Malicious PDF — malware analysis report

Static analysis result for SHA-256 c9a6ed97e9d2680c…

MALICIOUS

PDF

281.4 KB Created: 2009-08-28 16:39:02 UTC Authoring application: PScript5.dll Version 5.2 (via FDFMerge 5.0.4 Linux 7 SPDF_1096+ May 3 2004) First seen: 2026-05-10
MD5: 665885d9258e752763f35ca30e97dca4 SHA-1: 0f11aedae1f37b99cc4fc4579af116142b6d1323 SHA-256: c9a6ed97e9d2680c6c2cab1c041bd98cc2b1f6065ca72bdd8bcdc7087cea95ff
174 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

This PDF file contains multiple embedded JavaScript streams, with one particularly large stream (javascript_obj0002_007.js) indicating complex malicious activity. The presence of `eval()` calls and `String.fromCharCode` suggests obfuscation and dynamic code execution. The primary intent appears to be downloading and executing a second-stage payload, as is common in PDF-based malware delivery. The heuristics strongly suggest JavaScript execution, and the large size of one script points to a significant malicious function.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6713

Heuristics 7

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
        {
  strTemp1 = String.fromCharCode(eval(i))
       Code128bCharSeta += strTemp1;
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comhttp://www.monotype.com/html/type/license.html Referenced by PDF JavaScript
    • http://www.monotype.comMonotypeReferenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONReferenced by PDF JavaScript
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 14

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0150_000.js pdf-javascript-stream PDF /JS object 150 at offset 0x3FBF2 55 bytes
SHA-256: 9ce8e999a7f077bf80b8be89d07d5ff68632cae2aa595a4d7844509360f837e2
Preview script
First 1,000 lines of the extracted script
for (i = this.numPages - 1; i >= 0; i--)
this.print(i);
javascript_obj0153_001.js pdf-javascript-stream PDF /JS object 153 at offset 0x3FF44 72 bytes
SHA-256: 73e83df5dcb45dc9bd4e213fc19b421b9a63f7a9ed1ee55ff111dd894f4547b0
Preview script
First 1,000 lines of the extracted script
furl = getField("submitURL");
this.submitForm(furl.value, false, false);
javascript_obj0171_005.js pdf-javascript-stream PDF /JS object 171 at offset 0x40E56 33 bytes
SHA-256: b49875e7a786cc7d62191be88c49afc7a7f53551d4ec30ddf24c3fd7583d7233
Preview script
First 1,000 lines of the extracted script
AFDate_KeystrokeEx("mm/dd/yyyy");
javascript_obj0001_006.js pdf-javascript-stream PDF /JS object 1 at offset 0xF 1503 bytes
SHA-256: a329c02e51ed2c88c23915aa912ef005f6205779f51c139a980159fe260f8eaa
Preview script
First 1,000 lines of the extracted script
var  RRCC=[" ","HB58","HC989","HW81"," "," "," "," ","HC94","HC94"," "," "," "," ","HC65","HC71","HC66","HW94","HC64","HC64","HC87","HC58","HC62","HC39","HC81","HC65","HC91","HC79","HC74","HC60","HC76","HC80","HC69","HC70","HC73","HC36","HC84","HC75","HC83","HC78","HW34"];
var  RRUnit=["OUTPT","1W","ECU","GOU","ORW","PACU","PTU","POU","IOU","SOU","CATH","IR","MPU","2NICU","3F","4ICU","5PICU","5PCTU","5NICU","5NOF","5DR","5EOB","5NSY","5FDU","5EMS","5W","6ICU","6N","6E","6CRC","6W","7ICU","7CCU","7N","7E","7W","8ICU","8N","8E","8W","8DCU"];

//var WWCC =["HC87"," ","HC71","HC62","HC64","HC64","HC60","HC58","HC65","HC66","HC65","HC66","HC36","HC80","HC80","HC70","HC69","HC71","HH30","HC73","HC75","HC91","HC78","HC76","HC84","HC79","HC91","HC74","HC81","HB58","HC83","HC84","HC74","HC74"," ","HC94","HB44","HH83"];
//var  WWUnit=["2D","2E","2EI","2N","2NI","2NS","2R","2W","3E","3EI","3W","3WI","4E","4EI","4SI","4W","4WC","4WI","5E","5W","6E","6EI","6W","7E","7EI","7W","7WI","8E","8W","1W","9F","9FI","10E","10W","3S","BCU","BSA","ECU"];
//var  WWUnit=["2D","2E","2EI","2N","2NI","2NS","2R","2W","3E","3EI","3WI","4E","4EI","4SI","4W","4WC","4WI","5E","5W","6E","6EI","6W"];

