sie auf �OK�, um die neueste Version herunterzuladen, oder wenden Sie sich an Ihren Systemadministrator.";
javascript_obj0289_015.js pdf-javascript-stream PDF /JS object 289 at offset 0x2A7F0 361 bytes
SHA-256: 68ba25850fca5ed937173b9ac6e4d1f6e2464e72161db9546f4e6d20a540a108
Preview script
First 1,000 lines of the extracted script
if (ADBE.Reader_Value_Asked == undefined)
  ADBE.Reader_Value_Asked = false;
if (ADBE.Reader_Need_Version == undefined || ADBE.Reader_Need_Version < 6.0)
{
  ADBE.Reader_Need_Version = 6.0;
  ADBE.Reader_Value_New_Version_URL = "www.adobe.de";
  ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType;
}
javascript_obj0290_016.js pdf-javascript-stream PDF /JS object 290 at offset 0x2A8F9 338 bytes
SHA-256: 2f3a7b409302734f22a8ba5616f7c840e218882ac559109832417c6922d82ea3
Preview script
First 1,000 lines of the extracted script
if (app.viewerType == "Reader")
{
  if (ADBE.Reader_Value_Asked != true)
  {
    if (ADBE.Reader_Need_Version > app.viewerVersion)
    {
       if (app.alert(ADBE.Reader_string_Need_New_Version_Msg, 1, 1) == 1)
        this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
      ADBE.Reader_Value_Asked = true;
    }
  }
}
javascript_obj0291_017.js pdf-javascript-stream PDF /JS object 291 at offset 0x2AA01 865 bytes
SHA-256: f905788c5cc40567b0e67fab266534b05a701d79c57b6e478c116172b4d750b3
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function zw�lf()
{
var r = /[^\d,]/g;       // nur Zahlen oder : erlaubt
var str = event.value + event.change;
var neu = str.match(eval(r));
if (neu) {
app.alert("Es sind nur ganze Zahlen und Kommas erlaubt");
  event.rc = false;            
}
else{
var ev = event.value;
var svor = ev.substring(0,event.selStart);
var snach = ev.substring(event.selEnd,event.value.length);
sneu = svor+event.change+snach;
var komar = sneu.split(","); 
if(komar.length>2){
app.alert("mehr als ein Komma geht nicht!");
  event.rc = false; 
}

if(komar.length==2){
if(komar[1].length>2){//Nachkommastellen
  event.rc = false;
}
if(komar[0].length>12){//Anzahl vor dem Komma
  event.rc = false;
}
}
if(komar.length==1){            
if(sneu.length>12){//Anzahl vor dem Komma
  event.rc = false;
  app.alert("Es sind nur 12-stellige Zahlen vor dem Komma erlaubt");
}
}
}














