Malicious PDF — malware analysis report

Static analysis result for SHA-256 c9a48bc989edeb5b…

MALICIOUS

PDF

435.0 KB Created: Îý—D¤Mö0Q±Orówî%t¼¨d\ Authoring application: ˤ×öQâR%Æ;!®'ª(woª¸2C_ÏÅG (via ˤ×öQâFó)©.½zoyµ©zKDK_ÉÙGü) First seen: 2026-05-09
MD5: b0143864b05826aacf541b131df93a74 SHA-1: 5dfa47700ab5727dc71f2ca5820d976487ed2a0a SHA-256: c9a48bc989edeb5b41c878d7f3d0a1eee1b6c362d87225ed4814fab45aac90e3
104 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF file was flagged as malicious by an ML classifier and contains embedded JavaScript, which is used to obscure its content. The presence of JavaScript actions and encrypted content suggests an attempt to hide a malicious payload from static analysis. While several URLs are present, they are all confirmed as benign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8020

Heuristics 6

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xci/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.5/In PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In PDF document text
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0347_000.js pdf-javascript-stream PDF /JS object 347 at offset 0x27691 2798 bytes
SHA-256: 922f7942d25f53e6e6eedc1b3a95c47a757faab3be4838fa02db0dbea2c4dbcc
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
javascript_obj0348_001.js pdf-javascript-stream PDF /JS object 348 at offset 0x27959 902 bytes
SHA-256: 3bf84668674e23c91aaaa6c58c24a1f80a30566e9cfbd09040882d18101fed76
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 6.01)
{
   ADBE.Reader_Need_Version = 6.03
   ADBE.Reader_Value_New_Version_URL =
       "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l="
       + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_5";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 6.01)
{
   ADBE.Viewer_Need_Version = 6.03;
   ADBE.Viewer_Value_New_Version_URL =
       "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" 
       + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_5";
}
javascript_obj0349_002.js pdf-javascript-stream PDF /JS object 349 at offset 0x27AC1 1604 bytes
SHA-256: f979542c4992f256c12537db5bbe5f86605da11ef877e634ccfc2c47c9284b10
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 1.2)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 6.01)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_Older, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
               app.findComponent({cType:"Plugin", cName:"XFA",
                                   cDesc: ADBE.Viewer_string_Update_Reader_Desc});
         }
         ADBE.Reader_Value_Asked = true;
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion == 6)
         {
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_60,
            cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO,
            cTitle: ADBE.Viewer_string_Title});
         }
         else if (app.viewerVersion < 6)
         {
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older,
            cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO,
            cTitle: ADBE.Viewer_string_Title});
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Viewer_601, 1, 1) == 1)
                app.findComponent({cType:"Plugin", cName:"XFA",
                                   cDesc: ADBE.Viewer_string_Update_Desc});
         }
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
stream_001_off00002044.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2044 3187 bytes
SHA-256: 61d38bff306a8fca629f159df596dd48f9899b3bd7f814612d294bc0166a2a9a
stream_002_off000024b8.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x24B8 109083 bytes
SHA-256: 663c07d43620326e7033cc27e96d7be3c7f827ce0d6293b0fced01300fbcfa12
stream_003_off000048ed.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x48ED 8717 bytes
SHA-256: 10719d2503a13c3b45ef6d4b7f3238b3a3a81a5bf864c69419bf1c46ab11e4d6
stream_004_off000050a4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x50A4 2423 bytes
SHA-256: 2d58413fda1ff20c994606823bf49e41194612c0137b6315e50fa7bdc01f1e09
stream_198_off000400f3.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x400F3 45992 bytes
SHA-256: 17e4c07c041369ea9ddabfa29175af01abf722366e52f82fdc9eb3db3dfefa58
icc_00_off00027cfc.icc pdf-icc-profile PDF ICC profile at offset 0x27CFC 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_sfnt_off0003c649.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3C649 33616 bytes
SHA-256: e848403885eb4d0513a2bfd38be029b458a5c4c2cafe0f384aa9e744b0f9c0f5

Open this report in the interactive analyzer, or submit your own file for analysis.