PDF static analysis report

Static analysis result for SHA-256 ceffbb0012cb769d…

SUSPICIOUS

PDF

759.3 KB Created: 2010-06-25 11:24:41 -05:00 Authoring application: iText by lowagie.com (r1.02b;p128) First seen: 2026-05-11
MD5: 94832cb2fca82339aba048ab7765e10b SHA-1: 2bed6430d5a597b346835d2028df95ca41265814 SHA-256: ceffbb0012cb769d8f73e48bc705a921d5311712fd67a09da8107a6be07027c1
48 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1071.001 Web Protocols

The PDF contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The SE_CALLBACK_LURE heuristic strongly suggests the document's content is designed to trick the user into calling a phone number, a common tactic in tech-support scams and callback phishing. While the specific JavaScript functionality is not detailed, its presence combined with the callback lure points to a malicious intent, likely to initiate a social engineering attack.

Machine Learning

  • Nyx PDF Classifier clean score 0.0944

Heuristics 6

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype Referenced by PDF JavaScript
    • https://www.verisign.com/rpaReferenced by PDF JavaScript
    • http://ocsp.verisign.com/ocsp/status0Referenced by PDF JavaScript
    • https://www.verisign.com/rpa0Referenced by PDF JavaScript
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0Referenced by PDF JavaScript
    • http://www.microsoft.com/typographyReferenced by PDF JavaScript
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript
    • http://www.iec.chIn PDF document text
    • https://www.verisign.com/repository/CPS��In PDF document text
    • https://www.verisign.comReferenced by PDF JavaScript
    • https://www.verisign.com/repository/verisignlogo.gif0��In PDF document text
    • https://www.verisign.com/CPS0bIn PDF document text
    • http://www.microsoft.com/truetype/0In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0453_000.js pdf-javascript-stream PDF /JS object 453 at offset 0xB79FF 33 bytes
SHA-256: b49875e7a786cc7d62191be88c49afc7a7f53551d4ec30ddf24c3fd7583d7233
Preview script
First 1,000 lines of the extracted script
AFDate_KeystrokeEx("mm/dd/yyyy");
stream_058_off0003411a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3411A 4603 bytes
SHA-256: 3a6fa31bd7bc58a5e0d1bb40045a8f1578295b5d0a50b1a2b5df9dac2e157eb8
stream_101_off0006b6c8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6B6C8 367087 bytes
SHA-256: b8e2518b116c26bab0e9f8c1672daf405dedad561157502b657e9005be2029aa
stream_120_off000ba564.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xBA564 3477 bytes
SHA-256: 4c2fa3398ce59ede9c1941570ac21f10c754ff4dc63bbfe1cb7ae39b7fb38bff
icc_00_off00060dd4.icc pdf-icc-profile PDF ICC profile at offset 0x60DD4 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_cff_off00005f5c.bin pdf-font-stream PDF embedded font (cff) at offset 0x5F5C 6749 bytes
SHA-256: 85239cd24b89ce7c399afa4ab7ba067f7737bd17bcadf7ea0847b912dc65002a
font_01_cff_off00007aaa.bin pdf-font-stream PDF embedded font (cff) at offset 0x7AAA 4651 bytes
SHA-256: 4255dfc2a9b0631dacf6925699a323a4dbd9ed1a64d33b82b313f8ebbd7b0fc5
font_02_cff_off00008e9f.bin pdf-font-stream PDF embedded font (cff) at offset 0x8E9F 5990 bytes
SHA-256: a966ec4b314b03846bfdac6d3d6326f8f28c0cba1408cea89639f6eea3e221cb
font_03_cff_off0000d650.bin pdf-font-stream PDF embedded font (cff) at offset 0xD650 2158 bytes
SHA-256: bd27d01fa6fca113f6a72d74de5cd809d07966e2aac715833c8acb2727670278
font_04_cff_off0000e119.bin pdf-font-stream PDF embedded font (cff) at offset 0xE119 4952 bytes
SHA-256: 205da7482f44ac0df31aa359516cea40c541d20914f57f09693ef7f7af09e100
font_05_cff_off00010824.bin pdf-font-stream PDF embedded font (cff) at offset 0x10824 784 bytes
