Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1ee88dbc041afa0…

MALICIOUS

PDF

587.9 KB Created: ~”oÜÚo7´*Pªì” –=2ÿ*Q{ Authoring application: 6úøçÎ (via {Ê2ŽŽ~JïlØZ¼ÍuTg¹dN9áÂô) First seen: 2026-05-09
MD5: edd50a455353b0720288105bce835d93 SHA-1: 1a32461110e84e11c88f6b0375c51a5d9cc1b2ac SHA-256: c1ee88dbc041afa0d1a6e2ee3d42eb6cec22a40d8113e9bde578be37caf42ddf
204 Risk Score

🔏 Digital signature Modified after signing

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

This PDF file was flagged as malicious by an ML classifier. It contains encrypted content and embedded JavaScript, which is a common technique to hide malicious payloads from static analysis. The presence of PDF_ENCRYPTED_WITH_JS and PDF_JS heuristics strongly suggests that the JavaScript is used to decrypt and execute the hidden malicious content. The document body is unreadable, preventing a more specific analysis of the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8763

Heuristics 12

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Active content added after the PDF was signed medium PDF_SIGNATURE_POST_SIGN_MODIFICATION
    An incremental update appended AFTER the signed byte range introduces active content (/EmbeddedFile). Some of this can occur in legitimate form-fill (field scripts, a rewritten /Catalog), so it is suspicious rather than damning — but it is content the signer did not approve.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.passportcanada.gc.ca Referenced by PDF JavaScript
    • http://www.travel.gc.caReferenced by PDF JavaScript
    • http://www.cic.gc.caReferenced by PDF JavaScript
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.5/Referenced by PDF JavaScript
    • http://www.w3.org/1999/xhtmlReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xfdf/In PDF document text
    • http://ns.adobe.com/xtd/In PDF document text
    • http://www.xfa.org/schema/xfa-form/2.8/In PDF document text
    • http://www.w3.org/2001/XMLSchema-instanceIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 23

