Malicious PDF — malware analysis report

Static analysis result for SHA-256 d8a2ab6df6946e84…

MALICIOUS

PDF

487.2 KB Created: Y?WÛNkµ‘_’î„ðZ°é Authoring application: Ql „86÷ˁí™ðD°“ƒ×¸|*SRQÙ]Jj#S,×z¢þÜA (via \f„8ñ†)ȬìíKÁï‚å)xbOñN ;mcr‰*) First seen: 2026-05-11
MD5: 9d4ab976541af727fbcfd0586ff8b0b2 SHA-1: d8f32dc3d8d32907478c03f2f4cfaaa0ee0a535a SHA-256: d8a2ab6df6946e8416a5139526546dabb4065fde1279b681d2bfc665d3ae733a
64 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

The PDF file is encrypted and contains embedded JavaScript, indicating an attempt to conceal malicious activity. The presence of JavaScript actions and streams suggests that the script is likely used to download and execute a second-stage payload or to obfuscate the document's true content. The high confidence heuristic 'PDF_ENCRYPTED_WITH_JS' strongly supports this assessment.

Machine Learning

  • Nyx PDF Classifier clean score 0.1989

Heuristics 4

  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0366_000.js pdf-javascript-stream PDF /JS object 366 at offset 0x188F3 38 bytes
SHA-256: ff0b1e0798b55aee9e494d4b5046c0d747ee05557796f33002cd8f8168a10b67
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 3, 0, 0, "", true);
javascript_obj0367_001.js pdf-javascript-stream PDF /JS object 367 at offset 0x18948 41 bytes
SHA-256: 5b4e1a57bf6476c87a1db4d415eeb42e1477d446a4236b8ae4189d3d8f669dde
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 3, 0, 0, "", true);
javascript_obj0383_002.js pdf-javascript-stream PDF /JS object 383 at offset 0x18DFB 252 bytes
SHA-256: c2c0e0c4b24a3e331855e2fb8fd25dbf2bcb1230f45f80d4fea2c8a7681404d7
Preview script
First 1,000 lines of the extracted script
var a;
var f;
var v=0;
var i=0;