SHA-256: 61b06f0743b0dc24a31f6490e67961751fd2a208dbe6e6f5029a253729b11b10
font_06_cff_off00010d52.bin pdf-font-stream PDF embedded font (cff) at offset 0x10D52 6454 bytes
SHA-256: a56b1661419a590fe348e306f8f1938df8ec24b5799db8eb43c519b8173d3ba6
font_07_cff_off00012790.bin pdf-font-stream PDF embedded font (cff) at offset 0x12790 4531 bytes
SHA-256: 8ff3b24a04bf018cfde63516868c4767d922b0d9262429ba50084fd8f7b00774
font_08_cff_off00013a34.bin pdf-font-stream PDF embedded font (cff) at offset 0x13A34 4065 bytes
SHA-256: 193966c6d86ae761ea9f682c0710a4d14a85d36bd532efb63488dfdee3203945
font_09_sfnt_off000164a8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x164A8 10017 bytes
SHA-256: 8821ee19bd3f7b989c0373692ac27a15d435db056f454d33e7c81d84fa5af64e
font_10_sfnt_off0002ac32.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2AC32 32336 bytes
SHA-256: 14bf4fe2a9cb0a19b7579e04a4803f3dc7c51d3c5265897dba10d86bf872186d
font_11_cff_off0002f8ff.bin pdf-font-stream PDF embedded font (cff) at offset 0x2F8FF 138 bytes
SHA-256: 9677fa215f86c54737c065293ef4394c1275c2dd3963594d04467cbf0cb85a3d
font_12_sfnt_off00030634.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x30634 10017 bytes
SHA-256: 254397cf029c90b4d9e6433322f1782a79ff9fb6d0bbcd0211ec29d6457c55e8
font_14_cff_off00035470.bin pdf-font-stream PDF embedded font (cff) at offset 0x35470 4773 bytes
SHA-256: fea6fd4e32a23195c8c4f1292e410a01855988537624f2b03afd0206671ef57e
font_15_sfnt_off000368b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x368B6 5284 bytes
SHA-256: a8678490550b24db5df968563bce87578712dc18c940caa21979bf756a337b4c
font_16_sfnt_off00037edc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x37EDC 10017 bytes
SHA-256: 9bd299ef3094b5af1ec59381f465fe0ca6093d07d7ac5d4e988f2c5a7e502f71
font_17_sfnt_off0003b9f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3B9F6 10017 bytes
SHA-256: ada20f54b67fe07c5594a98dee566de8f57ebfc9f2eb91b1ac8f9c040047676e
font_18_sfnt_off0003fb8c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3FB8C 10017 bytes
SHA-256: 262f244bd33db9379a91023e8663e210d31757fc29b363a29e53d4a916ce9f73
font_19_sfnt_off0004380f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4380F 10017 bytes
SHA-256: 485264197048ffa32e2a794557b9bcc4b85ddf54f68efac9e819f818f5baa9bc
font_20_sfnt_off00048ec6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x48EC6 39448 bytes
SHA-256: e2784506de8acddb60038c57e545b45afeeef5391c33d62c6fa5ebfb43563fcf
font_21_sfnt_off0004eaa9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4EAA9 34260 bytes
SHA-256: 83a9ce123b2d84c9fb7ea4e72c41d546bfc89f3b9506e46b4799d0b242489da8
font_22_cff_off00056e2e.bin pdf-font-stream PDF embedded font (cff) at offset 0x56E2E 5425 bytes
SHA-256: aea7013a855abf2a5e97b2f0158746652850de87e1bbf82f496891df9a27718f
font_23_cff_off000584c4.bin pdf-font-stream PDF embedded font (cff) at offset 0x584C4 2793 bytes
SHA-256: 81630acf7139b297deb2f9ff64430dfbf77ecefcd86d49487fe6484c8751c756
font_24_cff_off0005d66b.bin pdf-font-stream PDF embedded font (cff) at offset 0x5D66B 4126 bytes
SHA-256: 92254c3093f1ee4309a5442ce26076f594cb74fa406c41420e4a3d79efe28001
font_25_cff_off0005e7df.bin pdf-font-stream PDF embedded font (cff) at offset 0x5E7DF 8161 bytes
SHA-256: b17bb391fe7285b8bcb478702d6770b52fd7283837b0114b78d6d9777a9a7f10
font_26_sfnt_off0006209d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6209D 11040 bytes
SHA-256: 59f3c38f5e16a9b4bb496d76cef9e0a788bb02677de15b5dcea0594cf70a5d52
font_28_sfnt_off000aa0d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAA0D1 41132 bytes
SHA-256: 78d90a2b1983f07ae6aaf2a45ccf5440c6435a763e0bba748a27fe174c26e2c8

Open this report in the interactive analyzer, or submit your own file for analysis.