PDF static analysis report

Static analysis result for SHA-256 dc3cb24623c6c393…

SUSPICIOUS

PDF

911.3 KB Created: 2007-10-24 11:44:32 +02:00 Authoring application: Acrobat Distiller 7.0.5 for Macintosh First seen: 2026-05-10
MD5: 838ca5502a73feddbb55be86741d2506 SHA-1: 1f4f20b0ad667b9178fac805ff0a5ddfce70d5b0 SHA-256: dc3cb24623c6c393301aa4369ac23d857ce0ccf702c1972831f974c68a39a8ea
50 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains numerous embedded JavaScript streams and triggers associated with JavaScript actions and AcroForm buttons. The heuristic firings indicate that these JavaScript objects are obfuscated and likely intended to download and execute a second-stage payload. No specific family could be identified due to the generic nature of the obfuscation and lack of clear indicators.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4904

Heuristics 7

  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/g/img/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj1596_002.js pdf-javascript-stream PDF /JS object 1596 at offset 0x83F58 64 bytes
SHA-256: b1eabd7002b3b6d4374372895528a4cc253665c9907fdfbc558550d6bb45b956
Preview script
First 1,000 lines of the extracted script
if (!checkGeburtsdatum(event.value)) {
    event.value = "";
}
javascript_obj2151_003.js pdf-javascript-stream PDF /JS object 2151 at offset 0x89889 42 bytes
SHA-256: 38771303e5b133f65b24c6712ec9e6df4c1e3ff95fa802e5cb4ed740e2d70e27
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 3, 0, 0, "", false);
javascript_obj2153_004.js pdf-javascript-stream PDF /JS object 2153 at offset 0x898DD 39 bytes
SHA-256: 3bc80ec40ddc2a11c8e2fe6adcd0b03351c4b296889df91d41bcbfba1fd9d4ad
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 3, 0, 0, "", false);
javascript_obj2337_005.js pdf-javascript-stream PDF /JS object 2337 at offset 0x8A17F 43 bytes
SHA-256: 517a26f1d133e376fd4bba7863bb558e0a9a58f0e6a947fb94614fccfb32c44c
Preview script
First 1,000 lines of the extracted script
AFRange_Validate(true, 5000, true, 100000);
javascript_obj2899_006.js pdf-javascript-stream PDF /JS object 2899 at offset 0x8B3B0 42 bytes
SHA-256: 1829f93c988f1bfcd4bf6a74fc06fa5705171ae9bf3ac877b13813c6b492c742
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 2, 0, 0, "", false);
javascript_obj2900_007.js pdf-javascript-stream PDF /JS object 2900 at offset 0x8B404 39 bytes
SHA-256: 3328eab8501405fcffcc95bb30fbb8bcb963b88928e4a40bd4be3a45d3e80107
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 2, 0, 0, "", false);
javascript_obj2994_008.js pdf-javascript-stream PDF /JS object 2994 at offset 0x8BE9A 37 bytes
SHA-256: 45484b6fb4ae63fb1b7a383c5b5567ae0f7931d2ed4c8c9092e3f50c0aad9c8b
Preview script
First 1,000 lines of the extracted script
AFRange_Validate(true, 10, true, 99);
javascript_obj3058_009.js pdf-javascript-stream PDF /JS object 3058 at offset 0x8CAF0 37 bytes
SHA-256: a4a6dbf7eb1f961bdf14d5cf9115e4c217095ec8a32a06c8edf2d9b0a521ee81
Preview script
First 1,000 lines of the extracted script
AFRange_Validate(true, 60, true, 85);
javascript_obj3104_010.js pdf-javascript-stream PDF /JS object 3104 at offset 0x8D89A 36 bytes
SHA-256: 2648b4119a040a5615a8a1b4d46e0ce397baef985e1dab8a6407d49c1486a8e9
Preview script
First 1,000 lines of the extracted script
AFRange_Validate(true, 0, true, 85);
javascript_obj3106_011.js pdf-javascript-stream PDF /JS object 3106 at offset 0x8D8E8 237 bytes
SHA-256: 5d4c104bacc58641bc28cf5e50c875385bf5b162b31b996d7ac26d9afa5c0a85
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
datum = event.value;
if (datum != "") {
datum = getDatum(datum);
limit = getDatum('01012007');

