Malware Insights
The PDF file is encrypted and contains an OpenAction, which is a common technique to obscure malicious content from static analysis. The heuristic 'PDF_ENCRYPTED_WITH_JS' indicates that JavaScript may be involved in the obfuscation or execution of the payload. The 'PDF_IMAGE_ONLY_LURE' heuristic suggests the document's content is presented as an image to bypass text-based analysis and potentially trick the user. Without further script analysis or extracted URLs, the exact payload and delivery mechanism remain unclear, leading to a lower confidence score.
Machine Learning
- Nyx PDF Classifier clean score 0.0262
Heuristics 3
-
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTERPDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
-
Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JSPDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Extracted artifacts 14
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0080_002.js |
pdf-javascript-stream | PDF /JS object 80 at offset 0x5A69 | 40 bytes |
SHA-256: 8989156e0f24047d2839dcbaed7792336dc870f1247937743c018c2d7d428bf2 |
|||
Preview scriptFirst 1,000 lines of the extracted script
this.getField("scrutateur").setFocus();
|
|||
javascript_obj0086_003.js |
pdf-javascript-stream | PDF /JS object 86 at offset 0x6423 | 78 bytes |
SHA-256: a6248cb417d3a27fc2836456470d337976c0d1432150f2ad7ce8bc6ad1065fd0 |
|||
Preview scriptFirst 1,000 lines of the extracted script
obtenirMessage("messageInfo_cliquez");
this.getField("president").setFocus();
|
|||
javascript_obj0097_004.js |
pdf-javascript-stream | PDF /JS object 97 at offset 0x6AAC | 62 bytes |
SHA-256: ec0291f72448d57d21a1f84630a648849c2a0d442a85c789f0f10b827f9083b7 |
|||
Preview scriptFirst 1,000 lines of the extracted script
if(event.value){event.value = util.printx(">*",event.value);}
|
|||
javascript_obj0107_005.js |
pdf-javascript-stream | PDF /JS object 107 at offset 0x6E22 | 37 bytes |
SHA-256: ea259f6281e66629fa1f3e0a7ab4b6880d7627c43718a284b67628977c797989 |
|||
Preview scriptFirst 1,000 lines of the extracted script
obtenirMessage("messageInfo_imp11");
|
|||
javascript_obj0111_006.js |
pdf-javascript-stream | PDF /JS object 111 at offset 0x72BC | 105 bytes |
SHA-256: 91a1df531d91cf7b649b2ad4ba0ad99ba3bfcb256685859dc59107549ab67a18 |
|||
Preview scriptFirst 1,000 lines of the extracted script
if(obtenirMessage("messageAvis_effacer") == 4)
{
resetForm();
this.getField("president").setFocus();
}
|
|||
javascript_obj0115_007.js |
pdf-javascript-stream | PDF /JS object 115 at offset 0x77B8 | 37 bytes |
SHA-256: 1f440ab05a7c603edbd1bdce697a1731d4f7e38170d9e6f0d0d16a6df0490ff8 |
|||
Preview scriptFirst 1,000 lines of the extracted script
this.getField("cliquez").setFocus();
|
|||
javascript_obj0120_008.js |
pdf-javascript-stream | PDF /JS object 120 at offset 0x78FB | 206 bytes |
SHA-256: 1c51f00ff2a9097ba85afb7c805b14e4fe8a83faca57b44469e03f7abd5435db |
|||
Preview scriptFirst 1,000 lines of the extracted script
if ( typeof x == "undefined" )
{
if (app.viewerVersion < 5.05)
obtenirMessage("messageErreur_reader");
else
{
var x = 1;
this.getField("president").setFocus();
}
}
|
|||
javascript_obj0154_009.js |
pdf-javascript-stream | PDF /JS object 154 at offset 0xCA33 | 35 bytes |
SHA-256: 8dc02ba48d6c20bb5007c9432fec9ec2c52bca2a4362d6c478bac61a663f3a6f |
|||
Preview scriptFirst 1,000 lines of the extracted script
this.getField("reset").setFocus();
|
|||
javascript_obj0148_010.js |
pdf-javascript-stream | PDF /JS object 148 at offset 0xB55D | 10239 bytes |
SHA-256: 88b7de31649d8aee1ab443d061645e29cd733ffa22439dd9a4208e121c7f4bb8 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 1 eval/decoder/string-building token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
function autoTab(champSuivant)
{
if (event.rc && AFMergeChange(event).length == event.target.charLimit)
this.getField(champSuivant).setFocus();
}
function validerNoDossier()
{
var position = event.selStart + 1;
if (position == 1 || position == 2)
validerAlpha();
else
validerNum();
}
function annulerDernierEvnmt()
{
app.beep(0);
event.rc = false;
