PDF static analysis report

Static analysis result for SHA-256 df8a242590fc7b3a…

SUSPICIOUS

PDF

399.4 KB Created: 2015-02-18 11:22:15 -05:00 Authoring application: Acrobat PDFMaker 11 for Word (via Adobe PDF Library 11.0) First seen: 2026-05-29
MD5: 373636e6b56e309717a8b74efb14bda1 SHA-1: b9fc51c61d439c58955d8e673ab1efb4d7a0d703 SHA-256: df8a242590fc7b3afd1d26b7247177f6e80eb277d5d69dc2517c374dfb86fb62
28 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

This PDF document contains multiple embedded JavaScript streams, several of which are related to form field calculations and date formatting. One script, javascript_obj0938_010.js, appears to be a custom date calculation function, and another, javascript_obj0939_011.js, is a more extensive date parsing utility from practicalpdf.com. While these scripts themselves are not overtly malicious, their presence in a PDF, combined with the 'PDF_JAVASCRIPT' and 'PDF_JS' heuristic firings, suggests an attempt to create interactive elements that could be used for phishing or to obscure malicious activity. The URL http://try67.blogspot.com is mentioned in the script comments, and http://practicalpdf.com is also referenced.

Machine Learning

  • Nyx PDF Classifier clean score 0.0780

Heuristics 5

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://practicalpdf.com Referenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/In PDF document text
    • http://try67.blogspot.comReferenced by PDF JavaScript
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 13

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj1232_002.js pdf-javascript-stream PDF /JS object 1232 at offset 0x55989 139 bytes
SHA-256: ff2c41141943c5e3655f4a5a712cd73eb51d613b5d815cf2562abf7d637b6604
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("Days 1", "Days 10", "Days 2", "Days 3", "Days 4", "Days 5", "Days 6", "Days 7", "Days 8", "Days 9"));
javascript_obj1233_003.js pdf-javascript-stream PDF /JS object 1233 at offset 0x55A41 38 bytes
SHA-256: ae95d6581723cae0c2c1e3044a60f6c91e032264799b53449cd6269e6993d7bc
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 0, 0, 0, "", true);
javascript_obj1234_004.js pdf-javascript-stream PDF /JS object 1234 at offset 0x55A92 41 bytes
SHA-256: 617ef4da07d9bc9d4e06a2320fe0d4cbacd3d6c2cc82039cf4e79e7facf7545f
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 0, 0, 0, "", true);
javascript_obj1347_007.js pdf-javascript-stream PDF /JS object 1347 at offset 0x5A617 33 bytes
SHA-256: b49875e7a786cc7d62191be88c49afc7a7f53551d4ec30ddf24c3fd7583d7233
Preview script
First 1,000 lines of the extracted script
AFDate_KeystrokeEx("mm/dd/yyyy");
javascript_obj0938_010.js pdf-javascript-stream PDF /JS object 938 at offset 0x3A32F 1522 bytes
SHA-256: b99e68249337621f6509d9757e300813973bb7756f5adce7da6c19fa36c43b96
Preview script
First 1,000 lines of the extracted script
// SINGLE LICENSE. All Rights Reserved to Gilad Denneboom, 2018. Distribution without permission is not allowed.
// You can contact me at try6767@gmail.com or via my website: http://try67.blogspot.com

