PDF static analysis report

Static analysis result for SHA-256 e008126da646f888…

SUSPICIOUS

PDF

92.8 KB Created: 2005-08-04 10:18:10 -04:00 Authoring application: PageMaker 7.0 (via Acrobat Distiller 6.0.1 (Windows)) First seen: 2026-05-10
MD5: 861d074ef41c4c6a90ffc608c0736c80 SHA-1: 954350e6a396d2acd933e88876d97cde17ee1fba SHA-256: e008126da646f8885272225a846a36c536867ca3cc87bea644fc6bf8d06b6e64
58 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1071.001 Web Protocols

The PDF contains embedded JavaScript and a callback phishing lure, indicating an attempt to deceive the user. The JavaScript actions and embedded JS streams suggest malicious code execution. The callback lure specifically prompts the user to call a phone number, consistent with tech support scams or billing fraud schemes. While specific JavaScript content is truncated, the presence of these elements strongly points to a social engineering attack.

Machine Learning

  • Nyx PDF Classifier clean score 0.0787

Heuristics 8

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • External URI info PDF_URI
    PDF contains an external URL action
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.revenue.delaware.gov/services/Business_Tax/FilingBusTaxes.shtml PDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://www.revenue.delaware.gov/services/Business_Tax/FilingBusTaxes.shtml)/S/URIIn PDF document text
    • http://www.iec.chIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 15

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0182_004.js pdf-javascript-stream PDF /JS object 182 at offset 0x98B7 122 bytes
SHA-256: 159c17c4d4c91b25e9af047743ac6167597b9351358bc2ffde36d5cfd6fe03b8
Preview script
First 1,000 lines of the extracted script
var w=this.getField("txtDE Inc Tax Withheld");
var p=this.getField("txtDE Inc Tax Paid");
event.value=w.value-p.value;
javascript_obj0183_005.js pdf-javascript-stream PDF /JS object 183 at offset 0x9963 39 bytes
SHA-256: 1d03a107e45160304b614e4ae31a0dc575017e5d6e59414bb8916127c3277507
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 0, 0, 0, "", false);
javascript_obj0184_006.js pdf-javascript-stream PDF /JS object 184 at offset 0x99B4 42 bytes
SHA-256: edc81df06236f4f7f78ad6c2ad7367f010516682b9b95cf24321c54c44a61f34
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 0, 0, 0, "", false);
javascript_obj0189_007.js pdf-javascript-stream PDF /JS object 189 at offset 0x12312 97 bytes
SHA-256: 2354cee5a8a0aaedc1dbd85cc7cecb3ef7b69494847e28ac8dc608be21fcd6e9
Preview script
First 1,000 lines of the extracted script
var value = event.value;
event.value = util.printx("99999999999999999999999999999999", value);
javascript_obj0190_008.js pdf-javascript-stream PDF /JS object 190 at offset 0x124F5 86 bytes
SHA-256: cff6287987cf67c92a41375d09fe926a88af02e8455829dcbd1c51f866f59431
Preview script
First 1,000 lines of the extracted script
var value = event.value;
event.value = util.printx("999999999999999999999", value);
javascript_obj0191_009.js pdf-javascript-stream PDF /JS object 191 at offset 0x12D92 190 bytes
SHA-256: fd1083e89705e5710cd715503c5f4c9ad58efda388513799ae35f6feebe0b549
Preview script
First 1,000 lines of the extracted script
var x=this.getField("txtTaxEnding");
var d=this.getField("txtDateDue");
d.value=x.value;