if (datum < limit) {
	app.alert(unescape("Der Versicherungsbeginn darf nicht vor dem 01.01.2007 liegen."),1);
	event.rc = false;
}
}
javascript_obj3119_012.js pdf-javascript-stream PDF /JS object 3119 at offset 0x8DA1D 66 bytes
SHA-256: 67263f165a3a441d0038d5997411413b8a9f8b5902833afbd9966df52c261d1c
Preview script
First 1,000 lines of the extracted script
wert = event.value;
if (wert == "ja") {
    bitteFormular(6);
}
javascript_obj3155_013.js pdf-javascript-stream PDF /JS object 3155 at offset 0x8DA91 71 bytes
SHA-256: 469d8d530b2af6ad48dc9158098135697a18b00252d241b78e6f4628d0f2715c
Preview script
First 1,000 lines of the extracted script
wert = event.value;
if (wert == "direkt") { 
    bitteFormular(4);
}
javascript_obj4173_029.js pdf-javascript-stream PDF /JS object 4173 at offset 0xA3793 199 bytes
SHA-256: bc5cabb464bd6493d4edb053df7d42aeb5db3d18737ab9cde38a91aff940bd47
Preview script
First 1,000 lines of the extracted script
var nachname = this.getField("nachname.ast");
var vorname = this.getField("vorname.ast");
var trenner = (vorname.value != "") ? ", " : "";
event.value = nachname.value + trenner + vorname.value;
javascript_obj4334_030.js pdf-javascript-stream PDF /JS object 4334 at offset 0xA4804 65 bytes
SHA-256: 9b03f9c6665fc798a2d0b145cf056d93bde400c7bcdc6978d3180eeccc2e134d
Preview script
First 1,000 lines of the extracted script
if (!checkGeburtsdatum(event.value)) {
    event.value = "";
}
javascript_obj4604_031.js pdf-javascript-stream PDF /JS object 4604 at offset 0xA7B6F 42 bytes
SHA-256: a22e7a3e6dbfb6427839e3a2fdcab1be9d58bdd666536d5308358ec98c59feed
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "", false);
javascript_obj4605_032.js pdf-javascript-stream PDF /JS object 4605 at offset 0xA7BC3 39 bytes
SHA-256: cf3ef38cead83f4b1b39c7a061c8fef2c62d068861252a2b5ba7c0b959eec058
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "", false);
javascript_obj4638_033.js pdf-javascript-stream PDF /JS object 4638 at offset 0xA7C4C 67 bytes
SHA-256: 77cfe34d4406a79c65948ddff0b6bdf6e29451aeec8c8d1c55cdbcadc122998b
Preview script
First 1,000 lines of the extracted script
if (!checkAnteile (event.value,"an")) {
    event.rc = false;
}
javascript_obj5009_036.js pdf-javascript-stream PDF /JS object 5009 at offset 0xAA3A1 67 bytes
SHA-256: 617e431dff7387b49eedc1298f66f0a15f2dbda9cc604048b98062791607cba2
Preview script
First 1,000 lines of the extracted script
if (!checkAnteile (event.value,"ag")) {
    event.rc = false;
}
javascript_obj5416_037.js pdf-javascript-stream PDF /JS object 5416 at offset 0xB013E 42 bytes
SHA-256: 2927a11b5de8196505468218d0335e4457345716313d2e477e9af256a6453087
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(1, 2, 0, 0, "", false);
javascript_obj5417_038.js pdf-javascript-stream PDF /JS object 5417 at offset 0xB0192 39 bytes
SHA-256: 483e06f06445cc39e6730dde13e0b0119b05238d991f965fa3cc0c1fa3e06089
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(1, 2, 0, 0, "", false);
javascript_obj7476_039.js pdf-javascript-stream PDF /JS object 7476 at offset 0xB36CD 61 bytes
SHA-256: 6194bed55306139fa0613692ba8d7df6566d9b3e25e1da418cf5db1d4d1a07bc
Preview script
First 1,000 lines of the extracted script
if (!nichtVor2008(event.value)) {
    event.rc = false;
}
javascript_obj7517_040.js pdf-javascript-stream PDF /JS object 7517 at offset 0xB42B5 70 bytes
SHA-256: 8181343701a06e8e9555e487e5d2cb4661b62b9b03e5247943073196bce92098
Preview script
First 1,000 lines of the extracted script
if (event.value != "") {
    this.getField("laufzeit").value = "";
}
javascript_obj7518_041.js pdf-javascript-stream PDF /JS object 7518 at offset 0xB432B 82 bytes
SHA-256: 969d68e80cd5494ab250f87fa04e8bad724bef3d670caac9ef666ee46091cd43
Preview script
First 1,000 lines of the extracted script
if (event.value != "") {
    this.getField("renteneintrittsalter").value = "";
}
javascript_obj7595_042.js pdf-javascript-stream PDF /JS object 7595 at offset 0xB555F 66 bytes
SHA-256: eacd816bb09f248d73ec08da6df88d0d030bc6780f8b267998914cf15400ca1b
Preview script
First 1,000 lines of the extracted script
if (!checkGeburtsdatum(event.value)) {
    event.value = "";

