PDF static analysis report

Static analysis result for SHA-256 dfb272e6c581340e…

SUSPICIOUS

PDF

497.6 KB First seen: 2026-05-09
MD5: e9372e5d18a21af753e45ebcfb59982f SHA-1: 5eca316676503c496b02c8dd40243a7d172df8a5 SHA-256: dfb272e6c581340ed5b698e7c3330f8cef4df558303861f1315d8dfd9fff0ece
52 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF was flagged by an ML classifier with high confidence and contains embedded files, indicating a potential for malicious content delivery. The presence of XFA forms and encryption further obscures the content, making it difficult to statically analyze. While several URLs were extracted, they were all confirmed as benign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9495

Heuristics 5

  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Encrypted PDF (string and stream contents are opaque to static scan) info PDF_ENCRYPTED
    PDF declares /Encrypt — string objects and stream contents are encrypted with the standard security handler (RC4 or AES). On its own this is informational; legitimate encrypted documents include signed contracts, billing statements, and rights-managed material. Static heuristics cannot inspect encrypted payload bytes.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://edgwww.um.warszawa.pl/webservices/ws_edgwww.asmx In PDF document text
    • https://edgwww.um.warszawa.pl/Instrukcjaostateczna.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/In PDF document text
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/2.6/In PDF document text
    • http://www.xfa.org/schema/xci/2.8/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.6/In PDF document text
    • http://www.w3.org/1999/xhtmlIn PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://www.w3.org/1999/XSL/TransformIn PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.6/In PDF document text
    • http://www.xfa.org/schema/xfa-connection-set/2.4/In PDF document text
    • http://www.xfa.org/schema/xfa-connection-set/2.8/In PDF document text
    • http://ns.adobe.com/xfdf/In PDF document text
    • http://ns.adobe.com/xtd/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 20

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0013.bin pdf-embedded-file PDF EmbeddedFile object 13 at offset 0x2338 163 bytes
SHA-256: 67142f000282703de9395ed1dd5b2cb737bae7ed8a4bed3b013b425fe5beb452
embedded_file_obj0014.bin pdf-embedded-file PDF EmbeddedFile object 14 at offset 0x2429 2348 bytes
SHA-256: 7f24c7e5b2126b797c6680082d0ed7d2ace51b24f52586f7af3cf4160c357c26
embedded_file_obj0015.bin pdf-embedded-file PDF EmbeddedFile object 15 at offset 0x2825 1688237 bytes
SHA-256: 2f5b45f38b8f5fc61d88ebc7dc7c80be60ff4b941d14a91d7ed4405e2a686d48
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 8 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).
embedded_file_obj0016.bin pdf-embedded-file PDF EmbeddedFile object 16 at offset 0x3325B 2918 bytes
SHA-256: c295b802640e901c9d8395ec66ca143905a458ad988aec343a5102dfe37c1376
embedded_file_obj0017.bin pdf-embedded-file PDF EmbeddedFile object 17 at offset 0x335E4 164 bytes
SHA-256: c57921168a6d8934c8eafb4f41f8acfb80601bf1d32ac058513c990766dc6a80
embedded_file_obj0018.bin pdf-embedded-file PDF EmbeddedFile object 18 at offset 0x336A9 121 bytes
SHA-256: 90938f9e3cdf6db2eeee31ed7c949f3b0952b799b670df73d2e56d31bfcc8d34
embedded_file_obj0019.bin pdf-embedded-file PDF EmbeddedFile object 19 at offset 0x33767 1535 bytes
SHA-256: 1d782ab3f72678791e6fb1367d1b988409c313e82b056374aa83a7ebd4afc106
embedded_file_obj0020.bin pdf-embedded-file PDF EmbeddedFile object 20 at offset 0x33A2F 85 bytes
SHA-256: af05f8185c725a70291567ae2112fa9a98b368528a7cc440552f0c0847d95121
embedded_file_obj0021.bin pdf-embedded-file PDF EmbeddedFile object 21 at offset 0x33ADD 200 bytes
SHA-256: 1a341384e0edeade096c46b56b44e343fca56670bd4af1196360221b42149aaf
javascript_obj0041_000.js pdf-javascript-stream PDF /JS object 41 at offset 0x695F7 2795 bytes
SHA-256: 826c5622c798d67e5281cca7e05933dddc90ccdcb0a6177c9f7d06f11bef8f7f
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
javascript_obj0042_001.js pdf-javascript-stream PDF /JS object 42 at offset 0x698BC 902 bytes
SHA-256: 1b2ec98752b966f601d5223a750559cf13d562ac5e5c6d1fcc7217835b01f5fd
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 8.1)
{
   ADBE.Reader_Need_Version = 8.1;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Reader_Need_Version;
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 8.1)
{
   ADBE.Viewer_Need_Version = 8.1;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Viewer_Need_Version;
}
javascript_obj0043_002.js pdf-javascript-stream PDF /JS object 43 at offset 0x69A14 1313 bytes
SHA-256: f94e41f586bf3f20bc1deeac4bfbda388a61db43f25fbd6304ba73f5653368cf
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.6)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 8.0)
         {
            if (app.alert(ADBE.Reader_string_Need_New_Version_Msg, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.6"});
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
		   else if (app.viewerVersion < 8.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
               app.launchURL(ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, true);
         }
         else if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.6"});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
embedded_file_obj0001_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 1 at offset 0x5C; filter decode failed 176 bytes
SHA-256: 6f2792baaf8d6caf29cd5e69ea60c18866966428a6ae05ea6cd6a77a5042387a
embedded_file_obj0002_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 2 at offset 0x16A; filter decode failed 960 bytes
SHA-256: 62a9477237f7108e7905c68910c8d71455610e85782c0d1bae3b041b12e5d1fa
embedded_file_obj0003_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 3 at offset 0x58B; filter decode failed 280464 bytes
SHA-256: e47ce290407d747fd0aa650147d978714a49ac2d191e1f3cf9c2fdf55f111a04
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 8.00, consistent with packed or encrypted content.
embedded_file_obj0004_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 4 at offset 0x44D79; filter decode failed 832 bytes
SHA-256: c75a1e58908c1e2a37877a89982858d1cefc5575969ac8b3b8f9013c6065102f
embedded_file_obj0005_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 5 at offset 0x45117; filter decode failed 128 bytes
SHA-256: 39f45a93ea665263ef86c3fd54be13ead5a3cd90daa17d9e31420e771204ac8a
embedded_file_obj0006_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 6 at offset 0x451F5; filter decode failed 128 bytes
SHA-256: 601ed8128684c9edd753bea2e8e9487d7586d1b9e006304cdaa3bae5aae4fb37
embedded_file_obj0007_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 7 at offset 0x452D3; filter decode failed 656 bytes
SHA-256: 24f057b35bd6759c6f19a37f57d47bdc70b448b95fb8f77e1f3fc2ee5dfdd7db
embedded_file_obj0008_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 8 at offset 0x455C1; filter decode failed 112 bytes
SHA-256: cb45add2a6bc61be814e93619076d955272f263aa43afddc1b465495431914b3

Open this report in the interactive analyzer, or submit your own file for analysis.