for (i=15;i<=24;i++) {
    f = "tx_4_" + i + "_2";
    a = getField(f).value;
    if (a != 0) {
        v += a;
    }
}
if (v == 0) {
    getField("tx_4_25_1").value = "";
}
else {
    getField("tx_4_25_1").value = v;
}
javascript_obj0384_003.js pdf-javascript-stream PDF /JS object 384 at offset 0x18F41 54 bytes
SHA-256: 877f65bda8f761c8bf53be624302c9f469dc48b9f7ef14fe5bdb76dea166c998
Preview script
First 1,000 lines of the extracted script
if (event.change.match(/\D+/g)) {
	event.rc = false;
}
javascript_obj0386_004.js pdf-javascript-stream PDF /JS object 386 at offset 0x18FDE 38 bytes
SHA-256: fefbea8a61fff6d2a5e8d7c764a407c92249644f8a10b0dec3cfae812883a2b7
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 2, 0, 0, "", true);
javascript_obj0387_005.js pdf-javascript-stream PDF /JS object 387 at offset 0x19033 41 bytes
SHA-256: 572a91fc51702643df28955aaeeb86dd1625f4e3544ee1ba29446fcedc17c93d
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 2, 0, 0, "", true);
javascript_obj0420_006.js pdf-javascript-stream PDF /JS object 420 at offset 0x19A1F 140 bytes
SHA-256: 7013cca9c27fe1dc8daaa2dae931a337a48e7ecfe5d375ae1280d4b5ca8537e8
Preview script
First 1,000 lines of the extracted script
var a;
a = getField("tx_1_00_1").value;
if (a != "") {
    getField("tx_2_00_0").value = a;
}
else {
    getField("tx_2_00_0").value = "";
}
javascript_obj0426_007.js pdf-javascript-stream PDF /JS object 426 at offset 0x19DD8 142 bytes
SHA-256: 5f3b80f9b22a9431df93a44e3ab0fe31ab5612bfdaab5e1e4b4f1a6249430a78
Preview script
First 1,000 lines of the extracted script
var a;
a = getField("tx_2_15_5").value;
if (a != "") {
    getField("tx_2_15_6").value = "%";
}
else {
    getField("tx_2_15_6").value = "";
}
javascript_obj0427_008.js pdf-javascript-stream PDF /JS object 427 at offset 0x19EA2 142 bytes
SHA-256: 0713473e715409bda5b1511a95997ee03631b791c4c17a380ac317205ccf15e8
Preview script
First 1,000 lines of the extracted script
var a;
a = getField("tx_2_16_5").value;
if (a != "") {
    getField("tx_2_16_6").value = "%";
}
else {
    getField("tx_2_16_6").value = "";
}
javascript_obj0430_009.js pdf-javascript-stream PDF /JS object 430 at offset 0x1A019 37 bytes
SHA-256: 44a6b83dbdb1e6c48965b8995a3550391d5dac52fa33d8d1923d1490732fd2a3
Preview script
First 1,000 lines of the extracted script
AFRange_Validate(true, 0, true, 999);
javascript_obj0435_010.js pdf-javascript-stream PDF /JS object 435 at offset 0x1A27E 71 bytes
SHA-256: 04f5fc40b31df2b83eb7df82b933f7f729c433b6e248c0ea42dac38ecb82e0bc
Preview script
First 1,000 lines of the extracted script
// Filtert Werte zwischen 1 und 31
AFRange_Validate(true, 1, true, 31);
javascript_obj0438_011.js pdf-javascript-stream PDF /JS object 438 at offset 0x1A41C 71 bytes
SHA-256: 61b4af6221f27e0fe2767ca33e6326a20629683cd2f710312ea3b90f8c83e35b
Preview script
First 1,000 lines of the extracted script
// Filtert Werte zwischen 1 und 12
AFRange_Validate(true, 1, true, 12);
javascript_obj0441_012.js pdf-javascript-stream PDF /JS object 441 at offset 0x1A5BA 76 bytes
SHA-256: af87222712ed2d6f953c786a7c295d588b78e8ee3b137fd86157f1a307eb26f0
Preview script
First 1,000 lines of the extracted script
// Filtert Werte zwischen 1 und 31
AFRange_Validate(true, 1900, true, 2000);
javascript_obj0453_014.js pdf-javascript-stream PDF /JS object 453 at offset 0x1AC1E 33 bytes
SHA-256: c4287c5c3e37d48b98ace11b04930d19e8be4d405af6749d7e51f8d70a59029e
Preview script