}
stream_013_off0000f574.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF574 107773 bytes
SHA-256: f8b5634482dabaf0040161953b708d7648a1dc1459beb6e63bf997bafb4818f7
font_00_cff_off0002de33.bin pdf-font-stream PDF embedded font (cff) at offset 0x2DE33 6160 bytes
SHA-256: 365aa02994429c8880eb8adddda574914c763503d2cc5c194bdba65826b0ce46
font_01_cff_off0002f33e.bin pdf-font-stream PDF embedded font (cff) at offset 0x2F33E 6916 bytes
SHA-256: 8e4b39466de4810665c5c345be72d41b8e29511bf4bf5433d8d894a5af68009d
javascript_obj0235_000.js pdf-javascript-stream PDF /JS object 235 at offset 0x2E269 48 bytes
SHA-256: 21ff1985ca90afd3f26954f4cf8120c7a8faba8d0646acba6f2aab8c44418540
Preview script
First 1,000 lines of the extracted script
�X �DUh ��?�f)?�a|�/�/��  �o
V� �T�]��� � 3�M�ӝ
javascript_obj0237_002.js pdf-javascript-stream PDF /JS object 237 at offset 0x2E2F0 48 bytes
SHA-256: e4b2636d843d10bb85a952d7a6926edc7b7e2d33407d68d1b8a2adbec8b77df2
Preview script
First 1,000 lines of the extracted script
�g� (2�!�ҧ.� @�Ged��� ��� �$޽R���yx�M|��v�% ^�
javascript_obj0239_004.js pdf-javascript-stream PDF /JS object 239 at offset 0x2E376 48 bytes
SHA-256: 8d99df05ff1c2d688ef99b8899f2475b1daaab24dbdf9b27553a70beb7b5f94f
Preview script
First 1,000 lines of the extracted script
[Of��;):�=��&{�򩁔47I{!��/� ��JX�,�� T w]#�g�
javascript_obj0241_006.js pdf-javascript-stream PDF /JS object 241 at offset 0x2E3FC 48 bytes
SHA-256: 757d394d283147510f6978f809b49774d0f0a7367b28da3955dde3686e999670
Preview script
First 1,000 lines of the extracted script
R�ѕ��EŬL��mZ ʶ�]��~ �P�  � ��-i� ��:�Hذ<�ݥ
javascript_obj0243_008.js pdf-javascript-stream PDF /JS object 243 at offset 0x2E481 48 bytes
SHA-256: 3869f2f79db728b7a18f30153fcf7e1faf28f350d9de1466aed92646301771f6
Preview script
First 1,000 lines of the extracted script
Z���O 
� n ���K�  �c%�� �
F�*)��'�)o�S�A  g1��U
javascript_obj0245_010.js pdf-javascript-stream PDF /JS object 245 at offset 0x2E50A 48 bytes
SHA-256: 2bcdb9752056d32e6ea4373a2a0642e801aaaa571215822012686a2df5d1b619
Preview script
First 1,000 lines of the extracted script
n&�Wi�)C�t35�%�
�->Q�R2	w� '�� �9����+��S s�Bb
javascript_obj0247_012.js pdf-javascript-stream PDF /JS object 247 at offset 0x2E591 48 bytes
SHA-256: 0c905efcc91c49e9c0f08932319e99f500233fcf35a72bc064c03ff344ad9db1
Preview script
First 1,000 lines of the extracted script
5 �� � f��    l�xB���kˠh���NՀJ� ~yA�&= �Ya �
javascript_obj0249_014.js pdf-javascript-stream PDF /JS object 249 at offset 0x2E616 48 bytes
SHA-256: f7725e52426110de0868f78e3b278f0c8b1570465b8470793053813d77aba461
Preview script
First 1,000 lines of the extracted script
{  9 �j��ƶ �,d"��vh�  ����Ô� ��   t��w��^�  `
javascript_obj0251_016.js pdf-javascript-stream PDF /JS object 251 at offset 0x2E69B 48 bytes
SHA-256: 1926e32070e39de8b8dbf2ff69d9ccc2cda6dbdbf7f514a6bc5a2c2deb87843d
Preview script
First 1,000 lines of the extracted script
�v�@�Y��<>( L�+L$r� ���� C�{Rz5� GkH �  ��4�ෞK
javascript_obj0253_018.js pdf-javascript-stream PDF /JS object 253 at offset 0x2E721 48 bytes
SHA-256: c3780615c892942c8f7f7ad1e75c2501080fdbb28a89c65f84a7f174df9d0a5c
Preview script
First 1,000 lines of the extracted script
��\j��H �� Ǻ �� � �f  i��!��}�M���^�nșR�+�
javascript_obj0255_020.js pdf-javascript-stream PDF /JS object 255 at offset 0x2E7A7 48 bytes
SHA-256: 2f90bfb9be192677b18c06097d8324b46d8b278a1ed57e288aafcd20e425dde7
Preview script
First 1,000 lines of the extracted script
��я�we{�V  �� NyvN�)�� d n� Sn�×y^ڠB�m�8A.$C
javascript_obj0257_022.js pdf-javascript-stream PDF /JS object 257 at offset 0x2E82D 48 bytes
SHA-256: 93af495348f5fd7d3ad7f56a2115160732dd8e5e11e6397e5d7c3b81fd85faa2
Preview script
First 1,000 lines of the extracted script
� � \ 
LS�uҤ�  �iy� �'�� v =���|� 6'��= M )��;

Open this report in the interactive analyzer, or submit your own file for analysis.