Malicious PDF — malware analysis report

Static analysis result for SHA-256 d77f196114a31ede…

MALICIOUS

PDF

272.8 KB Created: 2009-05-11 10:08:39 +03:00 Authoring application: Adobe LiveCycle Designer ES 8.2 First seen: 2026-05-10
MD5: 35cd657d082d855b6662f433626d01e7 SHA-1: bba33b80acb8347813fa4e537bae04a2cfeaf09c SHA-256: d77f196114a31edef031705ee34d81335b804c3bc4b342e23d3ac6d77a256eaa
214 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File T1566.001 Spearphishing Attachment T1071.001 Web Protocols

The PDF file contains embedded JavaScript and a SubmitForm action, indicating an attempt to interact with external resources. The presence of an embedded script payload and the use of unescape() suggest the execution of malicious code. While the document body is unreadable, the heuristics point towards a downloader or exploit delivery mechanism. The embedded file 'embedded_file_obj0010.bin' and the JavaScript file 'javascript_obj0207_001.js' are likely components of the malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9460

Heuristics 10

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
            var decodedFileName = unescape(doc.documentFileName);
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • SubmitForm action medium PDF_SUBMITFORM
    PDF has a /SubmitForm action — form data can be silently posted to an attacker-controlled URL
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ocsp.verisign.com0 Referenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/Referenced by PDF JavaScript
    • http://ns.adobe.com/pdf/1.3/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/mm/Referenced by PDF JavaScript
    • http://purl.org/dc/elements/1.1/Referenced by PDF JavaScript
    • http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/Referenced by PDF JavaScript
    • http://crl.adobe.com/prodSvce.crl0In PDF document text
    • https://www.adobe.com/misc/pki/prod_svce_cps.html0In PDF document text
    • http://crl.adobe.com/cds.crl0���~�|�z0x1In PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://ns.adobe.com/xdp/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xci/2.6/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xci/2.8/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.6/Referenced by PDF JavaScript
    • http://www.w3.org/1999/xhtmlReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-locale-set/2.7/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-locale-set/2.6/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-form/2.8/Referenced by PDF JavaScript
    • http://crl.verisign.com/tss-ca.crl0Referenced by PDF JavaScript
    • http://crl.verisign.com/ThawteTimestampingCA.crl0Referenced by PDF JavaScript
    • https://www.verisign.com/rpaReferenced by PDF JavaScript
    • https://www.verisign.com/rpa01Referenced by PDF JavaScript
    • http://crl.verisign.com/pca3.crl0Referenced by PDF JavaScript
    • http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0DReferenced by PDF JavaScript
    • https://www.verisign.com/rpa0Referenced by PDF JavaScript
    • http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0Referenced by PDF JavaScript
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlReferenced by PDF JavaScript
    • http://ns.adobe.com/xfdf/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 20

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0008.bin pdf-embedded-file PDF EmbeddedFile object 8 at offset 0x1FA4 162 bytes
SHA-256: dc5340ca6b8faa6e248a740e920df7c0eb2bd05e99bdb59be07b72db43557153
embedded_file_obj0009.bin pdf-embedded-file PDF EmbeddedFile object 9 at offset 0x2093 2226 bytes
SHA-256: 606d512836d3eeec7f64a82d49963e8a0c0e609a462440dfb0a441983d6b9ae2
embedded_file_obj0010.bin pdf-embedded-file PDF EmbeddedFile object 10 at offset 0x243C 60203 bytes
SHA-256: d6e376e98576f857784df370e74358e4e5740db25f90fef09817d69015230b7f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
embedded_file_obj0011.bin pdf-embedded-file PDF EmbeddedFile object 11 at offset 0x45EB 2967 bytes
SHA-256: 8cc670d8d2f8fc6f4f0ebb1794bca1ba2e56b946a3f546d9b64c97b97d6104e7
embedded_file_obj0012.bin pdf-embedded-file PDF EmbeddedFile object 12 at offset 0x496A 871 bytes
SHA-256: 86b509487430fe2684e4c72fc9e0a07cc57145983a916b237d13a384b6b32322
embedded_file_obj0013.bin pdf-embedded-file PDF EmbeddedFile object 13 at offset 0x4A59 1535 bytes
SHA-256: ca28a4c9a405031892afb9851e38dcdc3db5b47daca8773a021830cd791c1216
embedded_file_obj0014.bin pdf-embedded-file PDF EmbeddedFile object 14 at offset 0x4D1E 80 bytes
SHA-256: 2ebdd7efeaa1190ff6bad8cbd649b313e3969564018f204e7385b97c2fab1e19
embedded_file_obj0015.bin pdf-embedded-file PDF EmbeddedFile object 15 at offset 0x4DC9 233 bytes
SHA-256: 81dd4e4a7f54fef2f09b8de7ee71036db7ea020657b0d07cc7fab7e4482af11d
embedded_file_obj0377.bin pdf-embedded-file PDF EmbeddedFile object 377 at offset 0x3FBCF 1887 bytes
SHA-256: fa7ad477d12c8e6ea4200dd528a03d0cff54efc2a694ac5eeb4f5eb65208ad51
embedded_file_obj0378.bin pdf-embedded-file PDF EmbeddedFile object 378 at offset 0x3FD94 1814 bytes
SHA-256: 4bd65eafcdb262e6a7eb278af3ae4be7b1a9ca650f86f4c6a2d2afd621c3700b
javascript_obj0196_000.js pdf-javascript-stream PDF /JS object 196 at offset 0x94DD 999 bytes
SHA-256: 4a3be1c97fa660c78458adbf8467d9ef0ece4b4be6574ddb6a76861e566be29f
Preview script
First 1,000 lines of the extracted script
//@@FORMSWORKFLOW auto-generated script

