Malicious PDF — malware analysis report

Static analysis result for SHA-256 d4062e79823f4268…

MALICIOUS

PDF

396.7 KB Created: %x‚ú²:èFwˆäà4øڌ Authoring application: &ݨç*ˆF2ק¸k¸Êã{ (via &ݨç*ˆF2ק¸k¸Ê°S9°ÑÑQ¡*S) First seen: 2026-05-10
MD5: 5dd417ce148bbecdd80cbf5519dc6835 SHA-1: 8a948c0add381c3bc502fd5311aa7f7f86c2b263 SHA-256: d4062e79823f4268e68948bcefe0f6b6dbecceb019caf733919f98449dca3ff7
114 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF file contains multiple embedded JavaScript streams, and is flagged as encrypted with JavaScript, indicating an attempt to obfuscate malicious content. The presence of AcroForm buttons with action triggers further suggests interactive elements designed to initiate script execution. The high number of streams points to significant obfuscation. The primary attack pattern involves leveraging JavaScript within the PDF to conceal and execute a payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9396

Heuristics 5

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0144_000.js pdf-javascript-stream PDF /JS object 144 at offset 0x9E4C 216 bytes
SHA-256: 0aacb6e8eb1a08be32a71134b8bd8f516dfefadb5ae56b33bb6650319289a4eb
Preview script
First 1,000 lines of the extracted script
var sdg = this.getField("sdgt");
var zusdg = this.getField("sdga");
if (sdg.value < 50 & sdg.value > 0) zusdg.value = 50 - sdg.value;
if (sdg.value >= 50) zusdg.value = 0;