var d=this.getField("chk_tbl_in2");
d.value=event.value+x.value+"0000000000"+"000"+"0000000";
javascript_obj0196_010.js pdf-javascript-stream PDF /JS object 196 at offset 0x13490 58 bytes
SHA-256: 32bc94877c2e0810e4855a5e494ba0067dbd00acb1c96abd1a8ae7c851e277a8
Preview script
First 1,000 lines of the extracted script
this.getField('txtAccountNumber').textColor = color.black;
javascript_obj0113_011.js pdf-javascript-stream PDF /JS object 113 at offset 0x134C 279 bytes
SHA-256: cdba098e8a264cbfdadbd4b4818239ad0e8ec8562452bd5151bf7bb6809f7b48
Preview script
First 1,000 lines of the extracted script
if (bolSaved) app.alert('To protect your identity please adhere to the following recommendations: \n  -Only save this form to your local drive \n  -Do not attempt to email this form \n - Delaware Division of Revenue will not accept emailed forms in place of filing this return');
javascript_obj0187_012.js pdf-javascript-stream PDF /JS object 187 at offset 0x144EB 274 bytes
SHA-256: 592deb43655cbd0a95070c23fe7e7a44d04975ba372bd2ca423655652d96a405
Preview script
First 1,000 lines of the extracted script
this.getField('txtAccountNumber').textColor = color.white;
this.getField('chk_tbl_in1').textColor = color.white;
this.getField('chk_tbl_in2').textColor = color.white;
this.getField('chk_cnt').textColor = color.white;
this.getField('txtLine2').textColor = color.ltGray;
javascript_obj0193_013.js pdf-javascript-stream PDF /JS object 193 at offset 0x12EB8 4922 bytes
SHA-256: eccd54618b1c7361e4e5bbb6b2281f7893f2a83801269d922cf8d61e7aa2be38
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var chk=this.getField("chk_cnt");
var ac=this.getField("chk_tbl_in1");
var bc=this.getField("chk_tbl_in2");

