Malicious PDF — malware analysis report

Static analysis result for SHA-256 dcb9981d080a81fb…

MALICIOUS

PDF

301.0 KB Created: 2009-06-25 16:57:23 UTC Authoring application: PScript5.dll Version 5.2 (via Acrobat Distiller 5.0.5 (Windows)) First seen: 2026-05-10
MD5: 0c376493bde0ac912c4ce130c486bc0f SHA-1: c61980f24991817c8ff41e71028418940e23999e SHA-256: dcb9981d080a81fb6766798b239378901846185946ddf72a2c7ed1e89181ee94
136 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File T1566.001 Spearphishing Attachment T1071.001 Web Protocols

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT, PDF_JS, and PDF_EVAL. The eval() call and String.fromCharCode usage suggest obfuscated JavaScript code. This script is likely designed to download and execute a second-stage payload, as suggested by the 'Suspicious extracted artifact' heuristic. The presence of JavaScript within a PDF, combined with the eval() function, strongly points to an exploit delivery mechanism.

Machine Learning

  • Nyx PDF Classifier clean score 0.1546

Heuristics 6

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
        {
  strTemp1 = String.fromCharCode(eval(i))
       Code128bCharSeta += strTemp1;
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype Referenced by PDF JavaScript
    • http://ocsp.verisign.com0In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript
    • http://www.iec.chIn PDF document text
    • https://www.verisign.com/repository/CPS��In PDF document text
    • https://www.verisign.comIn PDF document text
    • https://www.verisign.com/repository/verisignlogo.gif0��In PDF document text
    • https://www.verisign.com/CPS0bIn PDF document text
    • http://www.microsoft.com/truetype/0In PDF document text
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In PDF document text
    • http://crl.verisign.com/tss-ca.crl0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 16

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0142_000.js pdf-javascript-stream PDF /JS object 142 at offset 0x6D9 8265 bytes
SHA-256: 09902a6f4fc69d2db0b7c22ab23461c755f2c9ff6249108cd150624899cdab33
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 10 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
// Barcode for packets
// Based on 828888H.pdf
// fix leading zero problem
// Sept 9, 2004
// extract visit date from PA4
// Set FormId to valueAsString 
// Sept 17, 2004
var PV = this.getField("Patient.VisitNo");
var PA6 = this.getField("Patient.addressograph6");
var PA1 = this.getField("Patient.addressograph1");
var PA2 = this.getField("Patient.addressograph2");
var PA3 = this.getField("Patient.addressograph3");

var PA4 = this.getField("Patient.addressograph4");

//var FormID = this.getField("Forms.FormID").value;

var FormID = this.getField("Forms.FormID").valueAsString;
// add barcode fields for packets 2009_05_18
var FormID1 = this.getField("Forms.FormID1").valueAsString; //packet - second set of forms
// var FormID2 = this.getField("Forms.FormID2").valueAsString; //packet - third set of forms
// var FormID3 = this.getField("Forms.FormID3").valueAsString; //packet - fourth set of forms
// var FormID4 = this.getField("Forms.FormID4").valueAsString; //packet - fifth set of forms
// var FormID5 = this.getField("Forms.FormID5").valueAsString; //packet - sixth set of forms
// var FormID6 = this.getField("Forms.FormID6").valueAsString; //packet - seventh set of forms
// var FormID7 = this.getField("Forms.FormID7").valueAsString; //packet - eighth set of forms

// var PN1 = this.getField("Patient.name1");
var PfMRN = this.getField("Patient.facilityMRN");
// var PAge1 = this.getField("Patient.age");
var Pmrn = this.getField("Patient.mrn");
var PmrnBarcode = this.getField("Patient.mrnBarcode"); 
// add barcode fields for packets 2009_05_18
var PmrnBarcode1 = this.getField("Patient.mrnBarcode1"); //packet - second set of forms
// var PmrnBarcode2 = this.getField("Patient.mrnBarcode2"); //packet - third set of forms
// var PmrnBarcode3 = this.getField("Patient.mrnBarcode3"); //packet - fourth set of forms
// var PmrnBarcode4 = this.getField("Patient.mrnBarcode4"); //packet - fifth set of forms
// var PmrnBarcode5 = this.getField("Patient.mrnBarcode5"); //packet - sixth set of forms
// var PmrnBarcode6 = this.getField("Patient.mrnBarcode6"); //packet - seventh set of forms
// var PmrnBarcode7 = this.getField("Patient.mrnBarcode7"); //packet - eighth set of forms

var PVisitNo = "";

// var BarcodeInput = this.getField("Barcode.Input");

// var PmrnBarcode1 = this.getField("Patient.mrnBarcode1"); **DONT CONFUSE WITH ABOVE GROUP FOR PACKETS
if (PA6.value !="")
{
   //console.println(util.printd(2, d));
   var PVEnd = PA6.value.length;
   PV.value=PA6.value.substring(16,24);
   // PVisitNo = PA6.value.substring(11,4);
   // console.println ("Visit No : " + PVisitNo);