First 1,000 lines of the extracted script
AFDate_KeystrokeEx("dd.mm.yyyy");
javascript_obj0468_015.js pdf-javascript-stream PDF /JS object 468 at offset 0x1B4C6 140 bytes
SHA-256: ded8203ae2fe4dea99fbddd828310816efaf22fb1b83ae26e0c27a74ea993948
Preview script
First 1,000 lines of the extracted script
if (event.change.match(/\D+/g)) {
    if (event.change.match(/\/+/g)) {
        event.rc = true;
    }
    else {
	event.rc = false;
    }
}
javascript_obj0718_018.js pdf-javascript-stream PDF /JS object 718 at offset 0x30F6D 410 bytes
SHA-256: 39cd7eac24cc855efe26a12dcae447cf17f1a5736458a2427cfe683faf9c20b4
Preview script
First 1,000 lines of the extracted script
var v = 0;
var a;
a = this.getField("tx_3_10_2").value;
if (a != "") {
    v += a * 6;
}
a = this.getField("tx_3_11_1").value;
if (a != "") {
    v += a * 12;
}
a = this.getField("tx_3_11_2").value;
if (a != "") {
    v += a * 24;
}
a = this.getField("tx_3_11_3").value;
if (a != "") {
    v -= a;
}
if (v == 0) {
    this.getField("tx_3_11_4").value = "";
}
else {
    this.getField("tx_3_11_4").value = v;
}
javascript_obj0719_019.js pdf-javascript-stream PDF /JS object 719 at offset 0x31048 410 bytes
SHA-256: 55ce4b02caf5cf2aee7659d4fcc3fbc360a937107c73c4734672164777b113ee
Preview script
First 1,000 lines of the extracted script
var v = 0;
var a;
a = this.getField("tx_4_05_2").value;
if (a != "") {
    v += a * 6;
}
a = this.getField("tx_4_06_1").value;
if (a != "") {
    v += a * 12;
}
a = this.getField("tx_4_06_2").value;
if (a != "") {
    v += a * 24;
}
a = this.getField("tx_4_06_3").value;
if (a != "") {
    v -= a;
}
if (v == 0) {
    this.getField("tx_4_06_4").value = "";
}
else {
    this.getField("tx_4_06_4").value = v;
}
javascript_obj0720_020.js pdf-javascript-stream PDF /JS object 720 at offset 0x31123 286 bytes
SHA-256: 70b9779986a7d9a53a3d984076f42dd3088cff91b28fc83595fc5b6380814ebc
Preview script
First 1,000 lines of the extracted script
var v = 0;
var anz = 0;
var a;
a = this.getField("tx_4_10_2").value;
if (a != "") {
    v += a;
}
a = this.getField("tx_4_10_3").value;
if (a != "") {
    anz = a;
}
v *= anz;
if (v == 0) {
    this.getField("tx_4_10_4").value = "";
}
else {
    this.getField("tx_4_10_4").value = v;
}
javascript_obj0721_021.js pdf-javascript-stream PDF /JS object 721 at offset 0x311F2 353 bytes
SHA-256: 424e0155efba61241539bf8ba7a5a981ddbbc16774d40437d8d2ea78c14c49f3
Preview script
First 1,000 lines of the extracted script
var v = 0;
var anz = 0;
var a;
a = this.getField("tx_4_10_2").value;
if (a != "") {
    v += a;
}
a = this.getField("tx_4_10_3").value;
if (a != "") {
    anz = a;
}
v *= anz;
a = this.getField("tx_4_10_5").value;
if (a != "") {
    v -= a;
}
if (v == 0) {
    this.getField("tx_4_10_6").value = "";
}
else {
    this.getField("tx_4_10_6").value = v;
}
javascript_obj0722_022.js pdf-javascript-stream PDF /JS object 722 at offset 0x312CA 286 bytes
SHA-256: 3d69b272b919ca4ea90dfc9367c55aa23782f3b7f32bdf48e46151b722e7eb10
Preview script
First 1,000 lines of the extracted script
var v = 0;
var anz = 0;
var a;
a = this.getField("tx_3_15_2").value;
if (a != "") {
    v += a;
}
a = this.getField("tx_3_15_3").value;
if (a != "") {
    anz = a;
}
v *= anz;
if (v == 0) {
    this.getField("tx_3_15_4").value = "";
}
else {
    this.getField("tx_3_15_4").value = v;
}
javascript_obj0723_023.js pdf-javascript-stream PDF /JS object 723 at offset 0x31399 353 bytes