}
javascript_obj7874_043.js pdf-javascript-stream PDF /JS object 7874 at offset 0xB645B 39 bytes
SHA-256: 0139a55451b991f0b4e6ee0446e1f6a2e0512cf6848847eb6202003711b34780
Preview script
First 1,000 lines of the extracted script
AFRange_Validate(true, 1000, false, 0);
javascript_obj0414_044.js pdf-javascript-stream PDF /JS object 414 at offset 0xDDA47 41 bytes
SHA-256: 6aeb2fc8f6b0dba7b9d76914b437aa0140bcd183b4c2b0d2b66173e7a39a1974
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "", true);
javascript_obj0416_045.js pdf-javascript-stream PDF /JS object 416 at offset 0xDDB4B 38 bytes
SHA-256: dd4e86ff46931388298d522a0c25afc2a74df361f28fb6ad9f104ffc1f5056c1
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "", true);
javascript_obj3095_046.js pdf-javascript-stream PDF /JS object 3095 at offset 0x8D76A 429 bytes
SHA-256: 7e2efd8c06b0808ca6f96553877d2252f385564733bdb3ac2d945589c667b280
Preview script
First 1,000 lines of the extracted script
wert = Number(event.value);
zahlungsweise = this.getField("zahlungsweise").value;

if (zahlungsweise == "Off") {
    app.alert ("Bitte geben Sie die Zahlungsweise an.");
    event.value = "";
} else {
    zahlungsweise = Number(zahlungsweise);
    minVal = 50 * zahlungsweise;
    if (wert < minVal) {
        app.alert("Der Beitrag muss mindestens " + minVal + " Euro betragen");
        event.value = "";
    }
}
javascript_obj4155_047.js pdf-javascript-stream PDF /JS object 4155 at offset 0xA3431 349 bytes
SHA-256: 996fc70e5de6677bdf952e8fbd0dc7b163da9aa135aa8ec75002e7168ddec1b7
Preview script
First 1,000 lines of the extracted script
var nachname = this.getField("nachname.vp1");
var vorname = this.getField("vorname.vp1");
if ((vorname.value == "") && (nachname.value == "")) {
    nachname = this.getField("nachname.ast");
    vorname = this.getField("vorname.ast");
}
var trenner = (vorname.value != "") ? ", " : "";
event.value = nachname.value + trenner + vorname.value ;
javascript_obj7494_048.js pdf-javascript-stream PDF /JS object 7494 at offset 0xB3B51 790 bytes
SHA-256: 624f09e12a56a347ca2dd695c161c1a87101c08e7323dcab9678589486c2b1c8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--)d[c.toString(a)]=k[c]||c.toString(a);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('r q(8,7,f,9){8=b.p(8*b.k(h,7))/b.k(h,7);g=8+"";2=g.o(".");6(!2[0])2[0]="0";6(!2[1])2[1]="";6(2[1].4<7){a=2[1];e(i=2[1].4+1;i<=7;i++){a+="0"}2[1]=a;6(2[1].4>0){2[1]=f+2[1]}}6(9!=""&&2[0].4>3){5=2[0];2[0]="";e(j=3;j<5.4;j+=3){d=5.n(5.4-j,5.4-j+3);2[0]=9+d+2[0]+""}c=5.m(0,(5.4%3==0)?3:(5.4%3));2[0]=c+2[0]}l 2[0]+2[1]}',28,28,'||arr_int||length|Begriff|if|laenge|number|th_sep|nachkomma|Math|str_first|Extrakt|for|sep|str_number|10|||pow|return|substr|slice|split|round|formatNumber|function'.split('|'),0,{}))