}

if (PA1.value !="")
{   
console.println ("PA1 [0:2] = " + PA1.valueAsString.substring(0,2) );

  if (PA1.valueAsString.substring(0,2) == "03") {
  var PA6String = PA6.valueAsString;
  var EnDate = "";
  var LocCode = "";
// console.println ("Out Patient detected");
// substring(ending_char + 1,starting_char)
PVisitNo = PA6String.substring(15,11);
console.println ("PA6String : " + PA6String);
  console.println ("Visit No : " + PVisitNo);
//  EnDate = PA6String.substring(33,21);
// substring(ending_char + 1,starting_char)
EnDate = PA4.value.substring(8,0);
// console.println ("EnDate : " + EnDate);
  LocCode = PA4.value.substring(14,9);
  }
   // PfMRN.value=PA1.value.substring(4,14);
}

// if (PA2.value !="")
// {   
//   PN1.value=PA2.value;
// }

// if (PA3.value !="")
// {   
//   PAge1.value=PA3.value.substring(1,5);
// }

if (Pmrn.value !="")
{   
var BarcodeInputStr ="";
BarcodeInputStr = PA1.value.substring(4,5) + "|" + Pmrn.valueAsString + "|" + PVisitNo  + "|" + EnDate + "|" + LocCode + "|" + FormID; PmrnBarcode.value=gen_Code128B(BarcodeInputStr);
// add barcode fields for packets 2009_05_18
var BarcodeInputStr1 ="";
BarcodeInputStr1 = PA1.value.substring(4,5) + "|" + Pmrn.valueAsString + "|" + PVisitNo  + "|" + EnDate + "|" + LocCode + "|" + FormID1; PmrnBarcode1.value=gen_Code128B(BarcodeInputStr1);
//second set of forms in packet

// var BarcodeInputStr2 ="";
// BarcodeInputStr2 = PA1.value.substring(4,5) + "|" + Pmrn.valueAsString + "|" + PVisitNo  + "|" + EnDate + "|" + LocCode + "|" + FormID2; PmrnBarcode2.value=gen_Code128B(BarcodeInputStr2);
// } // third set of forms in packet

// var BarcodeInputStr3 ="";
// BarcodeInputStr3 = PA1.value.substring(4,5) + "|" + Pmrn.valueAsString + "|" + PVisitNo  + "|" + EnDate + "|" + LocCode + "|" + FormID3; PmrnBarcode3.value=gen_Code128B(BarcodeInputStr3);
// }  // fourth set of forms in packet

// var BarcodeInputStr4 ="";
// BarcodeInputStr4 = PA1.value.substring(4,5) + "|" + Pmrn.valueAsString + "|" + PVisitNo  + "|" + EnDate + "|" + LocCode + "|" + FormID4; PmrnBarcode4.value=gen_Code128B(BarcodeInputStr4);
// }  // fifth set of forms in packet

// var BarcodeInputStr5 ="";
// BarcodeInputStr5 = PA1.value.substring(4,5) + "|" + Pmrn.valueAsString + "|" + PVisitNo  + "|" + EnDate + "|" + LocCode + "|" + FormID5; PmrnBarcode5.value=gen_Code128B(BarcodeInputStr5);
// }  // sixth set of forms in packet

// var BarcodeInputStr6 ="";
// BarcodeInputStr6 = PA1.value.substring(4,5) + "|" + Pmrn.valueAsString + "|" + PVisitNo  + "|" + EnDate + "|" + LocCode + "|" + FormID6; PmrnBarcode6.value=gen_Code128B(BarcodeInputStr6);
// }  // seventh set of forms in packet

// var BarcodeInputStr7 ="";
// BarcodeInputStr7 = PA1.value.substring(4,5) + "|" + Pmrn.valueAsString + "|" + PVisitNo  + "|" + EnDate + "|" + LocCode + "|" + FormID7; PmrnBarcode7.value=gen_Code128B(BarcodeInputStr7);
// }  // eighth set of forms in packet
}

//working code 
function Code128bCharSet() 
{
    var i;
    var Code128bCharSeta = "";
    var strTemp1;
    for (i = 32; i <= 127; i++)
    {
		strTemp1 = String.fromCharCode(eval(i))
       Code128bCharSeta += strTemp1;
    }
    for (i = 193; i <= 199; i++)
    {
		strTemp1 = String.fromCharCode(eval(i))
       Code128bCharSeta += strTemp1;
    }    
	return Code128bCharSeta;
}





function gen_Code128B(BarcodeInput) {
 
var mappingSet=String.fromCharCode(204);
var strtmp="";
var bCharSet = Code128bCharSet();
console.println ("bCharSet = " + bCharSet);
for (var i= 33; i <=126; i++){ 
mappingSet = mappingSet + String.fromCharCode(i);
}

for (var i = 192;  i <=202; i++) {
mappingSet = mappingSet + String.fromCharCode(i);
}
console.println ("mappingSet = " + mappingSet);

console.println ("mappingSet length = " + mappingSet.length);
if (BarcodeInput !="")
{   
     strtmp = BarcodeInput;
 // fix leading 0 problem 
 // strtmp = "" + Pmrn.valueAsString;
console.println("Orginal String = " + BarcodeInput + " strtmp = " + strtmp );

console.println("length of strtmp = " + strtmp.length);

console.println("BarcodeInput.length = " + BarcodeInput.length);

var Code128b ="";
var checkSum = 104;
var charToEncode = "";