SHA-256: 8ae4483daa0370c5c88dfc586aa855e74df0ad0f46b1d05148edb672111a0267
Preview script
First 1,000 lines of the extracted script
var v = 0;
var anz = 0;
var a;
a = this.getField("tx_3_15_2").value;
if (a != "") {
    v += a;
}
a = this.getField("tx_3_15_3").value;
if (a != "") {
    anz = a;
}
v *= anz;
a = this.getField("tx_3_15_5").value;
if (a != "") {
    v -= a;
}
if (v == 0) {
    this.getField("tx_3_15_6").value = "";
}
else {
    this.getField("tx_3_15_6").value = v;
}
javascript_obj0724_024.js pdf-javascript-stream PDF /JS object 724 at offset 0x31471 291 bytes
SHA-256: 0b11b29860f9abae1bb96147d13e2a6a4eb256c4fc93ebf96011dc1277c9e0b3
Preview script
First 1,000 lines of the extracted script
var v = 0;
var anz = 0;
var a;
a = this.getField("tx_3_16_2").value;
if (a != "") {
    v = a;
}
a = this.getField("tx_3_16_3").value;
if (a != "") {
    anz = a;
}
v *= anz * 0.4;
if (v == 0) {
    this.getField("tx_3_16_4").value = "";
}
else {
    this.getField("tx_3_16_4").value = v;
}
javascript_obj0725_025.js pdf-javascript-stream PDF /JS object 725 at offset 0x31543 358 bytes
SHA-256: 4b0aa042f77371d2654ea9936dec5cdc1475d839c06e7b009bcaf0d3849536f1
Preview script
First 1,000 lines of the extracted script
var v = 0;
var anz = 0;
var a;
a = this.getField("tx_3_16_2").value;
if (a != "") {
    v = a;
}
a = this.getField("tx_3_16_3").value;
if (a != "") {
    anz = a;
}
v *= anz * 0.4;
a = this.getField("tx_3_16_5").value;
if (a != "") {
    v -= a;
}
if (v == 0) {
    this.getField("tx_3_16_6").value = "";
}
else {
    this.getField("tx_3_16_6").value = v;
}
javascript_obj0726_026.js pdf-javascript-stream PDF /JS object 726 at offset 0x3161E 286 bytes
SHA-256: 75bc3622c71a9049885ad53d680fd19413776e9bd447df49ef15d114681a30c7
Preview script
First 1,000 lines of the extracted script
var v = 0;
var anz = 0;
var a;
a = this.getField("tx_3_18_2").value;
if (a != "") {
    v += a;
}
a = this.getField("tx_3_18_3").value;
if (a != "") {
    anz = a;
}
v *= anz;
if (v == 0) {
    this.getField("tx_3_18_4").value = "";
}
else {
    this.getField("tx_3_18_4").value = v;
}
javascript_obj0727_027.js pdf-javascript-stream PDF /JS object 727 at offset 0x316ED 353 bytes
SHA-256: 9bd05563a86b5f0f383742102f3860bdf281b44cf1e3a1b6c671699cae034474
Preview script
First 1,000 lines of the extracted script
var v = 0;
var anz = 0;
var a;
a = this.getField("tx_3_18_2").value;
if (a != "") {
    v += a;
}
a = this.getField("tx_3_18_3").value;
if (a != "") {
    anz = a;
}
v *= anz;
a = this.getField("tx_3_18_5").value;
if (a != "") {
    v -= a;
}
if (v == 0) {
    this.getField("tx_3_18_6").value = "";
}
else {
    this.getField("tx_3_18_6").value = v;
}
javascript_obj0728_028.js pdf-javascript-stream PDF /JS object 728 at offset 0x317C5 260 bytes
SHA-256: c96c925a888a1112ac89997a5ae09ac0f21f0a8b2f5c04f4d43ebe4e4c868701
Preview script
First 1,000 lines of the extracted script
var a;
var v = 0;
a = this.getField("tx_3_17_4").value;
if (a != "") {
    v = a;
}
a = this.getField("tx_3_17_5").value;
if (a != "") {
    v -= a;
}
if (v == 0) {
    this.getField("tx_3_17_6").value = "";
}
else {
    this.getField("tx_3_17_6").value = v;
}
javascript_obj0729_029.js pdf-javascript-stream PDF /JS object 729 at offset 0x31887 1574 bytes
SHA-256: a06686e93065ffa42ef12105ba255a1863a7ca95469fa8bb402d877fe3743406
Preview script
First 1,000 lines of the extracted script
var a;
var f;
var anz=0;
var v=0;
var vt=0;
var i=0;

