PDF static analysis report

Static analysis result for SHA-256 adbc8f2269ced5e3…

SUSPICIOUS

PDF

626.8 KB First seen: 2026-05-11
MD5: dc73916f7b97d3419c9d5c943ca3d898 SHA-1: 6acd93d9a7518e8c32135743cbe60b7979660895 SHA-256: adbc8f2269ced5e39258653610ac3095be15b961811c70ec558e2ec2a79d7acd
58 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File T1566.001 Spearphishing Attachment T1204 User Execution

The PDF file contains embedded JavaScript and an embedded script payload, indicating an attempt to execute malicious code. The heuristics suggest that this script is likely designed to download and execute a secondary payload, as evidenced by the 'PDF_EMBEDDED_SCRIPT_PAYLOAD' firing and the presence of a large embedded binary file. The document body was not sufficiently readable to determine a specific lure, but the overall structure points to a malicious PDF designed for exploitation.

Machine Learning

  • Nyx PDF Classifier clean score 0.0294

Heuristics 8

  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ocsp.verisign.com0 Referenced by PDF JavaScript
    • http://www.monotype.comMonotypeReferenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/Referenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/mm/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://purl.org/dc/elements/1.1/Referenced by PDF JavaScript
    • http://ns.adobe.com/pdf/1.3/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/t/pg/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#In PDF document text
    • http://ns.adobe.com/xap/1.0/g/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/Referenced by PDF JavaScript
    • http://ns.adobe.com/photoshop/1.0/In PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • http://ns.adobe.com/exif/1.0/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://crl.verisign.com/tss-ca.crl0Referenced by PDF JavaScript
    • http://crl.verisign.com/ThawteTimestampingCA.crl0Referenced by PDF JavaScript
    • https://www.verisign.com/rpaReferenced by PDF JavaScript
    • https://www.verisign.com/rpa01Referenced by PDF JavaScript
    • http://crl.verisign.com/pca3.crl0Referenced by PDF JavaScript
    • http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0DReferenced by PDF JavaScript
    • https://www.verisign.com/rpa0Referenced by PDF JavaScript
    • http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0Referenced by PDF JavaScript
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlReferenced by PDF JavaScript
    • http://ocsp.verisign.com/ocsp/status0Referenced by PDF JavaScript
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0Referenced by PDF JavaScript
    • http://www.microsoft.com/typographyReferenced by PDF JavaScript
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript
    • http://ns.adobe.com/xdp/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xci/2.6/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xci/2.8/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.6/Referenced by PDF JavaScript
    • http://www.w3.org/1999/xhtmlReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-locale-set/2.7/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-form/2.8/Referenced by PDF JavaScript
    • http://ns.adobe.com/xfdf/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0001.bin pdf-embedded-file PDF EmbeddedFile object 1 at offset 0x72184 163 bytes
SHA-256: d82e04aedd681f1d18ceda75b35a55dbf99ca34e29b98950e26a325ca84a3f7f
embedded_file_obj0002.bin pdf-embedded-file PDF EmbeddedFile object 2 at offset 0x72275 1741 bytes
SHA-256: 07bea0a40d368f93324cee7d7482e1e42d467fb3ceafc42d0b001800fe511ba0
embedded_file_obj0003.bin pdf-embedded-file PDF EmbeddedFile object 3 at offset 0x725B5 69942 bytes
SHA-256: 1dc1c8f54cfbebeb3b36eb3f9b9090dd31495d43a223fedb6d13f3ebcc4185aa
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
embedded_file_obj0004.bin pdf-embedded-file PDF EmbeddedFile object 4 at offset 0x74230 2079 bytes
SHA-256: a05e56c5ddc2fd45346c29a736ed164b9a962009f18f26a688b6ab511b7d4cd5
embedded_file_obj0005.bin pdf-embedded-file PDF EmbeddedFile object 5 at offset 0x743B4 7779 bytes
SHA-256: 6a07be8c49ad977b7163e66c8918baf6744d6c4c59edf2a165d87a239df1088e
embedded_file_obj0006.bin pdf-embedded-file PDF EmbeddedFile object 6 at offset 0x74917 1877 bytes
SHA-256: 34336c4e46f8f4657905dc98a651fc4e9a9257999f8b9c6b0424e5a3fdc9f172
embedded_file_obj0007.bin pdf-embedded-file PDF EmbeddedFile object 7 at offset 0x74C2A 80 bytes