Code128b = strtmp;

//for ( var i=0; i<= 7; i=i+2) {
//charToEncode = strtmp.substring(i,i+2);
// console.println ("charToEncode  = " + charToEncode );
//j=charToEncode;
//console.println(" j = " + j);
//ss1 = mappingSet.substring(j - 1);  // get all the string starting at position j. 
//ss2 = ss1.substring(0,1);           // then get string at j only.

//Code128c= Code128c + ss2;

// console.println(" Extract code = " + Code128c);
}
// need convert to string
Code128b = "" + Code128b;
//calc check digit
charToEncode="";
console.println ("Code128b = " + Code128b);
console.println ("Code128b length =" + Code128b.length);
var charval;
var charPos = 0;

for ( var i=0; i< Code128b.length; i++) {
console.println ("Code128b = at " + i + " is " + Code128b);
// charToEncode = Code128b.substring( i, 1);
charToEncode=Code128b.charAt(i);

//charToEncode = Code128b.charAt(i);
console.println ("charToEncode = " + charToEncode);
charval = charToEncode.charCodeAt(0);
charPos = bCharSet.indexOf(charToEncode);
console.println ("charPos = " + charPos);
if (charPos > 0) {
//   checkSum = checkSum + (i+1)*(charPos - 1)
     checkSum += (i+1) * charPos;
}
console.println ("checkSum = " + checkSum);


}

// console.println checksum ;
checkSum = checkSum % 103;
console.println ("checkSum % 103 = " + checkSum );
checkDigit = mappingSet.charAt(checkSum);

var OutCode;
OutCode= String.fromCharCode(201) + Code128b + checkDigit + String.fromCharCode(203) + String.fromCharCode(205);

return OutCode;
}
stream_005_off00002e8c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2E8C 30848 bytes
SHA-256: 77bc8cc695d7476f573b661b6a9cbc05230ce53f70971431b28c33e6af14e711
stream_015_off000166f7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x166F7 45288 bytes
SHA-256: 28e8ad2c8730552a75c28426e14a57b0d70190c13c71d11b521b9cce0ae77765
stream_022_off00026c80.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x26C80 39848 bytes
SHA-256: 9e2874c97d002cc548854e984a0594f7246fd7682be2289791c894deddeb940a
stream_027_off00036ad6.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x36AD6 107773 bytes
SHA-256: f8b5634482dabaf0040161953b708d7648a1dc1459beb6e63bf997bafb4818f7
icc_00_off000084d3.icc pdf-icc-profile PDF ICC profile at offset 0x84D3 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_cff_off00002cb5.bin pdf-font-stream PDF embedded font (cff) at offset 0x2CB5 402 bytes
SHA-256: 7f204b1217dc09c5fe0d70cc69892fccb9afec21bf6f0b05efc2fbc29e189aaf
font_02_cff_off00008322.bin pdf-font-stream PDF embedded font (cff) at offset 0x8322 380 bytes
SHA-256: df49b925c4e6cbdc7e37278e59aae46cb1308e4d562f374c71d0acec1f517e3a
font_04_sfnt_off0001cbdf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1CBDF 36360 bytes
SHA-256: 1871b22094f8d8959bdd0da0b1e28f198a04e1f7e96f0f332bae8a8bc1abc3bf
font_05_sfnt_off00021da0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x21DA0 16456 bytes
SHA-256: 42ccf568a405b12ea881446cd14f94387a120c746eb9738692e18d5a4b6502aa
font_06_sfnt_off00024fa2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24FA2 10316 bytes
SHA-256: 5220cdacb4141deaf3c113bf5b3bfeda5b26746474166b319224e2e44147bc7a
font_08_sfnt_off0002c138.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2C138 28796 bytes
SHA-256: 118f42ae07c375bb043d286e3d07604991b59bb7346acfbf23cb21439ba43dac
font_09_sfnt_off0002ef3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2EF3F 29156 bytes
SHA-256: 74b661c87f29daba0fadde951f2644758b2eb8e6ee74a1d261f2332d427a8409
font_10_sfnt_off00032621.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x32621 22064 bytes
SHA-256: c76747777f2923b771eaf0bd4ae56ea7ad140a789553d391d0e7ce0f75c82219
font_11_cff_off00035762.bin pdf-font-stream PDF embedded font (cff) at offset 0x35762 568 bytes
SHA-256: 3ceb4630a6325d5d520781cc975d6cced1f8266ca922d80d40dc110ba1df92cf
font_13_sfnt_off000460bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x460BB 27605 bytes
SHA-256: 659bf0b8035208f1758f1b892614dbfb0b5b7baad6052234297b54474b1d2dba

Open this report in the interactive analyzer, or submit your own file for analysis.