function calcDateDiff() {
	event.value = "";
	var dateFormat = "m/d/yyyy";
	var rowNum = event.target.name.replace("Days ", "");
	var startDateString = this.getField("From_"+rowNum).valueAsString;
	var endDateString = this.getField("To_"+rowNum).valueAsString;
	if (startDateString=="" || endDateString=="") return;
	var startDate = util.scand(dateFormat, startDateString);
	var endDate = util.scand(dateFormat, endDateString);
	if (startDate==null || endDate==null) return;
	startDate.setHours(0);
	startDate.setMinutes(0);
	startDate.setSeconds(0);
	startDate.setMilliseconds(0);
	endDate.setHours(0);
	endDate.setMinutes(0);
	endDate.setSeconds(0);
	endDate.setMilliseconds(0);	
	if (startDate.getTime()>endDate.getTime()) return;
	var ignoreWeekends = this.getField("Check "+rowNum).valueAsString!="Off";
	var diffInDays = 0;
	while (startDate.getTime()<=endDate.getTime()) {
		if (ignoreWeekends==false || (ignoreWeekends && startDate.getDay()!=0 && startDate.getDay()!=6)) {
			diffInDays++;
		}
		startDate.setDate(startDate.getDate()+1);
	}
	event.value = diffInDays;
	