/**************************************************************
AdobePatentID="B643"
**************************************************************/
var AdobePatentID = "AdobePatentID=\"B643\"";

// initialize some constants
var METADATA_ANNOT_NAME = "adhocFormState";
var STATE_DISTRIBUTED   = "distributed";
var STATE_RETURNED      = "returned";
var PROP_WFSTATE        = "wfState";

// The following code executes only for Acrobat/Reader under 8.0
if (app.viewerVersion < 9) {
    // Change the distributed state to returned state
    var annot = this.getAnnot(0, METADATA_ANNOT_NAME);
    if (annot != null) {
        var arrProps = new Array();
        arrProps = annot.contents.split(";");
        var wfState = getProperty(arrProps, PROP_WFSTATE);
        if (wfState == STATE_DISTRIBUTED) {
            setProperty(arrProps, PROP_WFSTATE, STATE_RETURNED);
            annot.contents = arrProps.join(";");
        }
    }
}
javascript_obj0207_001.js pdf-javascript-stream PDF /JS object 207 at offset 0xB646 11503 bytes
SHA-256: 134dcea3245a20a641ef7275cb3bef9d6455db27e7caac2bd70f3663f8b3b24f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
//@@FORMSWORKFLOW auto-generated script

/**************************************************************
AdobePatentID="B643"
**************************************************************/
var AdobePatentID = "AdobePatentID=\"B643\"";

// Show a dialog to ask the user's name and email during submit.
askUserIdentity = function(doc)
{
    // string constants
    var dlgStrings =
    {
        sDlgTitle:          "Send Form",
        sEmailLabel:        "&Email Address:",
        sNameLabel:         "Full &Name:",
        sSubmitLabel:       "&Send",
        sToLabel:           "To:",
        sSubjectLabel:      "Subject:",
        sSubjectContent:    "Submitting Completed Form",
        sAttachmentLabel:   "Attachment:",
        sFromLabel:         "From:",
        sErrorEmailRequired:"Please enter a valid email address.",
        sErrorNameRequired: "Please enter your name."
    };
    
    var dlgElems = [];
    dlgElems[dlgElems.length] = {
        type: "view",
        align_children: "align_left",
        elements:
        [
            {
                type: "view",
                align_children: "align_row",
                elements:
                [
                    {
                        type: "static_text",
                        name: dlgStrings.sToLabel,
                        width: 80,
                        bold: true,
                        font: "dialog"
                    },
                    {
                        type: "static_text",
                        item_id: "sdto",
                        width: 270,
                        font: "dialog"
                    }
                ]
            },
            {
                type: "view",
                align_children: "align_row",
                elements:
                [
                    {
                        type: "static_text",
                        name: dlgStrings.sSubjectLabel,
                        bold: true,
                        width: 80,
                        font: "dialog"
                    },
                    {
                        type: "static_text",
                        name: dlgStrings.sSubjectContent,
                        width: 270,
                        font: "dialog"
                    }
                ]
            },
            {
                type: "view",
                align_children: "align_row",
                elements:
                [
                    {
                        type: "static_text",
                        name: dlgStrings.sAttachmentLabel,
                        bold: true,
                        width: 80,
                        font: "dialog"
                    },
                    {
                        type: "static_text",
                        item_id: "atch",
                        width: 270,
                        font: "dialog"
                    }
                ]
            },
            {
                type: "gap",
                height: 5,
                width: 350
            },
            {
                type: "static_text",
                name: dlgStrings.sFromLabel,
                bold: true,
                font: "dialog"
            },
            {
                type: "static_text",
                name: dlgStrings.sEmailLabel,
                bold: true,
                font: "dialog"
            },
            {
                type: "edit_text",
                item_id: "emal",
                width: 250
            },
            {
                type: "static_text",
                name: dlgStrings.sNameLabel,
                bold: true,
                font: "dialog"
            },
            {
                type: "edit_text",
                item_id: "name",
                width: 250
            },
            {
                type: "gap",
                height: 5,
                width: 350
            },
            {
                type: "ok_cancel",
                ok_name: dlgStrings.sSubmitLabel
            }
        ]
    }
    