javascript_obj7509_049.js pdf-javascript-stream PDF /JS object 7509 at offset 0xB3D8E 2154 bytes
SHA-256: 3999f516f075c028ecd5d85123157567f1cd5fc02e01fb9cdcd519a63204b797
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('d 1R(9,1f){8(9==""){5}1h=7(9.a(0,2));1i=7(9.a(2,2))-1;1j=7(9.a(4));9=S R(1j,1i,1h);1g=S R();A=1g-9;A=1e(((((A/Q)/h)/h)/P)/1d.1c,10);8(A>=1f){n.m(l("q f%N b M 17 %16%L u t 14 K k J b I H G p F o."),1)}}d 1Q(3){8(3!=""){g=7(3.a(4));8(g<O){n.m(l("q w%1b b o 1a 19 p 1.1.O."),1);5 B}}5 c}d r(3){x=7(3.a(0,2));v=7(3.a(2,2));g=7(3.a(4));3=S R(g,v-1,x);5 3}d 1P(9,i){9=r(9);i=r(i);z=i.1O();z=Q*h*h*P+z;i.1N(z);y=i-9;y=1e(((((y/Q)/h)/h)/P)/1d.1c,10);5 y}d 1M(3){v=7(3.a(0,2));x=7(3.a(2,2));g=7(3.a(4));5 x+"."+v+"."+g}d 1L(3,e){8(3=="")5 c;3=r(3);8(e==1K)e=\'1J\';e=r(e);8(3<e){n.m(l("q w%1b b o 1a 19 p 1.1.O."),1);5 B}5 c}d 1I(18){1H(18){15 6:E="q f%N b M 17 %16%L u t 1G K k J b I H G p F o.";13;15 4:E="q f%N b M 1F %1E%L u t 14 K k J b I H G p F o. \\1D 1C 1B 1A V 1z 1y U k T 1x b u t 1w.";13}n.m(l(E),1)}d 1v(C,12){8(C=="")5 c;8(12=="11"){D="1u"}1t{D="11"}1s=c;s=Z.Y("1r."+D).X;j=Z.Y("j").X;8(j=="")5 c;8(s=="")5 c;W=7(C)+7(s);8(s>0&&(W!=7(j))){n.m(l("1q 1p 1o 1n V U k T 1m "+j+" 1l 1k."),1);5 B}5 c}',62,116,'|||datum||return||Number|if|geburtsdatum|substr|Sie|true|function|limit||jahr|60|refdatum|beitrag|und|unescape|alert|app|ein|dem|Bitte|getDatum|altWert|Abschnitt|in|monat||tag|alter|sekunden|istAlter|false|wert|altZahler|meldung|Antrag|mit|zusammen|dieses|reichen|aus|22|das|FCllen|2008|24|1000|Date|new|Arbeitnehmer|Arbeitgeber|von|summe|value|getField|this||an|zahler|break|04|case|22Gesundheitsfragen|Formular|which|nach|Datum|E4hlen|25|365|parseInt|sollAlter|jetzt|gTag|gMonat|gJahr|ergeben|Euro|muss|Anteile|der|Summe|Die|anteil|abgleichOK|else|ag|checkAnteile|05|finden|zwischen|Entgeltumwandlung|Vereinbarung|zur|Formularvorschlag|nEinen|22Direktversicherung|Zusatzformular|06|switch|bitteFormular|01011900|null|checkGeburtsdatum|formatDatum|setTime|getTime|getAlter|nichtVor2008|checkAlter'.split('|'),0,{}))
javascript_obj7863_050.js pdf-javascript-stream PDF /JS object 7863 at offset 0xB5D4B 2232 bytes
SHA-256: 1271bb15de730e301c73a205f98a470e4d7981d84985ab3e90a4c68a878f83c8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var struktur = new Array();