var a1=ac.value.substr(0,1)*1;
if (a1=='0') 
{
a1=10;
}

var a2=ac.value.substr(1,1)*2;
if (a2=='0') 
{
a2=20;
}

var a3=ac.value.substr(2,1)*3;
if (a3=='0') 
{
a3=30;
}

var a4=ac.value.substr(3,1)*4;
if (a4=='0') 
{
a4=40;
}

var a5=ac.value.substr(4,1)*5;
if (a5=='0') 
{
a5=50;
}

var a6=ac.value.substr(5,1)*6;
if (a6=='0') 
{
a6=60;
}

var a7=ac.value.substr(6,1)*7;
if (a7=='0') 
{
a7=70;
}

var a8=ac.value.substr(7,1)*8;
if (a8=='0') 
{
a8=80;
}

var a9=ac.value.substr(8,1)*9;
if (a9=='0') 
{
a9=90;
}

var a10=ac.value.substr(10,1)*1;
if (a10=='0') 
{
a10=10;
}

var a11=ac.value.substr(11,1)*2;
if (a11=='0') 
{
a11=20;
}

var a12=ac.value.substr(12,1)*3;
if (a12=='0') 
{
a12=30;
}

var a13=ac.value.substr(13,1)*4;
if (a13=='0') 
{
a13=40;
}

var a14=ac.value.substr(14,1)*5;
if (a14=='0') 
{
a14=50;
}

var a15=ac.value.substr(15,1)*6;
if (a15=='0') 
{
a15=60;
}

var a16=ac.value.substr(16,1)*7;
if (a16=='0') 
{
a16=70;
}

var a17=ac.value.substr(17,1)*8;
if (a17=='0') 
{
a17=80;
}

var a18=ac.value.substr(18,1)*9;
if (a18=='0') 
{
a18=90;
}

var a19=ac.value.substr(20,1)*1;
if (a19=='0') 
{
a19=10;
}

var a20=ac.value.substr(21,1)*2;
if (a20=='0') 
{
a20=20;
}

var a21=ac.value.substr(22,1)*3;
if (a21=='0') 
{
a21=30;
}


var a22=bc.value.substr(0,1)*4;
if (a22=='0') 
{
a22=40;
}

var a23=bc.value.substr(1,1)*5;
if (a23=='0') 
{
a23=50;
}

var a24=bc.value.substr(3,1)*6;
if (a24=='0') 
{
a24=60;
}

var a25=bc.value.substr(4,1)*7;
if (a25=='0') 
{
a25=70;
}

var a26=bc.value.substr(6,1)*8;
if (a26=='0') 
{
a26=80;
}

var a27=bc.value.substr(7,1)*9;
if (a27=='0') 
{
a27=90;
}

var a28=bc.value.substr(8,1)*1;
if (a28=='0') 
{
a28=10;
}

var a29=bc.value.substr(9,1)*2;
if (a29=='0') 
{
a29=20;
}

var a30=bc.value.substr(11,1)*3;
if (a30=='0') 
{
a30=30;
}

var a31=bc.value.substr(12,1)*4;
if (a31=='0') 
{
a31=40;
}

var a32=bc.value.substr(14,1)*5;
if (a32=='0') 
{
a32=50;
}

var a33=bc.value.substr(15,1)*6;
if (a33=='0') 
{
a33=60;
}

var a34=bc.value.substr(16,1)*7;
if (a34=='0') 
{
a34=70;
}

var a35=bc.value.substr(17,1)*8;
if (a35=='0') 
{
a35=80;
}

var a36=bc.value.substr(18,1)*9;
if (a36=='0') 
{
a36=90;
}

var a37=bc.value.substr(19,1)*1;
if (a37=='0') 
{
a37=10;
}




var a38=bc.value.substr(20,1)*2;
if (a38=='0') 
{
a38=20;
}

var a39=bc.value.substr(21,1)*3;
if (a39=='0') 
{
a39=30;
}

var a40=bc.value.substr(22,1)*4;
if (a40=='0') 
{
a40=40;
}

var a41=bc.value.substr(23,1)*5;
if (a41=='0') 
{
a41=50;
}

var a42=bc.value.substr(24,1)*6;
if (a42=='0') 
{
a42=60;
}

var a43=bc.value.substr(25,1)*7;
if (a43=='0') 
{
a43=70;
}

var a44=bc.value.substr(26,1)*8;
if (a44=='0') 
{
a44=80;
}

var a45=bc.value.substr(27,1)*9;
if (a45=='0') 
{
a45=90;
}

var a46=bc.value.substr(28,1)*1;
if (a46=='0') 
{
a46=10;
}

var a47=bc.value.substr(29,1)*2;
if (a47=='0') 
{
a47=20;
}

var a48=bc.value.substr(30,1)*3;
if (a48=='0') 
{
a48=30;
}

var a49=bc.value.substr(31,1)*4;
if (a49=='0') 
{
a49=40;
}

var a50=bc.value.substr(32,1)*5;