SHA-256: 2ebdd7efeaa1190ff6bad8cbd649b313e3969564018f204e7385b97c2fab1e19
embedded_file_obj0008.bin pdf-embedded-file PDF EmbeddedFile object 8 at offset 0x74CD3 56 bytes
SHA-256: 4a60a9864cdf7382475d51051a03fdc43b32c31eb508893ccfccece34957f9f1
embedded_file_obj0703.bin pdf-embedded-file PDF EmbeddedFile object 703 at offset 0x9621F 2825 bytes
SHA-256: 2967393302ef13e98f07508a75ffb4d8edcca7c73e6c5bc2258036bb364d1d9b
embedded_file_obj0704.bin pdf-embedded-file PDF EmbeddedFile object 704 at offset 0x963F2 85 bytes
SHA-256: c06dcd026a7ea0536b63e07ce688691b585339a3ab7ff59065e546b56308c7bb
embedded_file_obj0752.bin pdf-embedded-file PDF EmbeddedFile object 752 at offset 0x9B2D2 2773 bytes
SHA-256: 98b7a22a8e3d3000ca37528679332e2952d78f19e808e7d2e3b75e64e556b768
stream_002_off00000581.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x581 1313 bytes
SHA-256: f94e41f586bf3f20bc1deeac4bfbda388a61db43f25fbd6304ba73f5653368cf
stream_003_off00000760.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x760 902 bytes
SHA-256: 1b2ec98752b966f601d5223a750559cf13d562ac5e5c6d1fcc7217835b01f5fd
stream_013_off00011939.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11939 367087 bytes
SHA-256: b8e2518b116c26bab0e9f8c1672daf405dedad561157502b657e9005be2029aa
stream_056_off0004fad3.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4FAD3 37130 bytes
SHA-256: 4a5dc260e325582164cf7bf9f5bad420bdc88ef80cb74acdf805840b363bc38b
objstm_0285_00.bin pdf-objstm-decoded PDF /ObjStm 285 0 obj (inflated) 40518 bytes
SHA-256: 7eb67b4fbabdc0896f9f785c4438ea435ad42b7ae9947dd0ddafe184986b254e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 6 long base64-like blob(s).
font_00_sfnt_off00000e3c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3C 95975 bytes
SHA-256: c29e5b1537bee8c88b3ffca56c5f24a45ec8da374cf9d4c0b4a78d04fc230949
font_01_cff_off0007736c.bin pdf-font-stream PDF embedded font (cff) at offset 0x7736C 465 bytes
SHA-256: 7ed3926dcb80d54faad8945ca4ead72ac2dabdc08863a45fb0aa56716afffe89
font_02_cff_off00077a2c.bin pdf-font-stream PDF embedded font (cff) at offset 0x77A2C 465 bytes
SHA-256: 891e4775bfbf53bcab64377dadf0b0911c4840b1d3c70f28e9f58ea70e13960a
font_04_cff_off000787ac.bin pdf-font-stream PDF embedded font (cff) at offset 0x787AC 465 bytes
SHA-256: 670985580efc6ae52ddba1b79a55f47826759b91c520f9e3d3a15769af0db84c
font_06_cff_off00079530.bin pdf-font-stream PDF embedded font (cff) at offset 0x79530 465 bytes
SHA-256: ae8a8d2b1bcab542a7d4adc3278d57e98e0eb4e44a3d8fed99c9973861724347
font_07_sfnt_off00079bc6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x79BC6 52659 bytes
SHA-256: e25e1f616fe7e284c6ebcbf1736825e1a4bd9ccec9d4f6a4da8d9d5425a1d2c5
font_08_cff_off0007f1ad.bin pdf-font-stream PDF embedded font (cff) at offset 0x7F1AD 465 bytes
SHA-256: 7918503c6d66332a970e4f210b7d6b281a48110ae419927daf9a35da8323e2ec
font_11_cff_off000805ed.bin pdf-font-stream PDF embedded font (cff) at offset 0x805ED 465 bytes
SHA-256: 02e07e0d9ab7492a15b7b81e26298ed493244af4f07d790ba4c3b867c4254c2c
font_13_cff_off0008136d.bin pdf-font-stream PDF embedded font (cff) at offset 0x8136D 465 bytes
SHA-256: 06058bda5f4dcf8e16e2b6fba01331e0a13e62adb767914ea7d920625d191d34
font_16_cff_off000827ad.bin pdf-font-stream PDF embedded font (cff) at offset 0x827AD 465 bytes
SHA-256: 02fe123d453346ff33ae00118f7846f3224db3c431581e00b0457aac6b914249
font_18_sfnt_off0008351f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8351F 52833 bytes
SHA-256: 635c9fca34af39f2e6eaca2e1bcc06a9bec7bac4f8b081ad40924a374e597253
font_19_cff_off00088d0c.bin pdf-font-stream PDF embedded font (cff) at offset 0x88D0C 465 bytes
SHA-256: cc836b64f7b2e750f0ebcdbfa49acda7ef56ccf1c405e5b7c999b27813a4f4d7
font_20_cff_off000893ce.bin pdf-font-stream PDF embedded font (cff) at offset 0x893CE 465 bytes
SHA-256: a9ebd9f2d6725f218020a595dbb18ef181cf006a6c6f8de2321a3d39c7cdf7c4
font_23_cff_off0008a814.bin pdf-font-stream PDF embedded font (cff) at offset 0x8A814 465 bytes
SHA-256: 48da01b0b479ba7e7acacd5703c2e88cde67afe5562c9e2b893fddbda38b32e0
font_25_cff_off0008b598.bin pdf-font-stream PDF embedded font (cff) at offset 0x8B598 465 bytes
SHA-256: 46b0a1ef118b1ac566ca6aae6905b50fc50872a8f6289942016d0b2775b09176
font_28_cff_off0008c9de.bin pdf-font-stream PDF embedded font (cff) at offset 0x8C9DE 465 bytes
SHA-256: faffe69d6dbcb271aefa2cf90b3f1b3e17a54648d47231bf71e9ed7d2d104a91

Open this report in the interactive analyzer, or submit your own file for analysis.