this.event.value = sdg.value + zusdg.value;
javascript_obj0145_001.js pdf-javascript-stream PDF /JS object 145 at offset 0x9F5E 38 bytes
SHA-256: ff0b1e0798b55aee9e494d4b5046c0d747ee05557796f33002cd8f8168a10b67
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 3, 0, 0, "", true);
javascript_obj0146_002.js pdf-javascript-stream PDF /JS object 146 at offset 0x9FB3 41 bytes
SHA-256: 5b4e1a57bf6476c87a1db4d415eeb42e1477d446a4236b8ae4189d3d8f669dde
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 3, 0, 0, "", true);
javascript_obj0153_003.js pdf-javascript-stream PDF /JS object 153 at offset 0xA38D 38 bytes
SHA-256: 6f4ebd4f520911136751e3878ad4b37118b4c12f3bcf22c8ada375ca49290802
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 3, 0, 0, "", true);
javascript_obj0154_004.js pdf-javascript-stream PDF /JS object 154 at offset 0xA3E2 41 bytes
SHA-256: 969138dc842bacdbedfeaf4aaf6e3a512fdc0a2d7ed5d6a300c5a280fccb3bd0
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 3, 0, 0, "", true);
javascript_obj0176_005.js pdf-javascript-stream PDF /JS object 176 at offset 0xAFE6 187 bytes
SHA-256: a2c26bca44d0c0f8fa8b5864a43597aca3f0d11e5e5d886c8115c1ec490e89bd
Preview script
First 1,000 lines of the extracted script
event.value="Ihre Absenderangabe auf der Einlieferungsliste mu� mit den Angaben auf den eingelieferten Sendungen �bereinstimmen. Bitte geben Sie Ihre Kundennummer immer an, wenn bekannt."
javascript_obj0178_006.js pdf-javascript-stream PDF /JS object 178 at offset 0xB4E1 185 bytes
SHA-256: 56c23135e72cf3349a5845e6c4301ea4ab7713519df9c84fe69885966ae8ab03
Preview script
First 1,000 lines of the extracted script
event.value="Wenn Sie Ihre Infobriefe nicht selbst einliefern, sondern z.B. eine Agentur oder einen Lettershop damit beauftragen, kommen in diese Felder die Angaben Ihres Beauftragten."
javascript_obj0180_007.js pdf-javascript-stream PDF /JS object 180 at offset 0xB5F9 54 bytes
SHA-256: 1212303a8f8272336e6bd36f9e75b35de1e96730ccfc1800574252dd10f0fb1d
Preview script
First 1,000 lines of the extracted script
event.value="(f�r Kataloge: Exklusiv-Lizenz bis 199g)"
javascript_obj0183_008.js pdf-javascript-stream PDF /JS object 183 at offset 0xB6C2 118 bytes
SHA-256: c4da4e1b544174db58aae5dbc67fec74f542c2f56187d2cd0436966c1a137ed8
Preview script
First 1,000 lines of the extracted script
event.value="Die hier eingegebene Bezeichnung erscheint bei Abbuchung per Lastschriftverfahren auf Ihrem Kontoauszug."
javascript_obj0184_009.js pdf-javascript-stream PDF /JS object 184 at offset 0xB765 145 bytes
SHA-256: a713952f5d40405bbcf8d6bb120e970519c1333f5e34095f5a47f0ee017622e8
Preview script
First 1,000 lines of the extracted script
event.value="Die zu versendende Mindestmenge betr�gt 50 Sendungen. Wenn Sie die Mindestmenge nicht erreichen, k�nnen Sie entsprechend aufzahlen."
javascript_obj0185_010.js pdf-javascript-stream PDF /JS object 185 at offset 0xB823 202 bytes
SHA-256: ea011b8df97b85a1693aede0fdabbd852cf42944f0f03fa23507fa187ccf72ed
Preview script
First 1,000 lines of the extracted script
event.value="Wenn die passende Briefmarke nicht zur Verf�gung steht, ersetzen wir ihnen Differenzbetr�ge nur bis zur n�chsten m�glichen Wertstufe, die mit bis zu zwei Briefmarken erreicht werden kann. "
javascript_obj0186_011.js pdf-javascript-stream PDF /JS object 186 at offset 0xB91A 113 bytes
SHA-256: 624458c2ac45cb2793e000893b2449999ae619be62c8a3c0e71239530a16e83b
Preview script
First 1,000 lines of the extracted script
event.value="Im Rahmen der Absenderstempelung k�nnen Infobriefsendungen auch mit Briefmarken freigemacht werden."
javascript_obj0187_012.js pdf-javascript-stream PDF /JS object 187 at offset 0xB9B8 98 bytes