for (i=4;i<=5;i++) {
    f = "tx_3_0" + i + "_6";
    a = getField(f).value;
    if (a != 0) {
        v += a;
    }
}
for (i=6;i<=9;i++) {
    f = "tx_3_0" + i + "_2";
    a = getField(f).value;
    if (a != 0) {
        v += a;
    }
}
a = this.getField("tx_3_10_2").value;
if (a != "") {
    vt = a * 6;
}
a = this.getField("tx_3_11_1").value;
if (a != "") {
    vt += a * 12;
}
a = this.getField("tx_3_11_2").value;
if (a != "") {
    vt += a * 24;
}
a = this.getField("tx_3_11_3").value;
if (a != "") {
    vt -= a;
}
v += vt;
vt = 0;
anz = 0;
a = this.getField("tx_3_15_2").value;
if (a != "") {
    vt = a;
}
a = this.getField("tx_3_15_3").value;
if (a != "") {
    anz = a;
}
vt *= anz;
a = this.getField("tx_3_15_5").value;
if (a != "") {
    vt -= a;
}
v += vt;
vt = 0;
anz = 0;
a = this.getField("tx_3_16_2").value;
if (a != "") {
    vt = a;
}
a = this.getField("tx_3_16_3").value;
if (a != "") {
    anz = a;
}
vt *= (anz * 0.4);
a = this.getField("tx_3_16_5").value;
if (a != "") {
    vt -= a;
}
v += vt;
vt = 0;
anz = 0;
a = this.getField("tx_3_17_4").value;
if (a != "") {
    vt = a;
}
a = this.getField("tx_3_17_5").value;
if (a != "") {
    vt -= a;
}
v += vt
vt = 0;
anz = 0;
a = this.getField("tx_3_18_2").value;
if (a != "") {
    vt = a;
}
a = this.getField("tx_3_18_3").value;
if (a != "") {
    anz = a;
}
vt *= anz;
a = this.getField("tx_3_18_5").value;
if (a != "") {
    vt -= a;
}
v += vt;