    var desc = {
        resourceContext: "AcroForm",
        description:  {
            name: dlgStrings.sDlgTitle,
            elements: [
                {
                    type: "view",
                    align_children: "align_left",
                    elements: dlgElems
                }
            ]
        }
    }

    desc.initialize = function(dialog)
    {
        var METADATA_ANNOT_NAME = "adhocFormState";
        var PROP_INITIATOR = "initiator";
        
        var initiator;
        var annot = doc.getAnnot(0, METADATA_ANNOT_NAME);
        if (annot != null) {
            var arrProps = new Array();
            arrProps = annot.contents.split(";");
            initiator = getProperty(arrProps, PROP_INITIATOR);
        }
        
        var decodedFileName = unescape(doc.documentFileName);
        var initVars =
        {
            sdto: initiator,
            atch: decodedFileName
        }
        dialog.load(initVars);
    }

    desc.validate = function(dialog)
    {
        var values = dialog.store();
        if (values.emal == "") {
            app.alert(dlgStrings.sErrorEmailRequired);
            return false;
        }
        if (values.name == "") {
            app.alert(dlgStrings.sErrorNameRequired);
            return false;
        }
        return true;
    };
        
    desc.commit = function(dialog)
    {
        this.result = new Object;
        var values = dialog.store();
        this.result.name = values.name;
        this.result.email = values.emal;
    };

    var ret = app.execDialog(desc);
    if (ret == "ok")
        return desc.result;
    else
        return null;
};

askEmailClient = function(doc)
{
// string constants
    var dlgStrings =
    {
        sDlgTitle:      "Select Email Client",
        sDlgText:       "Please indicate the option which best describes how you send mail.",
        sDesktop:       "&Desktop Email Application",
        sDesktopDesc:   "Choose this option if you currently use an email application such as Microsoft Outlook Express, Microsoft Outlook, Eudora, or Mail.",
        sInternet:      "&Internet Email",
        sInternetDesc:  "Choose this option if you currently use an Internet email service such as Yahoo or Microsoft Hotmail. You will then need to save your form and return it manually to johanna.kontturi@certia.fi using your Internet email service."
    };
    
    var dlgElems = [];
    dlgElems[dlgElems.length] = {
        type: "view",
        align_children: "align_left",
        alignment: "align_fill",
        elements:
        [
            {
                type: "static_text",
                name: dlgStrings.sDlgText,
                width: 350,                
                font: "dialog"
            },
            {
                type: "radio",
                name: dlgStrings.sDesktop,
                item_id: "rad1",
                group_id: "rgrp",
                bold: true,
                font: "dialog"
            },
            {
                type: "view",
                align_children: "align_top",
                elements:
                [
                    {
                        type: "gap",
                        width: 20
                    },
                    {
                        type: "static_text",
                        name: dlgStrings.sDesktopDesc,
                        wrap_name: true,
                        width: 342,
                        font: "dialog"
                    }
                ]
            },            
            {
                type: "radio",
                name: dlgStrings.sInternet,
                item_id: "rad2",
                group_id: "rgrp",
                bold: true,
                font: "dialog"

            },
            {
                type: "view",
                align_children: "align_top",
                elements:
                [
                    {
                        type: "gap",
                        width: 20
                    },
                    {
                        type: "static_text",
                        name: dlgStrings.sInternetDesc,
                        wrap_name: true,
                        width: 342,
                        font: "dialog"
                    }
                ]
            },
            {
                type: "gap",
                height: 5,
                width: 350
            },
            {
                type: "ok_cancel",
            }
        ]
    }
    
    var desc = {
        resourceContext: "AcroForm",
        description:  {
            name: dlgStrings.sDlgTitle,
            width: 250,
            elements: [
                {
                    type: "view",
                    align_children: "align_left",
                    elements: dlgElems
                }
            ]
        }
    }
    
    desc.commit = function(dialog)
    {
        this.result = new Object;
        var values = dialog.store();
        this.result.send = values.rad1;
        this.result.save = values.rad2;
    };

    var ret = app.execDialog(desc);
    if (ret == "ok")
        return desc.result;
    else
        return null;            
};

