Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7b4d3b3793633cd…

MALICIOUS

PDF

331.7 KB Created: 2008-05-19 16:50:57 +08:00 Authoring application: Adobe Acrobat 8.1 Combine Files (via Adobe Acrobat 8.1) First seen: 2026-05-10
MD5: 34e296efbad40ecae2c6e3153de196df SHA-1: 2ea41eda79db0de4cef1fe69cc6e4551b38d6c8b SHA-256: c7b4d3b3793633cd539abada4838a929d4b0bdfabbab8b31b12bc33062bd6a94
76 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript/JScript T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The PDF_IMAGE_ONLY_LURE heuristic suggests the document is designed to trick the user into clicking on something, as it contains no readable text operators. The embedded JavaScript stream is the most likely vector for malicious activity, potentially downloading and executing a second-stage payload. No specific family could be identified.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9947

Heuristics 5

  • PDF paints image(s) but contains no text operators medium PDF_IMAGE_ONLY_LURE
    PDF has 1 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
icc_00_off0000238c.icc pdf-icc-profile PDF ICC profile at offset 0x238C 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
CNABB-Q-DE-2008-1-41-P6-S01.pdf pdf-embedded-file PDF EmbeddedFile object 2 at offset 0x1F427 25733 bytes
SHA-256: a51893f16b2c26e70d83c07394179e07bcbe9d9b58d2379d213800b2ad46eb98
Chen_Xin.pdf pdf-embedded-file PDF EmbeddedFile object 3 at offset 0x240A2 211920 bytes
SHA-256: 4dad3f93ab8a129788a653322cc1d78d0a5e86700dba168d32ed03cb599586c4
javascript_obj0031_000.js pdf-javascript-stream PDF /JS object 31 at offset 0x5D0 1946 bytes
SHA-256: 97e6c8fb70f6fedab160a41095c99dce3c9d53a0086d3a8d4e6d47cbe03dce61
Preview script
First 1,000 lines of the extracted script
�� v a r   v   =   a p p . v i e w e r V e r s i o n ; 
 i f   ( v   <   7 ) 
 { 
 	 v a r   n   =   0 ; 
 	 i f   ( t h i s . d a t a O b j e c t s   ! =   n u l l ) 
 	 	 n   =   t h i s . d a t a O b j e c t s . l e n g t h ; 
 	 i f   ( v   > =   5   & &   v   <   6   & &   n   >   0   & &   ( a p p . v i e w e r V a r i a t i o n   = =   " F u l l "   | |   a p p . v i e w e r V a r i a t i o n   = =   " F i l l - I n " ) ) 
 	 { 
 	 	 i f   ( t h i s . e x t e r n a l ) 
 	 	 	 a p p . a l e r t ( "g,e�hcS T+e�N��DN�0 ��g�w �DN�� ��SUQ�  O�[X  c	��geO�[Xe�hcRog,� q6T W(   A c r o b a t  N-bS_ Rog,� ^v�	b�  e�N�   >  e�hc\^`'   >  ]LQev�epcn[��a  0  " ,   3 ,   0 ) ; 
 	 	 e l s e 
 	 	 	 a p p . a l e r t ( "g,e�hcS T+e�N��DN�0 ���	b�  e�N�   >  e�hc\^`'   >  ]LQev�epcn[��a  geg�w �DN�0  " ,   3 ,   0 ) ; 
 	 } 
 	 e l s e   i f   ( v   > =   6   & &   v   <   7 ) 
 	 { 
 	 	 i f   ( n   = =   0 ) 
 	 	 { 
 	 	 	 v a r   n p   =   t h i s . n u m P a g e s ; 
 	 	 	 s y n c A n n o t S c a n ( ) ; 
 	 	 	 f o r   ( v a r   p   =   0 ;   p   <   n p   & &   n   = =   0 ;   + + p ) 
 	 	 	 { 
 	 	 	 	 v a r   a n n o t s   =   t h i s . g e t A n n o t s ( p ) ; 
 	 	 	 	 i f   ( a n n o t s   ! =   n u l l ) 
 	 	 	 	 { 
 	 	 	 	 	 f o r   ( v a r   i   =   0 ;   i   <   a n n o t s . l e n g t h ;   + + i ) 
 	 	 	 	 	 { 
 	 	 	 	 	 	 i f   ( a n n o t s [ i ] . t y p e   = =   " F i l e A t t a c h m e n t " ) 
 	 	 	 	 	 	 { 
 	 	 	 	 	 	 	 n   =   1 ; 
 	 	 	 	 	 	 	 b r e a k ; 
 	 	 	 	 	 	 } 
 	 	 	 	 	 } 
 	 	 	 	 } 
 	 	 	 } 
 	 	 } 
 	 	 i f   ( n   >   0 ) 
 	 	 { 
 	 	 	 i f   ( t h i s . e x t e r n a l ) 
 	 	 	 	 a p p . a l e r t ( "g,e�hcS T+e�N��DN�0 ��g�w �DN�� ��SUQ�e�hcz�S�W�v�n�R�ga�v��v��тrN	��_b� q6T �	b�  e�N��DN�  0  " ,   3 ,   0 ) ; 
 	 	 	 e l s e 
 	 	 	 	 a p p . a l e r t ( "g,e�hcS T+e�N��DN�0 ���	b�  e�hc   >  e�N��DN�  ��SUgeg�w �DN�0  " ,   3 ,   0 ) ; 
 	 	 } 
 	 } 
 }
stream_014_off000005d0.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5D0 1336 bytes
SHA-256: 5c1ab2af46eef55b0d162c3a84464633475df9b138b64aa21a36ffaffbdffa88

Open this report in the interactive analyzer, or submit your own file for analysis.