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0021.bin pdf-embedded-file PDF EmbeddedFile object 21 at offset 0x36D0 85 bytes
SHA-256: c06dcd026a7ea0536b63e07ce688691b585339a3ab7ff59065e546b56308c7bb
embedded_file_obj0022.bin pdf-embedded-file PDF EmbeddedFile object 22 at offset 0x3784 3341 bytes
SHA-256: e2abb24b818824c8517f07a9534c86810fe02ac2de92f4611a54f5cb28d96c14
embedded_file_obj0023.bin pdf-embedded-file PDF EmbeddedFile object 23 at offset 0x3C75 877238 bytes
SHA-256: 4ab77c12cf05e5c358dd1f713903287de6b7b9f199b9fa998f6ffd5aea5f766b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 85 eval/decoder/string-building token(s). Carved artifact contains 4 long base64-like blob(s).
embedded_file_obj0024.bin pdf-embedded-file PDF EmbeddedFile object 24 at offset 0x25340 7125 bytes
SHA-256: 8ca41e7a63829b1b1469cbc51b17e14ea3b30b405715f48a33bc525c639acf02
embedded_file_obj0025.bin pdf-embedded-file PDF EmbeddedFile object 25 at offset 0x25789 5239 bytes
SHA-256: 454af9a3c7387c75ec5757a59193834d823d272ee0da89d20c76350a0f908943
embedded_file_obj0026.bin pdf-embedded-file PDF EmbeddedFile object 26 at offset 0x25C75 799 bytes
SHA-256: 5a3858e2320448b65b2d44d61cbb8915f91f8cc789bcd21999f6ff4d393321d6
embedded_file_obj0027.bin pdf-embedded-file PDF EmbeddedFile object 27 at offset 0x25E84 110 bytes
SHA-256: b1b296d371e691ae903fc90e2f3bd69eeac3730137d7c7f5d9379aed02cb51d6
embedded_file_obj0028.bin pdf-embedded-file PDF EmbeddedFile object 28 at offset 0x25F33 214 bytes
SHA-256: 0796cb78318af629d0ec59a294644666f2996ec7d0eb2a9583645b1d6126e4da
embedded_file_obj0029.bin pdf-embedded-file PDF EmbeddedFile object 29 at offset 0x26033 55843 bytes
SHA-256: 9938a995f1026048db9ee39260cf91957e93555650e88d336095b08eec1b5463
javascript_obj0149_000.js pdf-javascript-stream PDF /JS object 149 at offset 0x3E691 2798 bytes
SHA-256: 922f7942d25f53e6e6eedc1b3a95c47a757faab3be4838fa02db0dbea2c4dbcc
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
javascript_obj0150_001.js pdf-javascript-stream PDF /JS object 150 at offset 0x3E959 870 bytes
SHA-256: 4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 7.0)
{
   ADBE.Reader_Need_Version = 7.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 7.0)
{
   ADBE.Viewer_Need_Version = 7.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
javascript_obj0151_002.js pdf-javascript-stream PDF /JS object 151 at offset 0x3EAB2 1535 bytes
SHA-256: 04ceb4c2218e7db19a6e007ca4ce846f92c17fff5eaf3a611e71bbd7a5726917
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.1)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 6.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_5x, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.viewerVersion < 7.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
               app.findComponent({cType:"App", cName:"Reader7", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
               app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
         else if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
xfa_image_rawvalue_000.tif pdf-xfa-image-tiff XFA image/rawValue TIFF payload near offset 0xEF9D 4516 bytes
SHA-256: 885d94abc364f92820dc4ceaa613135a17a2d58102daf32ccca532c25b875fd4
xfa_image_rawvalue_001.tif pdf-xfa-image-tiff XFA image/rawValue TIFF payload near offset 0x1097F 2923 bytes
SHA-256: 63565274e03c5a2c507f7833ed49576ab76751cf857c7cb4733e3777bab151fc
xfa_image_rawvalue_002.tif pdf-xfa-image-tiff XFA image/rawValue TIFF payload near offset 0x5CF72 2902 bytes
SHA-256: c4930b7050e70e2da874cfad7223567ef4e89e78a4e07a02a20a37e1e538f25f
embedded_file_obj0354_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 354 at offset 0x35F87; filter decode failed 89 bytes
SHA-256: 7bc0fee89c2e0cd571cb23b4a4f3dcd5935d224ca0e1e347dbc8e2a079641647
embedded_file_obj0355_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 355 at offset 0x3603C; filter decode failed 1172 bytes
SHA-256: 65458e3ff1151943afd149c4a5449dceff5c273b6c4e09dfec31b00122ad677d
embedded_file_obj0356_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 356 at offset 0x3652E; filter decode failed 197112 bytes
SHA-256: 47644824e5303d336ae69be05234e537097dec86536a0ff8cb619271e2eb34d8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 8.00, consistent with packed or encrypted content.
embedded_file_obj0357_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 357 at offset 0x66782; filter decode failed 1006 bytes
SHA-256: e3d1293d4100d747913e10cc590363c94394dcb314d9725d98582da8ba855220
embedded_file_obj0358_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 358 at offset 0x66BCC; filter decode failed 1362 bytes
SHA-256: bdde690e2356834e8aca65ef734e335c59538440ca6b1d91efe204220fc6fc7e
embedded_file_obj0359_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 359 at offset 0x67179; filter decode failed 438 bytes
SHA-256: 7919672678a9f23e2f01bcdffdd5404e55ddd1c5d6228b1c216a38ea52246974
embedded_file_obj0360_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 360 at offset 0x67389; filter decode failed 86 bytes
SHA-256: 60217cf5b5942e31a028c9bdb9b3330456a04b459953d0eee36b0f0339f04ec7
embedded_file_obj0361_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 361 at offset 0x6743A; filter decode failed 166 bytes
SHA-256: 3a7f24877b7447858083ec9409b8a7e3b72da0e9c63f9151ef1419a14e9e21fb

Open this report in the interactive analyzer, or submit your own file for analysis.