/**************************************************************
AdobePatentID="B643"
**************************************************************/
// set a new property value to a property in the specified array.
setProperty = function(arrProps, propName, propValue)
{
    var i;
    var bSet = false;
    for (i = 0; i < arrProps.length; i++) {
        var propParts = new Array();
        propParts = arrProps[i].split(":");
        if (propParts[0] == propName) {
            propParts[1] = propValue;
            arrProps[i] = propParts.join(":");
            bSet = true;
            break;
        }
    }
    
    if (!bSet)
        arrProps[arrProps.length] = propName + ":" + propValue;
};

/**************************************************************
AdobePatentID="B643"
**************************************************************/
// get the value for a property in the specified array.
getProperty = function(arrProps, propName)
{
    var i;
    for (i = 0; i < arrProps.length; i++) {
        var propParts = new Array();
        propParts = arrProps[i].split(":");
        if (propParts[0] == propName) {
            return propParts[1];
        }
    }
    return null;
};

/**************************************************************
AdobePatentID="B643"
**************************************************************/
showAutoGenSubmitBtn = function(bShow)
{
    var autoGenSubmitName = "form1[0].ButtonField1[0]";
    var fld = this.getField(autoGenSubmitName);
    if (fld != null)
    {
        var b= this.dirty;
        if (bShow)
            fld.display = display.noPrint;
        else
            fld.display = display.hidden;
        this.dirty= b;
    }
};

// Hide the auto-generated submit button for Acrobat/Reader >= 9.0
if (app.viewerVersion >= 9)
    showAutoGenSubmitBtn(false);
else
    showAutoGenSubmitBtn(true);
javascript_obj0208_002.js pdf-javascript-stream PDF /JS object 208 at offset 0xBFAD 1313 bytes
SHA-256: f94e41f586bf3f20bc1deeac4bfbda388a61db43f25fbd6304ba73f5653368cf
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.6)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 8.0)
         {
            if (app.alert(ADBE.Reader_string_Need_New_Version_Msg, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.6"});
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
		   else if (app.viewerVersion < 8.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
               app.launchURL(ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, true);
         }
         else if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.6"});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
javascript_obj0209_003.js pdf-javascript-stream PDF /JS object 209 at offset 0xC18F 902 bytes
SHA-256: 1b2ec98752b966f601d5223a750559cf13d562ac5e5c6d1fcc7217835b01f5fd
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 8.1)
{
   ADBE.Reader_Need_Version = 8.1;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Reader_Need_Version;
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 8.1)
{
   ADBE.Viewer_Need_Version = 8.1;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Viewer_Need_Version;
}
javascript_obj0210_004.js pdf-javascript-stream PDF /JS object 210 at offset 0xC2ED 2795 bytes
SHA-256: 826c5622c798d67e5281cca7e05933dddc90ccdcb0a6177c9f7d06f11bef8f7f
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
font_00_cff_off00000937.bin pdf-font-stream PDF embedded font (cff) at offset 0x937 3907 bytes
SHA-256: 87f6821ea7e5d41d56f8cc2a939bb40ac9487c6df45bf2376e6adbc768081f58
font_01_sfnt_off00012890.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12890 95975 bytes
SHA-256: c29e5b1537bee8c88b3ffca56c5f24a45ec8da374cf9d4c0b4a78d04fc230949
font_02_cff_off0002479e.bin pdf-font-stream PDF embedded font (cff) at offset 0x2479E 6013 bytes
SHA-256: 25316e6ef10fae455d1fcf7c92093ea2df713d3b40f605eecd85b19811c47a57
font_03_cff_off00026129.bin pdf-font-stream PDF embedded font (cff) at offset 0x26129 10178 bytes
SHA-256: e7ba48e2b8c5bace9783e2b6d2ca0e14b1f7e0d0461106328735597ec4e6e906
font_04_cff_off000288c1.bin pdf-font-stream PDF embedded font (cff) at offset 0x288C1 8997 bytes
SHA-256: ffa5ec5d4b5102547c14deba45374e016cb7342407dbd297fcafd421ec30b280

Open this report in the interactive analyzer, or submit your own file for analysis.