PDF static analysis report

Static analysis result for SHA-256 b1c811d3f0e930b0…

CLEAN

PDF

85.7 KB Created: 2018-02-01 09:21:21 -05:00 Authoring application: VF2PDF.dll 2.3.6.0 First seen: 2019-08-04
MD5: 313f4808aa2a2073005d219bc68971cd SHA-1: 053fb60530e884851eb8b6aebbec4570ec788d4a SHA-256: b1c811d3f0e930b0096a9e785f730ba4d92458bd6dcfbdff4cf7a1e247ef20d1
20 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3624

Heuristics 4

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.cerenade.com/ Referenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
🗂 Part of campaign: shared payload 47a4c5a45e 3 samples

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0045_001.js pdf-javascript-stream PDF /JS object 45 at offset 0xAB39 33 bytes
SHA-256: f0a0eef79d820433b6742ba4c20f8407e0f3f78f2a827bda377f7690ca7578a1
Preview script
First 1,000 lines of the extracted script
AFDate_KeystrokeEx("mm-dd-yyyy");
javascript_obj0084_002.js pdf-javascript-stream PDF /JS object 84 at offset 0xBD1F 39 bytes
SHA-256: 19cb1f36a429aa0507c463c0f9e1fd1a4fcfbfb101d1ab03f01074deb708bc56
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 0, 2, 0, "$", true);
javascript_obj0085_003.js pdf-javascript-stream PDF /JS object 85 at offset 0xBD6F 42 bytes
SHA-256: cf1278bfde08fc8d9e4fcb6fae8f62fa8226e80513c38d7d269fb2c17b801e8a
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 0, 2, 0, "$", true);
javascript_obj0227_004.js pdf-javascript-stream PDF /JS object 227 at offset 0x10625 42 bytes
SHA-256: dd30765fc42ee98eaca0ee82309e921ccb10bdf722befbcbcb689823274767de
Preview script
First 1,000 lines of the extracted script
VFMask_Format(event, "###\\-###\\-####*");
javascript_obj0228_005.js pdf-javascript-stream PDF /JS object 228 at offset 0x1067D 44 bytes
SHA-256: 4d371aa2cb359b03fc779cb1f46626e877c4c59676a71b57c6b2269bec28879b
Preview script
First 1,000 lines of the extracted script
VFMask_Validate(event, "###\\-###\\-####*");
javascript_obj0017_006.js pdf-javascript-stream PDF /JS object 17 at offset 0x195A 5737 bytes
SHA-256: 51f27213d39174f734f982279b38c41678cbfa68351fc7c47c4b54ef33b33bb2
Preview script
First 1,000 lines of the extracted script
//-------------------------------------------------------------
// Visual eForms PDF Export JavaScript Functions
// Version 1.1
// Copyright � 2002, 2003 Cerenade. All rights reserved.
// http://www.cerenade.com/
//-------------------------------------------------------------
global.vfEnabled = 28;
global.vfOverwirte = 28;
global.vfVisible = 76;
global.vfBackColor = 9;
global.vfTextColor = 26;
global.RadioGroupStat1 = "";
global.RadioGroupStat2 = "";
global.RadioGroupStat3 = "";
global.RadioGroupStat4 = "";

this.calculateNow();
//-------------------------------------------------------------

function GetFieldValue(FieldName)
{
  var FieldT = this.getField(String(FieldName));
  if (FieldT.type == "checkbox")
  {
    if (FieldT.value == "Yes")
      return 1;
    else
      return 0;
  }
  else
    return FieldT.value;
}
//-------------------------------------------------------------

function VFMask_CheckChar(CharCode, Format)
{
  switch (Format)
  {
    case 65 :
      if (((CharCode < 65) || (CharCode > 90)) &&
          ((CharCode < 97) || (CharCode > 122)))
        return -1;
      break;
    case 85 :
      if ((CharCode < 65) || (CharCode > 90))
        return -1;
      break;
    case 76 :
      if ((CharCode < 97) || (CharCode > 122))
        return -1;
      break;
    case 35 :
      if ((CharCode < 48) || (CharCode > 57))
        return -1;
      break;
    case 33 :
      if (((CharCode < 33) || (CharCode > 47)) &&
          ((CharCode < 58) || (CharCode > 64)) &&
          ((CharCode < 91) || (CharCode > 96)) &&
          ((CharCode < 123) || (CharCode > 126)))
        return -1;
      break;
    case 83 :
      if (CharCode != 32)
        return -1;
      break;
    case 69 :
      if (CharCode != 13)
        return -1;
      break;
    case 46 :
    case 80 :
      return 0;
      break;
    default :
      return -1;
  }
}
//-------------------------------------------------------------

