Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5cf3bb3850c459c…

MALICIOUS

PDF

693.1 KB Created: 2007-12-20 10:19:03 -05:00 Authoring application: Acrobat PDFMaker 8.1 for Word (via Acrobat Distiller 8.1.0 (Windows)) First seen: 2026-05-07
MD5: 0e6c7628af51ad5e43dd35a60c6f2a5f SHA-1: 255fdcfb26322c80ca883d2642281c83f1b5a8b7 SHA-256: b5cf3bb3850c459c3cf18beffb9fd050f08b0633b9972e3903152c61a6676d14
206 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.007 JavaScript

The PDF file contains multiple embedded JavaScript streams and an embedded script payload, indicating an attempt to execute malicious code. The presence of TrueType bitmap font and active content, along with a high ML classifier score, strongly suggests exploitation of a known vulnerability such as CVE-2023-26369. The document body appears to be form fields, which could be used in a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8926

Heuristics 9

  • TrueType bitmap font + active content — CVE-2023-26369 related high CVE related PDF_CVE_2023_26369_RELATED
    PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
  • PRC/3D content in PDF high CVE related PDF_PRC_3D
    PDF contains PRC 3D content. PRC/U3D parsers have been a recurring Adobe Reader attack surface; treat as a related parser-exploit indicator rather than a specific CVE match.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Embedded script payload in PDF stream info PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/ In PDF document text
    • http://www.xfa.org/schema/xci/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.5/In PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In PDF document text
    • http://ns.adobe.com/xtd/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xfdf/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0308_000.js pdf-javascript-stream PDF /JS object 308 at offset 0x1157 1604 bytes
SHA-256: f979542c4992f256c12537db5bbe5f86605da11ef877e634ccfc2c47c9284b10
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 1.2)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 6.01)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_Older, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
               app.findComponent({cType:"Plugin", cName:"XFA",
                                   cDesc: ADBE.Viewer_string_Update_Reader_Desc});
         }
         ADBE.Reader_Value_Asked = true;
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion == 6)
         {
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_60,
            cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO,
            cTitle: ADBE.Viewer_string_Title});
         }
         else if (app.viewerVersion < 6)
         {
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older,
            cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO,
            cTitle: ADBE.Viewer_string_Title});
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Viewer_601, 1, 1) == 1)
                app.findComponent({cType:"Plugin", cName:"XFA",
                                   cDesc: ADBE.Viewer_string_Update_Desc});
         }
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
javascript_obj0309_001.js pdf-javascript-stream PDF /JS object 309 at offset 0x1340 902 bytes
SHA-256: 3bf84668674e23c91aaaa6c58c24a1f80a30566e9cfbd09040882d18101fed76
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 6.01)
{
   ADBE.Reader_Need_Version = 6.03
   ADBE.Reader_Value_New_Version_URL =
       "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l="
       + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_5";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 6.01)
{
   ADBE.Viewer_Need_Version = 6.03;
   ADBE.Viewer_Value_New_Version_URL =
       "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" 
       + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_5";
}