if (a50=='0') 
{
a50=50;
}

var a51=bc.value.substr(33,1)*6;
if (a51=='0') 
{
a51=60;
}

var a52=bc.value.substr(34,1)*7;
if (a52=='0') 
{
a52=70;
}

var a53=bc.value.substr(35,1)*8;
if (a53=='0') 
{
a53=80;
}

chk.value=a1+a2+a3+a4+a5+a6+a7+a8+a9+a10+a11+a12+a13+a14+a15+a16+a17+a18+a19+a20+a21+a22+a23+a24+a25+a26+a27+a28+a29+a30+a31+a32+a33+a34+a35+a36+a37+a38+a39+a40+a41+a42+a43+a44+a45+a46+a47+a48+a49+50+a51+a52+a53;

chk.value=Math.floor(31-chk.value%31);

if (chk.value=='10') 
{
chk.value="0";
}

if (chk.value=='11') 
{
chk.value="A";
}


if (chk.value=='12') 
{
chk.value="B";
}


if (chk.value=='13') 
{
chk.value="C";
}

if (chk.value=='14') 
{
chk.value="D";
}

if (chk.value=='15') 
{
chk.value="E";
}

if (chk.value=='16') 
{
chk.value="F";
}

if (chk.value=='17') 
{
chk.value="G";
}

if (chk.value=='18') 
{
chk.value="H";
}

if (chk.value=='19') 
{
chk.value="J";
}

if (chk.value=='20') 
{
chk.value="K";
}

if (chk.value=='21') 
{
chk.value="L";
}

if (chk.value=='22') 
{
chk.value="M";
}

if (chk.value=='23') 
{
chk.value="N";
}

if (chk.value=='24') 
{
chk.value="P";
}

if (chk.value=='25') 
{
chk.value="Q";
}

if (chk.value=='26') 
{
chk.value="R";
}

if (chk.value=='27') 
{
chk.value="T";
}

if (chk.value=='28') 
{
chk.value="U";
}

if (chk.value=='29') 
{
chk.value="W";
}

if (chk.value=='30') 
{
chk.value="X";
}

if (chk.value=='31') 
{
chk.value="Y";
}
javascript_obj0198_014.js pdf-javascript-stream PDF /JS object 198 at offset 0x13522 898 bytes
SHA-256: b65d68e2d446b52122f882716c85958d0cee68c289a2c9a95100eeddcca13d8c
Preview script
First 1,000 lines of the extracted script
var co=this.getField("txtAccountNumber");
{
if (NumbersStr.length < 13)
var cResponse = app.response({ cQuestion: "Your account number should be 13 digits long. Please re-enter your account number without dashes below. If you are having problems or do not know your 1-digit prefix or your 3-digit suffix, please call (302) 577-8780 for assistance.", cTitle: "Delaware Division of Revenue", cLabel: "Account Number:"});
}
{
while (cResponse.length != 13)
var cResponse = app.response({ cQuestion: "Please re-enter your account number without dashes below. If you are having problems or do not know your your 1-digit prefix or your 3-digit suffix, please call (302) 577-8780 for assistance.", cTitle: "Delaware Division of Revenue", cLabel: "Account Number:"});
}
{
if (NumbersStr.length < 13)
co.value = cResponse;
else co.value=event.value;
}
this.getField('txtTaxEnding').setFocus();
javascript_obj0199_015.js pdf-javascript-stream PDF /JS object 199 at offset 0x136E6 5083 bytes
SHA-256: f416c9fd5b01f9c2675d800306311af910880a24716d85793ea665e08d045c48
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
this.getField('chk_tbl_in1').textColor = color.black;
this.getField('chk_tbl_in2').textColor = color.black;
this.getField('chk_cnt').textColor = color.black;
var chk=this.getField("chk_cnt");
var ac=this.getField("chk_tbl_in1");
var bc=this.getField("chk_tbl_in2");