SHA-256: 824e71cf85e7c99cafd0f82ef0fe98ecfb6badaade53cac718b84ddff4b32bb1
Preview script
First 1,000 lines of the extracted script
event.value="Auf Wunsch �bernimmt unser Frankierservice die Freimachung Ihrer Infobriefsendungen."
javascript_obj0188_013.js pdf-javascript-stream PDF /JS object 188 at offset 0xBA47 191 bytes
SHA-256: 8467585407ea55f21bd9ebf0f24b8376456074b9af4ab8ffa92a0ca9a270590a
Preview script
First 1,000 lines of the extracted script
event.value="F�r die Bezahlung von Infobrief-Einlieferungen werden auch Verrechnungsschecks akzeptiert. Bitte informieren Sie sich bei Ihrer Gesch�ftskundenberatung �ber die Voraussetzungen!"
javascript_obj0189_014.js pdf-javascript-stream PDF /JS object 189 at offset 0xBB33 193 bytes
SHA-256: bab82569853cdad3976785e5f9110d665846c9676f4b0c51779691829000f3a8
Preview script
First 1,000 lines of the extracted script
event.value="Wenn Sie Infobriefsendungen mit Freimachungsvermerk, also mit einem 'Entgelt bezahlt'-Aufdruck freimachen, k�nnen Sie die Einlieferung bar oder per EC-Karte und Geheimzahl zahlen."
javascript_obj0191_015.js pdf-javascript-stream PDF /JS object 191 at offset 0xBC53 137 bytes
SHA-256: 9f869aa1d907567fdea4b53b4c1f079f48bdf855d9c1533456723fe027ef02bc
Preview script
First 1,000 lines of the extracted script
event.value="Wenn Sie am DV-Freimachungsverfahren teilnehmen, k�nnen Sie Infobriefsendungen auch �ber diese Freimachungsform frankieren."
javascript_obj0192_016.js pdf-javascript-stream PDF /JS object 192 at offset 0xBD09 136 bytes
SHA-256: 651c7ce3649ab3840f2c21b2a977d74d95dbb1870f82e7400e557082f9961039
Preview script
First 1,000 lines of the extracted script
event.value="Eine M�glichkeit der Freimachung von Infobriefsendungen ist die Freistempelung mit einer zugelassenen Freistempelmaschine."
javascript_obj0194_017.js pdf-javascript-stream PDF /JS object 194 at offset 0xBDF0 256 bytes
SHA-256: 5e64679a02ea2b5f345a2925af28871cb09a6a910c421c56166aa3fb7197930c
Preview script
First 1,000 lines of the extracted script
event.value="Infobrief-Kreativ ist nicht an starre Formen gebunden. F�r Infobrief-Kreativ-Sendungen wird bei der Einlieferung jeweils auf die Basisvariante ein zus�tzliches Entgelt von 0,09 EUR/St�ck erhoben. Bitte fragen Sie Ihre Gesch�ftskundenberatung."
javascript_obj0455_019.js pdf-javascript-stream PDF /JS object 455 at offset 0x19489 210 bytes
SHA-256: e832d881bcff46782bdd480fcf718d157698939594180e586a55bef71044fad6
Preview script
First 1,000 lines of the extracted script
// setzen frankierentgelt auf Null, wenn unchecked
var f = this.getField("efs");
if(this.getField("frankier3").value=="Off" && this.getField("frankier4").value=="pwz") f.value=0;
// ende frankierentgelt checken
javascript_obj0460_020.js pdf-javascript-stream PDF /JS object 460 at offset 0x198C7 214 bytes
SHA-256: 87db5c6391bc5d519b412a9a5e06968d4c465da7301366481644420198ac76c1
Preview script
First 1,000 lines of the extracted script
// setzen frankierentgelt auf Null, wenn unchecked
var f = this.getField("efs");
if(this.getField("frankier3").value=="service" && this.getField("frankier4").value=="Off") f.value=0;
// ende frankierentgelt checken
javascript_obj0541_021.js pdf-javascript-stream PDF /JS object 541 at offset 0x1EF06 98 bytes
SHA-256: d1c7bef22bb193bf4505b190dbf92ce90af038ddbb5b2323bec83357bb7363bc
Preview script
First 1,000 lines of the extracted script
this.getField("infocard").value="Off";
checkBoxUpdate(1,2,1,"infocard");
checkBoxUpdate(1,2,1,"");
javascript_obj0542_022.js pdf-javascript-stream PDF /JS object 542 at offset 0x1EF9D 67 bytes
SHA-256: a63c91a0b9fa5c0ebec5151023eb1b120930a9dbfa845f2f3eb2db08afae5115
Preview script
First 1,000 lines of the extracted script
var infocard = this.getField("infocard");