}

// SINGLE LICENSE. All Rights Reserved to Gilad Denneboom, 2018. Distribution without permission is not allowed.
// You can contact me at try6767@gmail.com or via my website: http://try67.blogspot.com
javascript_obj0939_011.js pdf-javascript-stream PDF /JS object 939 at offset 0x3A5AE 6898 bytes
SHA-256: 2848aca1b3997166e1bc293459e25f11002bd6e1b2e8d1d048640e5189f8a3e7
Preview script
First 1,000 lines of the extracted script
/*function PPDF_parseDateString(a,b){for(var d,e,c=/m+|d+|y+|H+|h+|M+|s+|t+|j+|\./g,f=[];e=c.exec(a);)f.push({match:e[0],startIndex:e.index,endIndex:e.index+e[0].length});if(d=f[0].startIndex>0?a.substring(0,f[0].startIndex):"",f.length>0)for(var g=0;g<f.length;g++){var h=f[g].match,i="";switch(h){case"mmmm":i=monthNames[b.getMonth()];break;case"mmm":i=monthNames[b.getMonth()].substr(0,3);break;case"mm":i=PPDF_pad(b.getMonth()+1,2);break;case"m":i=(b.getMonth()+1).toString();break;case"dddd":i=dayNames[b.getDay()];break;case"ddd":i=dayNames[b.getDay()].substr(0,3);break;case"dd":i=PPDF_pad(b.getDate(),2);break;case"d":i=b.getDate().toString();break;case"yyyy":i=b.getFullYear().toString();break;case"yy":i=b.getFullYear().toString().substring(2);break;case"HH":i=PPDF_pad(b.getHours(),2);break;case"H":i=b.getHours().toString();break;case"hh":var j=b.getHours();j>12&&(j-=12),i=PPDF_pad(j,2);break;case"h":j=b.getHours(),j>12&&(j-=12),i=j.toString();break;case"MM":i=PPDF_pad(b.getMinutes(),2);break;case"M":i=b.getMinutes().toString();break;case"ss":i=PPDF_pad(b.getSeconds(),2);break;case"s":i=b.getSeconds().toString();break;case"tt":i=b.getHours()>=12?"pm":"am";break;case"t":i=b.getHours()>=12?"p":"a"}var k="";g+1<f.length&&(k=a.substring(f[g].endIndex,f[g+1].startIndex)),d=d+i+k}return d}function PPDF_pad(a,b,c){return c=c||"0",a+="",a.length>=b?a:new Array(b-a.length+1).join(c)+a}console.println("** PPDF: Initializing DateExtended by practicalPDF (http://practicalpdf.com)");var nSecond=1e3,nMinute=60*nSecond,nHour=60*nMinute,nDay=24*nHour,nWeek=7*nDay,weekStartDay=0,monthNames=["January","February","March","April","May","June","July","August","September","October","November","December"],dayNames=["Sunday","Monday","Tuesday","Wednesday","Thursday","Friday","Saturday"];Object.defineProperty(Date,"PPDF_VERSION",{value:"1.1",writable:!1,enumerable:!0,configurable:!0}),Object.defineProperty(Date,"SHORT_DATE",{value:"m/d/yyyy",writable:!1,enumerable:!0,configurable:!0}),Object.defineProperty(Date,"LONG_DATE",{value:"dddd, mmmm dd, yyyy",writable:!1,enumerable:!0,configurable:!0}),Object.defineProperty(Date,"SHORT_TIME",{value:"h:MM tt",writable:!1,enumerable:!0,configurable:!0}),Object.defineProperty(Date,"LONG_TIME",{value:"h:MM:ss tt",writable:!1,enumerable:!0,configurable:!0}),Object.defineProperty(Date,"FULL_DATETIME",{value:"dddd, mmmm dd, yyyy h:MM:ss tt",writable:!1,enumerable:!0,configurable:!0}),Object.defineProperty(Date,"SORTABLE_DATETIME",{value:"yyyy-mm-dd HH:MM:ss",writable:!1,enumerable:!0,configurable:!0}),Object.defineProperty(Date,"MONTH_DAY",{value:"mmmm dd",writable:!1,enumerable:!0,configurable:!0}),Object.defineProperty(Date,"YEAR_MONTH",{value:"yyyy mmmm",writable:!1,enumerable:!0,configurable:!0}),Date.isLeapYear=function(a){return a%4===0&&a%100!==0||a%400===0},Date.daysBetween=function(a,b){var c=b.getTime()-a.getTime();return Math.abs(Math.round(c/nDay))},Date.getAge=function(b){var c=new Date,d=c.getFullYear()-b.getFullYear(),e=c.getMonth()-b.getMonth();return(e<0||0===e&&c.getDate()<b.getDate())&&(d-=1),d},Date.getAgeFromString=function(b){var c=new Date(Date.parse(b)),d=new Date,e=d.getFullYear()-c.getFullYear(),f=d.getMonth()-c.getMonth();return(f<0||0===f&&d.getDate()<c.getDate())&&(e-=1),e},Date.newFromString=function(a){return new Date(Date.parse(a))},Date.max=function(b){return new Date(Math.max.apply(null,b))},Date.min=function(b){return new Date(Math.min.apply(null,b))},Date.prototype.nextWeekDay=function(){var a;return this.reset(),this.getDay()<5&&(a=this.changeBy({days:1})),5==this.getDay()&&(a=this.changeBy({days:3})),6==this.getDay()&&(a=this.changeBy({days:2})),a},Date.prototype.nextMonth=function(a){return this.changeBy({months:1}),this.setDate(1),a&&"boolean"==typeof