var a1=ac.value.substr(0,1)*1;
if (a1=='0') 
{
a1=10;
}

var a2=ac.value.substr(1,1)*2;
if (a2=='0') 
{
a2=20;
}

var a3=ac.value.substr(2,1)*3;
if (a3=='0') 
{
a3=30;
}

var a4=ac.value.substr(3,1)*4;
if (a4=='0') 
{
a4=40;
}

var a5=ac.value.substr(4,1)*5;
if (a5=='0') 
{
a5=50;
}

var a6=ac.value.substr(5,1)*6;
if (a6=='0') 
{
a6=60;
}

var a7=ac.value.substr(6,1)*7;
if (a7=='0') 
{
a7=70;
}

var a8=ac.value.substr(7,1)*8;
if (a8=='0') 
{
a8=80;
}

var a9=ac.value.substr(8,1)*9;
if (a9=='0') 
{
a9=90;
}

var a10=ac.value.substr(10,1)*1;
if (a10=='0') 
{
a10=10;
}

var a11=ac.value.substr(11,1)*2;
if (a11=='0') 
{
a11=20;
}

var a12=ac.value.substr(12,1)*3;
if (a12=='0') 
{
a12=30;
}

var a13=ac.value.substr(13,1)*4;
if (a13=='0') 
{
a13=40;
}

var a14=ac.value.substr(14,1)*5;
if (a14=='0') 
{
a14=50;
}

var a15=ac.value.substr(15,1)*6;
if (a15=='0') 
{
a15=60;
}

var a16=ac.value.substr(16,1)*7;
if (a16=='0') 
{
a16=70;
}

var a17=ac.value.substr(17,1)*8;
if (a17=='0') 
{
a17=80;
}

var a18=ac.value.substr(18,1)*9;
if (a18=='0') 
{
a18=90;
}

var a19=ac.value.substr(20,1)*1;
if (a19=='0') 
{
a19=10;
}

var a20=ac.value.substr(21,1)*2;
if (a20=='0') 
{
a20=20;
}

var a21=ac.value.substr(22,1)*3;
if (a21=='0') 
{
a21=30;
}


var a22=bc.value.substr(0,1)*4;
if (a22=='0') 
{
a22=40;
}

var a23=bc.value.substr(1,1)*5;
if (a23=='0') 
{
a23=50;
}

var a24=bc.value.substr(3,1)*6;
if (a24=='0') 
{
a24=60;
}

var a25=bc.value.substr(4,1)*7;
if (a25=='0') 
{
a25=70;
}

var a26=bc.value.substr(6,1)*8;
if (a26=='0') 
{
a26=80;
}

var a27=bc.value.substr(7,1)*9;
if (a27=='0') 
{
a27=90;
}

var a28=bc.value.substr(8,1)*1;
if (a28=='0') 
{
a28=10;
}

var a29=bc.value.substr(9,1)*2;
if (a29=='0') 
{
a29=20;
}

var a30=bc.value.substr(11,1)*3;
if (a30=='0') 
{
a30=30;
}

var a31=bc.value.substr(12,1)*4;
if (a31=='0') 
{
a31=40;
}

var a32=bc.value.substr(14,1)*5;
if (a32=='0') 
{
a32=50;
}

var a33=bc.value.substr(15,1)*6;
if (a33=='0') 
{
a33=60;
}

var a34=bc.value.substr(16,1)*7;
if (a34=='0') 
{
a34=70;
}

var a35=bc.value.substr(17,1)*8;
if (a35=='0') 
{
a35=80;
}

var a36=bc.value.substr(18,1)*9;
if (a36=='0') 
{
a36=90;
}

var a37=bc.value.substr(19,1)*1;
if (a37=='0') 
{
a37=10;
}




var a38=bc.value.substr(20,1)*2;
if (a38=='0') 
{
a38=20;
}

var a39=bc.value.substr(21,1)*3;
if (a39=='0') 
{
a39=30;
}

var a40=bc.value.substr(22,1)*4;
if (a40=='0') 
{
a40=40;
}

var a41=bc.value.substr(23,1)*5;
if (a41=='0') 
{
a41=50;
}

var a42=bc.value.substr(24,1)*6;
if (a42=='0') 
{
a42=60;
}

var a43=bc.value.substr(25,1)*7;
if (a43=='0') 
{
a43=70;
}

var a44=bc.value.substr(26,1)*8;
if (a44=='0') 
{
a44=80;
}

var a45=bc.value.substr(27,1)*9;
if (a45=='0') 
{
a45=90;
}

var a46=bc.value.substr(28,1)*1;
if (a46=='0') 
{
a46=10;
}

var a47=bc.value.substr(29,1)*2;
if (a47=='0') 
{
a47=20;
}

var a48=bc.value.substr(30,1)*3;
if (a48=='0') 
{
a48=30;
}

var a49=bc.value.substr(31,1)*4;
if (a49=='0') 
{
a49=40;
}

var a50=bc.value.substr(32,1)*5;
if (a50=='0') 
{
a50=50;
}

var a51=bc.value.substr(33,1)*6;
if (a51=='0') 
{
a51=60;
}

var a52=bc.value.substr(34,1)*7;
if (a52=='0') 
{
a52=70;
}

var a53=bc.value.substr(35,1)*8;
if (a53=='0') 
{
a53=80;
}

chk.value=a1+a2+a3+a4+a5+a6+a7+a8+a9+a10+a11+a12+a13+a14+a15+a16+a17+a18+a19+a20+a21+a22+a23+a24+a25+a26+a27+a28+a29+a30+a31+a32+a33+a34+a35+a36+a37+a38+a39+a40+a41+a42+a43+a44+a45+a46+a47+a48+a49+50+a51+a52+a53;

chk.value=Math.floor(31-chk.value%31);

if (chk.value=='10') 
{
chk.value="0";
}

if (chk.value=='11') 
{
chk.value="A";
}


if (chk.value=='12') 
{
chk.value="B";
}


if (chk.value=='13') 
{
chk.value="C";
}

if (chk.value=='14') 
{
chk.value="D";
}

if (chk.value=='15') 
{
chk.value="E";
}

if (chk.value=='16') 
{
chk.value="F";
}

if (chk.value=='17') 
{
chk.value="G";
}

if (chk.value=='18') 
{
chk.value="H";
}

if (chk.value=='19') 
{
chk.value="J";
}

if (chk.value=='20') 
{
chk.value="K";
}

if (chk.value=='21') 
{
chk.value="L";
}

if (chk.value=='22') 
{
chk.value="M";
}

if (chk.value=='23') 
{
chk.value="N";
}

if (chk.value=='24') 
{
chk.value="P";
}

if (chk.value=='25') 
{
chk.value="Q";
}

if (chk.value=='26') 
{
chk.value="R";
}

if (chk.value=='27') 
{
chk.value="T";
}

if (chk.value=='28') 
{
chk.value="U";
}

if (chk.value=='29') 
{
chk.value="W";
}

if (chk.value=='30') 
{
chk.value="X";
}

if (chk.value=='31') 
{
chk.value="Y";
}
javascript_obj0200_016.js pdf-javascript-stream PDF /JS object 200 at offset 0x13B2E 314 bytes
SHA-256: 3499e421ffaafa1a1de363fc89d41d1e16e502fe30986c5b1d169ca598fc9139
Preview script
First 1,000 lines of the extracted script
var value = event.value;
var NumbersStr = util.printx("9999999999999", value);
{
if (NumbersStr.length >= 13)
var formatStr = "9-999999999-999";
else var formatStr = "0-000000000-000";
}
event.value = util.printx(formatStr, value);

var c=this.getField("chk_tbl_in1");
c.value="00890407"+event.value;
stream_023_off0000a760.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA760 48485 bytes
SHA-256: da33fb3b6abdc3cf5d0c9a3466eb3d411d5292346678be0d843a5b6f82611d39
icc_00_off000057dd.icc pdf-icc-profile PDF ICC profile at offset 0x57DD 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e

Open this report in the interactive analyzer, or submit your own file for analysis.