Malicious PDF — malware analysis report

Static analysis result for SHA-256 cfca151dfa008e8c…

MALICIOUS

PDF

790.6 KB Created: óCÉ4ý¢”kºRfEÐ& … Ä£¿ÒÐ Authoring application: ö”f©²è0þZŽwì^€í茒  ò$ First seen: 2026-05-08
MD5: 97a78e0849bef079ce6942f4ef2513be SHA-1: 67808cb292930f95112e559d5f1069248d6efc0e SHA-256: cfca151dfa008e8c589334b4ad9bfeaef1910468e721de6e8935711cc7926a0b
106 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript/JScript T1553.004 Subversion: Mark-of-the-Web Bypass

The PDF sample was flagged by a machine learning classifier and heuristics indicate the presence of JavaScript, which is used to hide malicious content. The 'PDF_ENCRYPTED_WITH_JS' heuristic suggests that the payload is intentionally obscured from static analysis, likely for evasion. The ML classifier's high score further supports the malicious nature of the file. No specific IOCs were extracted due to the obfuscation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9252

Heuristics 7

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype In PDF document text
    • http://ocsp.verisign.com0In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xfa-form/2.6/In PDF document text
    • http://www.xfa.org/schema/xci/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.5/In PDF document text
    • http://www.w3.org/1999/xhtmlIn PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • HTTP://YES.AZ.GOVIn PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In PDF document text
    • http://crl.verisign.com/tss-ca.crl0In PDF document text
    • https://www.verisign.com/rpa01In PDF document text
    • http://crl.verisign.com/pca3.crl0In PDF document text
    • http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0DIn PDF document text
    • http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0In PDF document text
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 15

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0015.bin pdf-embedded-file PDF EmbeddedFile object 15 at offset 0x4D37 162 bytes
SHA-256: 7db8c6807e4a6fb9fc646e764105a39f9c3422edc808e49e415b85e336afbcac
embedded_file_obj0023.bin pdf-embedded-file PDF EmbeddedFile object 23 at offset 0xD623 305 bytes
SHA-256: 5ad0c8f4fd3ff34131e1bdb7c8b7d9e13f1141344b4ae96d3e64151d703c31fd
javascript_obj0049_000.js pdf-javascript-stream PDF /JS object 49 at offset 0xC60A9 2798 bytes
SHA-256: 922f7942d25f53e6e6eedc1b3a95c47a757faab3be4838fa02db0dbea2c4dbcc
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
javascript_obj0050_001.js pdf-javascript-stream PDF /JS object 50 at offset 0xC6370 902 bytes
SHA-256: 91ea259764c68d27b8981a339c02d8ea92224ae5c0d0cd0a7c8f3d645d599090
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 8.0)
{
   ADBE.Reader_Need_Version = 8.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Reader_Need_Version;
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 8.0)
{
   ADBE.Viewer_Need_Version = 8.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Viewer_Need_Version;
}
javascript_obj0051_002.js pdf-javascript-stream PDF /JS object 51 at offset 0xC64C7 1383 bytes
SHA-256: 40d207bd33ef19f74e77d6e0bc9aa193e7355fc39dc66f9669dd2d0a8de76db6
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.5)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 8.0)
         {
            if (app.alert(ADBE.Reader_string_Need_New_Version_Msg, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_string_Need_New_Version_Msg_Old, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
		   else if (app.viewerVersion < 8.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
               app.launchURL(ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, true);
         }
         else if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
stream_001_off00004e14.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4E14 3286 bytes
SHA-256: 4c4093642644bb32aceeb6fa32581f7477109308cbfc84a77ab07fa12b172dac
stream_002_off000052cd.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x52CD 132328 bytes
SHA-256: 6bafa10cad05c71f3ae70b9ddd09c7250213f2f3c6ee05ebb53ab2aa53c74501
Detection
ClamAV: No threats found
Obfuscation or payload: likely
427 of 831 identifiers look randomly generated (e.g. 'QKIJEhfhOtEg1qIAQNOYH89gwsBETKLpzXqLtmQi'); 2 string-concatenation chain(s) — consistent with name-mangling obfuscation. Carved artifact contains 2 long base64-like blob(s).
stream_003_off0000cdce.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xCDCE 4752 bytes
SHA-256: d1f7bfc656e439556ffb4e2a8c82b8d1fde63211be2aae5fb16d3d25fdaa1fce
stream_004_off0000d0cf.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD0CF 2134 bytes
SHA-256: 50a557a49b2692f3b52fbe0b52dde97c24cdf9d7d6d809d95b5a6d91d608357f
stream_015_off0000f527.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF527 367087 bytes
SHA-256: b8e2518b116c26bab0e9f8c1672daf405dedad561157502b657e9005be2029aa
stream_017_off000517e6.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x517E6 398350 bytes
SHA-256: 3865d93c0c2166362b36dcedd4241f4d13e97beb2582d99741eb0ef72770f9b8
stream_018_off0008b254.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8B254 409252 bytes
SHA-256: a0f5b5f69a88877ffaa1733f0e0bbf9b4b3eef82f4ff804c724870cecea228d2
font_01_sfnt_off00041d3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x41D3F 94875 bytes
SHA-256: 058d11642e857508126df5662db2c7af4bdc1892e73eea6fc33f2605a1fc3c20
embedded_file_obj0065_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 65 at offset 0xC5165; filter decode failed 183 bytes
SHA-256: 03f43c48b32a1dd1b9cc674b4c5e24cb0f1b85b8310997c39c55a67001fa3932
embedded_file_obj0066_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 66 at offset 0xC5276; filter decode failed 151 bytes
SHA-256: a02a61b3b8f27f041a7c69df3259d0b0cfe6b0c26f01952175fbf04465db5041

Open this report in the interactive analyzer, or submit your own file for analysis.