Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae0cabf88a6f5790…

MALICIOUS

PDF

468.0 KB Created: 2007-09-18 14:27:28 -05:00 Authoring application: Adobe Acrobat 8.0 Combine Files (via Adobe Acrobat 8.0) First seen: 2026-05-10
MD5: 0ecc5c31762016853367569bb88a5495 SHA-1: e444e91a1cd8ff015493e473f50182058d54f490 SHA-256: ae0cabf88a6f5790aa76e34d51efb6c99166d59b80f686c672c1d489c06383a6
166 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

This PDF file contains multiple JavaScript streams and an embedded PDF, indicating a multi-stage attack. The embedded JavaScript is likely responsible for downloading and executing a secondary payload. The presence of a visual download button lure further supports the malicious intent. The embedded PDF itself contains suspicious static findings, including JavaScript actions and form buttons, suggesting it is part of the malicious workflow.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9527

Heuristics 12

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • Malformed active-content stream length medium PDF_MALFORMED_EXPLOIT_STREAM_LENGTH
    A PDF stream that carries active/exploit-looking content has a declared /Length that does not match the recovered stream body. Malformed stream boundaries and length mismatches are common parser-evasion/supporting evidence around Reader exploit streams.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.adobe.com/products/acrobat/readstep2.html PDF link annotation
    • http://www.adobe.com/products/acrobat/readstep2.html)/S/URI/IsMapIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by PDF JavaScript
    • http://ns.adobe.com/pdf/1.3/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/Referenced by PDF JavaScript
    • http://purl.org/dc/elements/1.1/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/mm/Referenced by PDF JavaScript
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 14

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0101_000.js pdf-javascript-stream PDF /JS object 101 at offset 0xC71 1604 bytes
SHA-256: f979542c4992f256c12537db5bbe5f86605da11ef877e634ccfc2c47c9284b10
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 1.2)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 6.01)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_Older, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
               app.findComponent({cType:"Plugin", cName:"XFA",
                                   cDesc: ADBE.Viewer_string_Update_Reader_Desc});
         }
         ADBE.Reader_Value_Asked = true;
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion == 6)
         {
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_60,
            cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO,
            cTitle: ADBE.Viewer_string_Title});
         }
         else if (app.viewerVersion < 6)
         {
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older,
            cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO,
            cTitle: ADBE.Viewer_string_Title});
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Viewer_601, 1, 1) == 1)
                app.findComponent({cType:"Plugin", cName:"XFA",
                                   cDesc: ADBE.Viewer_string_Update_Desc});
         }
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
javascript_obj0102_001.js pdf-javascript-stream PDF /JS object 102 at offset 0xE5A 902 bytes
SHA-256: 3bf84668674e23c91aaaa6c58c24a1f80a30566e9cfbd09040882d18101fed76
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 6.01)
{
   ADBE.Reader_Need_Version = 6.03
   ADBE.Reader_Value_New_Version_URL =
       "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l="
       + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_5";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 6.01)
{
   ADBE.Viewer_Need_Version = 6.03;
   ADBE.Viewer_Value_New_Version_URL =
       "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" 
       + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_5";
}
javascript_obj0103_002.js pdf-javascript-stream PDF /JS object 103 at offset 0xFC5 2798 bytes
SHA-256: 922f7942d25f53e6e6eedc1b3a95c47a757faab3be4838fa02db0dbea2c4dbcc
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
font_00_cff_off00002361.bin pdf-font-stream PDF embedded font (cff) at offset 0x2361 85952 bytes
SHA-256: e0b74124f131f1d8e85f1769181d3cdcb2b3a1f2d5d9fac5b13777fc512f46a7
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.44, consistent with packed or encrypted content.
Foreign.pdf pdf-embedded-file PDF EmbeddedFile object 5 at offset 0x66C6 48807 bytes
SHA-256: 35d4c5132501a4f3e321bd4223a65136ec73cb9e07a5528e042a166b5b693957
Reciprocity_Instructions.pdf pdf-embedded-file PDF EmbeddedFile object 8 at offset 0x30975 2638 bytes
SHA-256: a080f279499531728bde5fdd9749d6d7f9af3d27830ffbfd6a298526cd977cbc
2010_HVAC_Contractor_Form.pdf pdf-embedded-file PDF EmbeddedFile object 7 at offset 0x31807 73774 bytes
SHA-256: 7fa7ca82c85860b038d842b248b6b2e52b60380b439786a9ebe886595fd24c60
embedded_file_obj0013.bin pdf-embedded-file PDF EmbeddedFile object 13 at offset 0x64BED 1995 bytes
SHA-256: 8e84902424c45b24862622a755ccb1fa65e5896cc230f8a46b910f2a93e17b4e
new_bond.pdf pdf-embedded-file PDF EmbeddedFile object 9 at offset 0x70DF6 16891 bytes
SHA-256: 73834755451db215b0fdd6014ee5a4c3ddd4aeeef9019ca7784333b0a7673b3e
javascript_obj0072_000.js pdf-javascript-stream PDF /JS object 72 at offset 0x728 1379 bytes
SHA-256: 736c69993d4cd953676f5971bd943955c344f3001c77f281afd5d8df5a456b51
Preview script
First 1,000 lines of the extracted script
var v = app.viewerVersion;
if (v < 7)
{
	var n = 0;
	if (this.dataObjects != null)
		n = this.dataObjects.length;
	if (v >= 5 && v < 6 && n > 0 && (app.viewerVariation == "Full" || app.viewerVariation == "Fill-In"))
	{
		if (this.external)
			app.alert("This document has file attachments. To view the attachments, click the Save button to save a copy of the document, open the copy in Acrobat, and use the File > Document Properties > Embedded Data Objects menu.", 3, 0);
		else
			app.alert("This document has file attachments. Use the File > Document Properties > Embedded Data Objects menu to view the attachments.", 3, 0);
	}
	else if (v >= 6 && v < 7)
	{
		if (n == 0)
		{
			var np = this.numPages;
			syncAnnotScan();
			for (var p = 0; p < np && n == 0; ++p)
			{
				var annots = this.getAnnots(p);
				if (annots != null)
				{
					for (var i = 0; i < annots.length; ++i)
					{
						if (annots[i].type == "FileAttachment")
						{
							n = 1;
							break;
						}
					}
				}
			}
		}
		if (n > 0)
		{
			if (this.external)
				app.alert("This document has file attachments. To view the attachments, click the black triangle at the top of the document window's vertical scrollbar and choose File Attachments.", 3, 0);
			else
				app.alert("This document has file attachments. Use the Document > File Attachments menu to view the attachments.", 3, 0);
		}
	}
}
icc_00_off00002785.icc pdf-icc-profile PDF ICC profile at offset 0x2785 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_cff_off000031e9.bin pdf-font-stream PDF embedded font (cff) at offset 0x31E9 3343 bytes
SHA-256: 03f004927ca314ec5dd7da0be0d26dd0196a80bb4e478c7921660dd83737b631
font_01_cff_off00004171.bin pdf-font-stream PDF embedded font (cff) at offset 0x4171 3582 bytes
SHA-256: 5eff8bf8cc14b7c8264a4c4600a967db515a9954b09974206ba811cd806be20b
font_02_cff_off00005224.bin pdf-font-stream PDF embedded font (cff) at offset 0x5224 2083 bytes
SHA-256: 5e5d2cbabc995740b019cb0c5127bbab328ccc709469618e5e200a6d6f53dbdd

Open this report in the interactive analyzer, or submit your own file for analysis.