struktur[0] = new Array();
struktur[0]["first"] = 3;
struktur[0]["last"] = 3;

struktur[1] = new Array();
struktur[1]["first"] = 5;
struktur[1]["last"] = 12;

struktur[2] = new Array();
struktur[2]["first"] = 13;
struktur[2]["last"] = 16;
struktur[2][0] = new Array();
struktur[2][0]["first"] = 14;
struktur[2][0]["last"] = 14;
struktur[2][1] = new Array();
struktur[2][1]["first"] = 15;
struktur[2][1]["last"] = 16;

struktur[3] = new Array();
struktur[3]["first"] = 17;
struktur[3]["last"] = 21;
struktur[3][0] = new Array();
struktur[3][0]["first"] = 18;
struktur[3][0]["last"] = 18;
struktur[3][1] = new Array();
struktur[3][1]["first"] = 19;
struktur[3][1]["last"] = 21;

struktur[4] = new Array();
struktur[4]["first"] = 22;
struktur[4]["last"] = 25;
struktur[4][0] = new Array();
struktur[4][0]["first"] = 23;
struktur[4][0]["last"] = 23;
struktur[4][1] = new Array();
struktur[4][1]["first"] = 24;
struktur[4][1]["last"] = 25;

struktur[5] = new Array();
struktur[5]["first"] = 26;
struktur[5]["last"] = 29;
struktur[5][0] = new Array();
struktur[5][0]["first"] = 27;
struktur[5][0]["last"] = 27;
struktur[5][1] = new Array();
struktur[5][1]["first"] = 28;
struktur[5][1]["last"] = 29;

struktur[6] = new Array();
struktur[6]["first"] = 30;
struktur[6]["last"] = 34;
struktur[6][0] = new Array();
struktur[6][0]["first"] = 31;
struktur[6][0]["last"] = 31;
struktur[6][1] = new Array();
struktur[6][1]["first"] = 32;
struktur[6][1]["last"] = 34;

struktur[7] = new Array();
struktur[7]["first"] = 35;
struktur[7]["last"] = 60;

function drucke(mainIndex,subIndex) {

	
	if (subIndex != null) {
		firstPage = struktur[mainIndex][subIndex]["first"];
		lastPage = struktur[mainIndex][subIndex]["last"];
	} else {
		firstPage = struktur[mainIndex]["first"];
		lastPage = struktur[mainIndex]["last"];
	}
	firstPage--;
	lastPage--;
    
	this.print(false, firstPage, lastPage);
}

function meldung () {
	app.alert(unescape("Bitte denken Sie daran%2C das Formular %2202 - BEST%C4TIGUNG %DCBER DEN EMPFANG VON INFORMATIONEN%22 ausgef%FCllt und unterschrieben zusammen mit den notwendigen Antr%E4gen einzureichen%21"),1);
}

Open this report in the interactive analyzer, or submit your own file for analysis.