javascript_obj0310_002.js pdf-javascript-stream PDF /JS object 310 at offset 0x14AB 2798 bytes
SHA-256: 922f7942d25f53e6e6eedc1b3a95c47a757faab3be4838fa02db0dbea2c4dbcc
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
embedded_pdf_script_000168cf.bin pdf-embedded-script PDF raw stream script payload at offset 0x168CF 3107 bytes
SHA-256: 6808ac386cf1021213427e8c4c296469d470383c8cbe18fa44fe1e8bddd87b51
Preview script
First 1,000 lines of the extracted script
<config xmlns="http://www.xfa.org/schema/xci/1.0/"
><agent name="designer"
><destination
>pdf</destination
><pdf
><!--  [0..n]  --><fontInfo
></fontInfo
></pdf
></agent
><trace
><area level="1" name="font"
></area
></trace
><present
><!--  [0..n]  --><pdf
><!--  [0..n]  --><fontInfo
><embed
>0</embed
><subsetBelow
>100</subsetBelow
></fontInfo
><version
>1.5</version
><creator
>Adobe LiveCycle Designer 8.0</creator
><producer
>Adobe LiveCycle Designer 8.0</producer
><interactive
>1</interactive
><tagged
>1</tagged
><compression
><level
>6</level
><compressLogicalStructure
>1</compressLogicalStructure
><type
></type
></compression
><linearized
>1</linearized
><batchOutput
></batchOutput
><encryption
><encrypt
></encrypt
><permissions
><accessibleContent
>1</accessibleContent
><contentCopy
>1</contentCopy
><documentAssembly
>1</documentAssembly
><formFieldFilling
>1</formFieldFilling
><modifyAnnots
>1</modifyAnnots
><print
>1</print
><printHighQuality
>1</printHighQuality
><change
>1</change
><plaintextMetadata
>1</plaintextMetadata
></permissions
></encryption
><openAction
><destination
></destination
></openAction
><scriptModel
></scriptModel
><taggedMode
></taggedMode
><viewerPreferences
><addViewerPreferences
></addViewerPreferences
><duplexOption
></duplexOption
><numberOfCopies
></numberOfCopies
><pageRange
></pageRange
></viewerPreferences
><silentPrint
><addSilentPrint
></addSilentPrint
><printerName
></printerName
></silentPrint
></pdf
><xdp
><packets
>*</packets
></xdp
><common
><data
><uri
></uri
><adjustData
>1</adjustData
><xsl
><uri
></uri
></xsl
><outputXSL
><uri
></uri
></outputXSL
></data
><messaging
></messaging
><log
><to
>memory</to
><uri
>C:\DOCUME~1\HABIBA~1\LOCALS~1\Temp\_9ak162el323fbbjm.log</uri
><mode
>overwrite</mode
><threshold
></threshold
></log
><template
><base
>C:\DOCUME~1\HABIBA~1\LOCALS~1\Temp\</base
><relevant
></relevant
><uri
></uri
></template
><locale
></locale
></common
><cache
><renderCache
></renderCache
></cache
><incrementalMerge
></incrementalMerge
><script
><runScripts
></runScripts
><exclude
></exclude
><currentPage
></currentPage
></script
><pagination
></pagination
><copies
></copies
><layout
></layout
><destination
>pdf</destination
><output
><to
>uri</to
><uri
>C:\DOCUME~1\HABIBA~1\LOCALS~1\Temp\_9ak162el328c53qq.tmp</uri
></output
></present
><agent name="acrobat"
><common
><locale
></locale
><data
><uri
></uri
><adjustData
>1</adjustData
><xsl
><uri
></uri
></xsl
><outputXSL
><uri
></uri
></outputXSL
></data
><template
><base
>C:\DOCUME~1\HABIBA~1\LOCALS~1\Temp\</base
><relevant
></relevant
><uri
></uri
></template
></common
></agent
><psMap
></psMap
><coolType
><additionalFontsDirectory
>C:\Program Files\Adobe\Acrobat 8.0\Designer 8.0\fonts</additionalFontsDirectory
><commonFontsDirectory
>C:\Program Files\Adobe\Acrobat 8.0\Designer 8.0\fonts</commonFontsDirectory
><unicodeDirectory
>C:\Program Files\Adobe\Acrobat 8.0\Designer 8.0\fonts\typeSpt\Unicode</unicodeDirectory
><fntNamesDBFile
>C:\Program Files\Adobe\Acrobat 8.0\Designer 8.0\fonts\typeSpt\FntNames.db</fntNamesDBFile
></coolType
></config
>
icc_00_off0000a314.icc pdf-icc-profile PDF ICC profile at offset 0xA314 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_sfnt_off0000fbd0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBD0 26228 bytes
SHA-256: 513cd6a39a7f12c27e22aa34801338ee0a7301d6e5c8a1246131b7398993b79c

Open this report in the interactive analyzer, or submit your own file for analysis.