a&&1==a&&(6==this.getDay()&&this.changeBy({days:2}),0==this.getDay()&&this.changeBy({days:1})),this},Date.prototype.toFormattedString=function(a){return util.printd(a,this)},Date.prototype.reset=function(){return this.setHours(0),this.setMinutes(0),this.setSeconds(0),this.setMilliseconds(0),this},Date.prototype.getDaysInMonth=function(){return Date.getDaysInMonth(this.getFullYear(),this.getMonth())},Date.getDaysInMonth=function(a,b){return[31,Date.isLeapYear(a)?29:28,31,30,31,30,31,31,30,31,30,31][b]},Date.prototype.changeByMilliseconds=function(a){return this.setMilliseconds(this.getMilliseconds()+a),this},Date.prototype.changeBySeconds=function(a){return this.changeByMilliseconds(1e3*a)},Date.prototype.changeByMinutes=function(a){return this.changeByMilliseconds(6e4*a)},Date.prototype.changeByHours=function(a){return this.changeByMilliseconds(36e5*a)},Date.prototype.changeByDays=function(a){return this.changeByMilliseconds(864e5*a)},Date.prototype.changeByWeeks=function(a){return this.changeByMilliseconds(6048e5*a)},Date.prototype.changeByMonths=function(a){var b=this.getDate(),c=this.getHours(),d=this.getMinutes(),e=this.getSeconds();return this.setDate(1),this.setMonth(this.getMonth()+a),this.setDate(Math.min(b,this.getDaysInMonth())),this.setHours(c),this.setMinutes(d),this.setSeconds(e),this},Date.prototype.changeByYears=function(a){return this.changeByMonths(12*a)},Date.prototype.changeBy=function(a){return a.milliseconds&&this.changeByMilliseconds(a.milliseconds),a.seconds&&this.changeBySeconds(a.seconds),a.minutes&&this.changeByMinutes(a.minutes),a.hours&&this.changeByHours(a.hours),a.days&&this.changeByDays(a.days),a.weeks&&this.changeByWeeks(a.weeks),a.months&&this.changeByMonths(a.months),a.years&&this.changeByYears(a.years),this},Date.prototype.getDayOfYear=function(){return Math.floor((this-new Date(this.getFullYear(),0,1))/nDay)},Date.prototype.getWeekOfYear=function(a){var b,c=this.getFullYear(),d=this.getMonth(),e=this.getDate();b=a?a:weekStartDay;var f=8-new Date(c,0,1).getDay();8==f&&(f=1);var g=(Date.UTC(c,d,e,0,0,0)-Date.UTC(c,0,1,0,0,0))/nDay+1,h=Math.floor((g-f+7)/7);if(h===b){c--;var i=8-new Date(c,0,1).getDay();h=2==i||8==i?53:52}return h},Date.prototype.millisecondsElapsed=function(a){return Math.abs((a||new Date)-this)},Date.prototype.getDayName=function(a){return a&&1==a?util.printd("ddd",this):util.printd("dddd",this)},Date.prototype.getMonthName=function(a){return a&&1==a?util.printd("mmm",this):util.printd("mmmm",this)},"function"==typeof util.scand||(util.scand=function(){if(2==arguments.length)return new Date(Date.parse(arguments[1]))},delete util.printd,util.printd=function(){if(2==arguments.length){var a=arguments[0],b=arguments[1];if("number"==typeof a&&b instanceof Date){var c;switch(a){case 0:c=util.printd("D:yyyymmddHHMMss",b),c+=b.getTimezoneOffset().toString();break;case 1:c=util.printd("yyyy.mm.dd HH:MM:ss",b),c+=b.getTimezoneOffset().toString();break;case 1:c=util.printd("yyyy/mm/dd hh:MM:ss",b)}return c}if("string"==typeof a&&b instanceof Date)return PPDF_parseDateString(a,b)}}),console.println("** PPDF: DateExtended ready");*/
objstm_1404_00.bin pdf-objstm-decoded PDF /ObjStm 1404 0 obj (inflated) 15158 bytes
SHA-256: 852061f9325a89bf7fb474524ffd746d4c9b8cbaf4b40fc71ca3bd918f2f34e0
icc_00_off00011fb5.icc pdf-icc-profile PDF ICC profile at offset 0x11FB5 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
icc_01_off00015de2.icc pdf-icc-profile PDF ICC profile at offset 0x15DE2 408 bytes
SHA-256: 653b586c4707574ffcd648ba35494daed2c76ceafcf4c07d315ed961b1dc347f
font_00_cff_off00015f74.bin pdf-font-stream PDF embedded font (cff) at offset 0x15F74 3453 bytes
SHA-256: 22be5866c474f936bcb4c9a71fc4cdfc1a7c69f95d82421a1bf6530a81abb52b
font_01_sfnt_off000235d2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x235D2 38226 bytes
SHA-256: 317d345e7171d6aa7ba72c66d454fc557e9f3e216e54ef11a33685d6ed9f8f50
font_02_sfnt_off000303bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x303BB 50384 bytes
SHA-256: ee62ff777c8ad9a505d7c5beebae3a37a3d525b4d53a0f656227e9caafd45bcb
font_03_sfnt_off0004e1fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4E1FD 60316 bytes
SHA-256: d8a4ad4de382119e3b241ff73f9572f246af46d7375c8c9229427fbbc47ef922

Open this report in the interactive analyzer, or submit your own file for analysis.