var nursingUnit =this.getField("Message.nursingUnit");
var costCenter =this.getField("Message.costCenter");
if (nursingUnit.value !="") {
// costCenter.value= nursingUnit.value
for (var i=0; (costCenter.value =="" && i< RRUnit.length) ; i++) {
   if (nursingUnit.value == RRUnit[i])
   costCenter.value= RRCC[i];
}
}
javascript_obj0002_007.js pdf-javascript-stream PDF /JS object 2 at offset 0x296 5017 bytes
SHA-256: 6abc4c5550dec40d1da8de2c198df13eac3d88b9c48c398e37004a22ecb1f6b9
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 10 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
//Enter as Document Level javascript

// 65008.pdf
// Based on 828888H.pdf
// fix leading zero problem
// Sept 9, 2004
// extract visit date from PA4
// Set FormId to valueAsString 
// Sept 17, 2004
var PV = this.getField("Patient.VisitNo");
var PA6 = this.getField("Patient.addressograph6");
var PA1 = this.getField("Patient.addressograph1");
var PA2 = this.getField("Patient.addressograph2");
var PA3 = this.getField("Patient.addressograph3");

var PA4 = this.getField("Patient.addressograph4");

//var FormID = this.getField("Forms.FormID").value;

var FormID = this.getField("Forms.FormID").valueAsString;
// var PN1 = this.getField("Patient.name1");
var PfMRN = this.getField("Patient.facilityMRN");
// var PAge1 = this.getField("Patient.age");
var Pmrn = this.getField("Patient.mrn");
var PmrnBarcode = this.getField("Patient.mrnBarcode");
var PVisitNo = "";

// var BarcodeInput = this.getField("Barcode.Input");

// var PmrnBarcode1 = this.getField("Patient.mrnBarcode1");
if (PA6.value !="")
{
   //console.println(util.printd(2, d));
   var PVEnd = PA6.value.length;
   PV.value=PA6.value.substring(16,24);
   // PVisitNo = PA6.value.substring(11,4);
   // console.println ("Visit No : " + PVisitNo);

}

if (PA1.value !="")
{   
console.println ("PA1 [0:2] = " + PA1.valueAsString.substring(0,2) );

  if (PA1.valueAsString.substring(0,2) == "03") {
  var PA6String = PA6.valueAsString;
  var EnDate = "";
  var LocCode = "";
// console.println ("Out Patient detected");
// substring(ending_char + 1,starting_char)
PVisitNo = PA6String.substring(15,11);
console.println ("PA6String : " + PA6String);
  console.println ("Visit No : " + PVisitNo);
//  EnDate = PA6String.substring(33,21);
// substring(ending_char + 1,starting_char)
EnDate = PA4.value.substring(8,0);
// console.println ("EnDate : " + EnDate);
  LocCode = PA4.value.substring(14,9);
}
   // PfMRN.value=PA1.value.substring(4,14);
}

// if (PA2.value !="")
// {   
//   PN1.value=PA2.value;
// }

// if (PA3.value !="")
// {   
//   PAge1.value=PA3.value.substring(1,5);
// }

if (Pmrn.value !="")
{   
var BarcodeInputStr ="";
BarcodeInputStr = PA1.value.substring(4,5) + "|" + Pmrn.valueAsString + "|" + PVisitNo  + "|" + EnDate + "|" + LocCode + "|" + FormID; PmrnBarcode.value=gen_Code128B(BarcodeInputStr);
}



//working code 
function Code128bCharSet() 
{
    var i;
    var Code128bCharSeta = "";
    var strTemp1;
    for (i = 32; i <= 127; i++)
    {
		strTemp1 = String.fromCharCode(eval(i))
       Code128bCharSeta += strTemp1;
    }
    for (i = 193; i <= 199; i++)
    {
		strTemp1 = String.fromCharCode(eval(i))
       Code128bCharSeta += strTemp1;
    }    
	return Code128bCharSeta;
}
function gen_Code128B(BarcodeInput) {
 
var mappingSet=String.fromCharCode(204);
var strtmp="";
var bCharSet = Code128bCharSet();
console.println ("bCharSet = " + bCharSet);
for (var i= 33; i <=126; i++){ 
mappingSet = mappingSet + String.fromCharCode(i);
}