if (v == 0) {
    getField("tx_3_19_1").value = "";
}
else {
    getField("tx_3_19_1").value = v;
}
javascript_obj0730_030.js pdf-javascript-stream PDF /JS object 730 at offset 0x31A02 320 bytes
SHA-256: dda0f068943f0c8e903e0a8750639fc777bfcc5289fdf474673c1fe3af7c9fd3
Preview script
First 1,000 lines of the extracted script
var f;
var a;
var i=0;
var v=0;

for (i=23;i<=24;i++) {
    f = "tx_3_" + i + "_6";
    a = getField(f).value;
    if (a != 0) {
        v += a;
    }
}
a = this.getField("tx_3_25_2").value;
if (a != "") {
    v += a;
}

if (v == 0) {
    getField("tx_3_26_2").value = "";
}
else {
    getField("tx_3_26_2").value = v;
}
javascript_obj0731_031.js pdf-javascript-stream PDF /JS object 731 at offset 0x31AF5 1642 bytes
SHA-256: 30f5c5f58e19ca7f1232f29905922877ac2d3a87304bb02d9b7dbed0f41fbcb9
Preview script
First 1,000 lines of the extracted script
var a;
var f;
var anz=0;
var v=0;
var vt=0;
var i=0;

for (i=23;i<=24;i++) {
    f = "tx_3_" + i + "_6";
    a = getField(f).value;
    if (a != 0) {
        v += a;
    }
}
a = this.getField("tx_3_25_2").value;
if (a != "") {
    v += a;
}
for (i=2;i<=4;i++) {
    f = "tx_4_0" + i + "_2";
    a = getField(f).value;
    if (a != 0) {
        v += a;
    }
}
a = this.getField("tx_4_05_2").value;
if (a != "") {
    vt = a * 6;
}
a = this.getField("tx_4_06_1").value;
if (a != "") {
    vt += a * 12;
}
a = this.getField("tx_4_06_2").value;
if (a != "") {
    vt += a * 24;
}
a = this.getField("tx_4_06_3").value;
if (a != "") {
    vt -= a;
}
v += vt;
vt = 0;
anz = 0;
a = this.getField("tx_4_10_2").value;
if (a != "") {
    vt = a;
}
a = this.getField("tx_4_10_3").value;
if (a != "") {
    anz = a;
}
vt *= anz;
a = this.getField("tx_4_10_5").value;
if (a != "") {
    vt -= a;
}
v += vt;
vt = 0;
anz = 0;
a = this.getField("tx_4_11_2").value;
if (a != "") {
    vt = a;
}
a = this.getField("tx_4_11_3").value;
if (a != "") {
    anz = a;
}
vt *= (anz * 0.4);
a = this.getField("tx_4_11_5").value;
if (a != "") {
    vt -= a;
}
v += vt;
vt = 0;
anz = 0;
a = this.getField("tx_4_12_4").value;
if (a != "") {
    vt = a;
}
a = this.getField("tx_4_12_5").value;
if (a != "") {
    vt -= a;
}
v += vt
vt = 0;
anz = 0;
a = this.getField("tx_4_13_2").value;
if (a != "") {
    vt = a;
}
a = this.getField("tx_4_13_3").value;
if (a != "") {
    anz = a;
}
vt *= anz;
a = this.getField("tx_4_13_5").value;
if (a != "") {
    vt -= a;
}
v += vt;

if (v == 0) {
    getField("tx_4_14_1").value = "";
}
else {
    getField("tx_4_14_1").value = v;
}
javascript_obj0732_032.js pdf-javascript-stream PDF /JS object 732 at offset 0x31C77 291 bytes
SHA-256: f3578e2c1838a346c838a247b97357bb5e553472ec8bca7ca75d486016928b26
Preview script
First 1,000 lines of the extracted script
var v = 0;
var anz = 0;
var a;
a = this.getField("tx_4_11_2").value;
if (a != "") {
    v = a;
}
a = this.getField("tx_4_11_3").value;
if (a != "") {
    anz = a;
}
v *= anz * 0.4;
if (v == 0) {
    this.getField("tx_4_11_4").value = "";
}
else {
    this.getField("tx_4_11_4").value = v;
}
javascript_obj0733_033.js pdf-javascript-stream PDF /JS object 733 at offset 0x31D49 358 bytes
SHA-256: 75503e57e438a721e380db77d50655aaac130ee8097a2622f89ff68d7e0a9e8a
Preview script
First 1,000 lines of the extracted script
var v = 0;
var anz = 0;
var a;
a = this.getField("tx_4_11_2").value;
if (a != "") {
    v = a;
}
a = this.getField("tx_4_11_3").value;
if (a != "") {
    anz = a;
}
v *= anz * 0.4;
a = this.getField("tx_4_11_5").value;
if (a != "") {
    v -= a;
}
if (v == 0) {
    this.getField("tx_4_11_6").value = "";
}
else {
    this.getField("tx_4_11_6").value = v;
}
javascript_obj0734_034.js pdf-javascript-stream PDF /JS object 734 at offset 0x31E24 260 bytes
SHA-256: d9f626c0cb9e04623546c55341e4eb86f683be6b9dd6cf4fbcc4f7e187be7945
Preview script
First 1,000 lines of the extracted script
var a;
var v = 0;
a = this.getField("tx_4_12_4").value;
if (a != "") {
    v = a;
}
a = this.getField("tx_4_12_5").value;
if (a != "") {
    v -= a;
}
if (v == 0) {
    this.getField("tx_4_12_6").value = "";
}
else {
    this.getField("tx_4_12_6").value = v;
}

Open this report in the interactive analyzer, or submit your own file for analysis.