infocard.value = "Off";
javascript_obj0598_023.js pdf-javascript-stream PDF /JS object 598 at offset 0x2253C 70 bytes
SHA-256: 8f0f4d570a870d9da43cee2fb80b5b1090ab912d71d8aca2e9ad5123905b36a5
Preview script
First 1,000 lines of the extracted script
this.calculate = false;
init07();
this.calculate = true;
calculateNow;
javascript_obj0641_024.js pdf-javascript-stream PDF /JS object 641 at offset 0x23F45 247 bytes
SHA-256: 84ea2b803a04ef057bfeed55965c17ad225b9a521638a7d9c30dd053425b2fd4
Preview script
First 1,000 lines of the extracted script
function eingabeEin()
{
if(app.viewerVersion>=5)
{
var e = this.getField(event.target.name);
e.fillColor=color.white;
}}

function eingabeAus()
{
if(app.viewerVersion>=5){
var e = this.getField(event.target.name);
e.fillColor=color.transparent;
}}
javascript_obj0643_025.js pdf-javascript-stream PDF /JS object 643 at offset 0x240B5 159 bytes
SHA-256: de2c4901940092352e982d8eb9f797e79fc433ffa86488c06933727b4e888bc9
Preview script
First 1,000 lines of the extracted script
function hide(feld)
{
var a = this.getField(feld);
a.hidden = true;
}

function show(feld)
{
var a = this.getField(feld);

a.hidden = false;
a.print = false;
}
javascript_obj0663_026.js pdf-javascript-stream PDF /JS object 663 at offset 0x2526A 90 bytes
SHA-256: df2f0311b9b9eef9471372b2898add6010281ce3d0b4707983905d0ff360422c
Preview script
First 1,000 lines of the extracted script
var c = this.getField("efs");
if(c.value=="0" || c.value=="0,00") c.textColor=color.white;
javascript_obj0664_027.js pdf-javascript-stream PDF /JS object 664 at offset 0x252F6 90 bytes
SHA-256: 274432c46985c43736fe4987156a7e1a0c21eb5125d6caf5fdbba51edc45f3b8
Preview script
First 1,000 lines of the extracted script
var c = this.getField("efs");
if(c.value=="0" || c.value=="0,00") c.textColor=color.black;
javascript_obj0672_028.js pdf-javascript-stream PDF /JS object 672 at offset 0x25A65 58 bytes
SHA-256: 0d6304b853eaf516cc25e444e23d3e24734329ef1a273a6cbbdc0af460b715a0
Preview script
First 1,000 lines of the extracted script
if(this.getField("dialoggelb").value!="Off") hide("init");
javascript_obj0704_029.js pdf-javascript-stream PDF /JS object 704 at offset 0x29F9E 113 bytes
SHA-256: 13a7dc96a697fc8a0be0b6f90f8a7d1dd8b3322981b201eb015eb5b710a3bb2b
Preview script
First 1,000 lines of the extracted script
var a = this.getField("infocard");

a.value="Off";


checkBoxUpdate(1,2,1,"infocard");
checkBoxUpdate(4,2,1,"");
javascript_obj0708_030.js pdf-javascript-stream PDF /JS object 708 at offset 0x2A32B 99 bytes
SHA-256: b297ec09e8b7b68a5a85ae5e9e7a1ed25aff2b91c97cebd9a72c4547fe3a93ec
Preview script
First 1,000 lines of the extracted script
this.getField("infocard").value="Off";
checkBoxUpdate(1,2,1,"infocard");
checkBoxUpdate(4,2,2,"");
javascript_obj0712_031.js pdf-javascript-stream PDF /JS object 712 at offset 0x2A6BA 99 bytes
SHA-256: f34b10c602acdda0d131963a77d7f61ff359b9458082755a8e77d05ba8c930aa
Preview script
First 1,000 lines of the extracted script
this.getField("infocard").value="Off";
checkBoxUpdate(1,2,1,"infocard");
checkBoxUpdate(4,2,3,"");
javascript_obj0716_032.js pdf-javascript-stream PDF /JS object 716 at offset 0x2AAA7 105 bytes
SHA-256: a045218a66e5907d9cc88abcc26f5d5dd76c9b63f1a44295fa548974deebb29d
Preview script
First 1,000 lines of the extracted script
this.getField("infocard").value="Off";
checkBoxUpdate(1,2,1,"infocard");
checkBoxUpdate(4,2,4,"artikel");

Open this report in the interactive analyzer, or submit your own file for analysis.