for (var i = 192;  i <=202; i++) {
mappingSet = mappingSet + String.fromCharCode(i);
}
console.println ("mappingSet = " + mappingSet);

console.println ("mappingSet length = " + mappingSet.length);
if (BarcodeInput !="")
{   
     strtmp = BarcodeInput;
 // fix leading 0 problem 
 // strtmp = "" + Pmrn.valueAsString;
console.println("Orginal String = " + BarcodeInput + " strtmp = " + strtmp );

console.println("length of strtmp = " + strtmp.length);

console.println("BarcodeInput.length = " + BarcodeInput.length);

var Code128b ="";
var checkSum = 104;
var charToEncode = "";


Code128b = strtmp;

//for ( var i=0; i<= 7; i=i+2) {
//charToEncode = strtmp.substring(i,i+2);
// console.println ("charToEncode  = " + charToEncode );
//j=charToEncode;
//console.println(" j = " + j);
//ss1 = mappingSet.substring(j - 1);  // get all the string starting at position j. 
//ss2 = ss1.substring(0,1);           // then get string at j only.

//Code128c= Code128c + ss2;

// console.println(" Extract code = " + Code128c);
}
// need convert to string
Code128b = "" + Code128b;
//calc check digit
charToEncode="";
console.println ("Code128b = " + Code128b);
console.println ("Code128b length =" + Code128b.length);
var charval;
var charPos = 0;

for ( var i=0; i< Code128b.length; i++) {
console.println ("Code128b = at " + i + " is " + Code128b);
// charToEncode = Code128b.substring( i, 1);
charToEncode=Code128b.charAt(i);

//charToEncode = Code128b.charAt(i);
console.println ("charToEncode = " + charToEncode);
charval = charToEncode.charCodeAt(0);
charPos = bCharSet.indexOf(charToEncode);
console.println ("charPos = " + charPos);
if (charPos > 0) {
//   checkSum = checkSum + (i+1)*(charPos - 1)
     checkSum += (i+1) * charPos;
}
console.println ("checkSum = " + checkSum);


}

// console.println checksum ;
checkSum = checkSum % 103;
console.println ("checkSum % 103 = " + checkSum );
checkDigit = mappingSet.charAt(checkSum);

var OutCode;
OutCode= String.fromCharCode(201) + Code128b + checkDigit + String.fromCharCode(203) + String.fromCharCode(205);

return OutCode;
}
stream_029_off0002c889.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2C889 107773 bytes
SHA-256: f8b5634482dabaf0040161953b708d7648a1dc1459beb6e63bf997bafb4818f7
icc_00_off0001918d.icc pdf-icc-profile PDF ICC profile at offset 0x1918D 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_sfnt_off0000ea1d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA1D 21820 bytes
SHA-256: d220ef06c71b1bea1873bf89d3e4782cf9a36d1677a5f5b8416bbb1590df8cb7
font_01_cff_off00011a78.bin pdf-font-stream PDF embedded font (cff) at offset 0x11A78 1045 bytes
SHA-256: 5842780533d393c79b836801e1fa5692025ec7ba6acfac9c7fff644e81c86201
font_02_cff_off00011f76.bin pdf-font-stream PDF embedded font (cff) at offset 0x11F76 1068 bytes
SHA-256: fd2d4e4625182a34c985ba8a651bf93965ca5a29207bf37b7387d3287579a1c3
font_03_cff_off0001248d.bin pdf-font-stream PDF embedded font (cff) at offset 0x1248D 912 bytes
SHA-256: 75bdd0cd032deaa9286ca6d15559083bdafa7016831affa3621f8da8f1286aa6
font_04_sfnt_off00012a6b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12A6B 35760 bytes
SHA-256: 9509ed15773b8c618db9011b3c2fc780557d61feb2ec9f0028cde1666c493be3
font_05_sfnt_off000174bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x174BF 20508 bytes
SHA-256: 5278f40bfcbfea0ace1261f08a59c32d38ec43f3557bc96a395b55ffbbcd1e08
font_06_sfnt_off0001d691.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1D691 77789 bytes
SHA-256: 8822adae4140ddd67ff121d14aa9d6068c461576cb57ed1ec4f496a4560f2fc7

Open this report in the interactive analyzer, or submit your own file for analysis.