function VFMask_Format(event, FormatStr)
{
  var FieldValue = new String(event.value);
  FormatStr = String(FormatStr);
  var ValueLen = FieldValue.length;
  var FrmtLen = FormatStr.length;
  var StrCnt = 0;
  for(FrmtCnt = 0; FrmtCnt < FrmtLen; FrmtCnt++)
  {
    if (StrCnt >= ValueLen)
      break;
    if (FormatStr.charCodeAt(FrmtCnt) == 92)
    {
      FrmtCnt++;
      if (FormatStr.charCodeAt(FrmtCnt) == FieldValue.charCodeAt(StrCnt))
      {
        StrCnt++;
        continue;
      }
      event.value = event.value.substr(0, StrCnt) +
          FormatStr.substr(FrmtCnt, 1) + event.value.substring(StrCnt);
      FieldValue = event.value;
      StrCnt++;
      ValueLen++;
      continue;
    }
    if (FormatStr.charCodeAt(FrmtCnt) == 42)
      break;
    else if (FormatStr.charCodeAt(FrmtCnt) == 91)
    {
      FrmtCnt++;
      for (; FrmtCnt < FormatStr.length; FrmtCnt++)
        if (FormatStr.charCodeAt(FrmtCnt) == 93)
          break;
    }
    StrCnt++;
  }
}
//-------------------------------------------------------------

function VFMask_Validate(event, FormatStr)
{
  var FieldValue = new String(event.value);
  FormatStr = String(FormatStr);
  var LastFrmt = new String("");
  var ValueLen = FieldValue.length;
  var FrmtLen = FormatStr.length;
  var ValueIsMatch = new Boolean(false);
  var StrCnt = 0;
  for(FrmtCnt = 0; FrmtCnt < FrmtLen; FrmtCnt++)
  {
    if (StrCnt >= ValueLen)
      break;
    if (FormatStr.charCodeAt(FrmtCnt) == 92)
    {
      if ((FrmtCnt == FrmtLen - 1))
      {
        app.alert("Format String is invalid.");
        event.rc = false;
        return -1;
      }
      FrmtCnt++;
      if (FormatStr.charCodeAt(FrmtCnt) == FieldValue.charCodeAt(StrCnt))
      {
        StrCnt++;
        continue;
      }
      continue;
    }
    if (FormatStr.charCodeAt(FrmtCnt) == 42)
    {
      if (FrmtCnt != FrmtLen - 1)
      {
        app.alert("Invalid mask format string.");
        event.rc = false;
        return -1;
      }
      LFrmtLen = LastFrmt.length;
      for (; StrCnt < ValueLen; StrCnt++)
        for (LFrmtCnt = 0; LFrmtCnt < LFrmtLen; LFrmtCnt++)
          if (VFMask_CheckChar(FieldValue.charCodeAt(StrCnt),
              LastFrmt.charCodeAt(LFrmtCnt)))
          {
            app.alert("Invalid format.\r\nThe correct format is \"" + FormatStr + "\".");
            event.rc = false;
            return -1;
          }
      break;
    }
    else if (FormatStr.charCodeAt(FrmtCnt) == 91)
    {
      FrmtCnt++;
      LastFrmt = "";
      ValueIsMatch = false;
      for (; FrmtCnt < FormatStr.length; FrmtCnt++)
      {
        if (FormatStr.charCodeAt(FrmtCnt) == 93)
          break;
        LastFrmt += FormatStr.substr(FrmtCnt, 1);
        if (!VFMask_CheckChar(FieldValue.charCodeAt(StrCnt),
            FormatStr.charCodeAt(FrmtCnt)))
          ValueIsMatch = true;
      }
      if (!ValueIsMatch)
      {
        app.alert("Invalid format.\r\nThe correct format is \"" + FormatStr + "\".");
        event.rc = false;
        return -1;
      }
      StrCnt++;
      continue;
    }
    LastFrmt = FormatStr.substr(FrmtCnt, 1);
    if (VFMask_CheckChar(FieldValue.charCodeAt(StrCnt),
        FormatStr.charCodeAt(FrmtCnt)))
    {
      app.alert("Invalid format.\r\nThe correct format is \"" + FormatStr + "\".");
      event.rc = false;
      return -1;
    }
    else
      StrCnt++;
  }
  if (StrCnt < ValueLen)
  {
    app.alert("Invalid format.\r\nThe correct format is \"" + FormatStr + "\".");
    event.rc = false;
    return -1;
  }
}
//-------------------------------------------------------------
objstm_0297_00.bin pdf-objstm-decoded PDF /ObjStm 297 0 obj (inflated) 16973 bytes
SHA-256: a0c657be3749b0dc124b7bf67030ac32629b6571c4ab49824b6a6b6c5f0c939e
objstm_0303_00.bin pdf-objstm-decoded PDF /ObjStm 303 0 obj (inflated) 7119 bytes
SHA-256: e3d9cd6ade35cbf0e179d4e5dfab72cfead4fca3aaeba05b63a3b952513f9641

Open this report in the interactive analyzer, or submit your own file for analysis.