return false;
}
function validerHeure()
{
if (event.value)
{
var heure = event.value;
if (heure > 2400 || heure.length<4)
{
obtenirMessage("messageErreur_heure");
event.rc = false;
}
}
}
function formaterHeure()
{
if (event.value) event.value = util.printx("99 h 99", event.value);
}
function validerNum(car)
{
var cValid = "0123456789" + (typeof car == "string" ? car : "");
numValide = true;
if (cValid.indexOf(event.change) == -1)
numValide = annulerDernierEvnmt();
else
numValide = true;
return numValide;
}
function validerAlpha(car)
{
var cValid = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ" + (typeof car == "string" ? car : "");
alphaValide = true;
if (cValid.indexOf(event.change) == -1)
alphaValide = annulerDernierEvnmt();
else
alphaValide = true;
return alphaValide;
}
function validerAlphaNum(car)
{
var cValid = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ" + (typeof car == "string" ? car : "");
alphaNumValide = true;
if (cValid.indexOf(event.change) == -1)
alphaNumValide = annulerDernierEvnmt();
else
alphaNumValide = true;
return alphaNumValide;
}
function validerCodePostal()
{
var position = event.selStart;
var codePostalValide = true;
if(!event.willCommit)
if(position % 2 == 0)
validerAlpha();
else
validerNum();
else
if(!validerCP())
{
obtenirMessage("messageErreur_cp");
event.value = "";
event.target.setFocus();
codePostalValide = false;
}
return codePostalValide;
}
function validerCP()
{
var codePostalValide = true;
var carInvalide = /[dfioquDFIOQU]/g;
var premierCarInvalide = /^[wzWZ]/;
if(event.value)
if(event.value.search(carInvalide) != -1 || event.value.search(premierCarInvalide) != -1 || event.value.search(/\D\d\D\d\D\d/))
codePostalValide = false;
return codePostalValide;
}
function formaterCodePostal()
{
event.value = util.printx(">A9A 9A9",event.value);
}
function validerDate(format)
{
date = event.value; dateValide = true;
jourDansMois = new Array("31","29","31","30","31","30","31","31","30","31","30","31");
annee = format == "amj" || format == "am" ? /^(\d{4})\d+/ : format == "ma" || format == "jma" ? /\d+(\d{4})$/ : 0;
mois = format == "amj" || format == "am" ? /\d{4}(\d{2})\d*/ : format == "mj" || format == "ma" ? /^(\d{2})\d+/ : /\d{2}(\d{2})\d*/;
jour = format == "amj" || format == "mj" ? /\d+(\d{2})$/ : format == "jma" || format == "jm" ? /^(\d{2})\d+/ : 0;
if (date)
if(date.length != event.target.charLimit)
dateValide = false;
else
{
if((mois ? retournerStr(date,mois) > 12 || retournerStr(date,mois) < 1 : false) || (annee ? !retournerStr(date,annee) : false))
dateValide = false;
else if(jour)
if (retournerStr(date,mois) != 2 || (!annee))
dateValide = retournerStr(date,jour) > jourDansMois[retournerStr(date,mois)-1] ||
!retournerStr(date,jour) ? false : true;
else
dateValide = retournerStr(date,jour) > jourDansFevrier(retournerStr(date,annee)) ||
!retournerStr(date,jour) ? false : true;
}
if(!dateValide) {event.rc = false; obtenirMessage("messageErreur_"+format);} return dateValide;
}
function jourDansFevrier(annee)
{
return (((annee % 4 == 0) && ((!(annee % 100 == 0)) || (annee % 400 == 0))) ? 29 : 28 );
}
function retournerStr(date,regExp)
{
return parseInt(date.replace(regExp,"$1"),10);
}
function formaterDate(str)
{
j = m = "99"; a = "9999"; tiret = "-"; format = "";
for(var i = 0; i < str.length*2-1; i++) format += i % 2 ? tiret : eval(str.substr(i/2,1));
if(event.value) event.value = util.printx(format,event.value);
}
function formaterDate2()
{
event.value = util.printx("9999 99 99", event.value);
}
function validerNas()
{
var intPreuve = 0, intTmp = 0, strNAS = event.value;
var nasValide = true;
if (strNAS != "")
{
if (parseInt(strNAS.charAt(0)) != 0)
{
for (var i = 0; i < 8; i++)
{
intTmp = parseInt(strNAS.charAt(i));
if ((i + 1) % 2 == 0)
{
intTmp = intTmp * 2;
if (intTmp > 9)
intTmp = (intTmp % 10) + 1;
}
intPreuve = intPreuve + intTmp;
}
intPreuve = 10 - (intPreuve % 10);
if (intPreuve == 10)
intPreuve = 0;
}
if (strNAS.charAt(8) != intPreuve || strNAS.length != 9 || parseInt(strNAS.charAt(0)) == 0)
{
nasValide = false;
event.rc = false;
obtenirMessage("messageErreur_nas");
}
return nasValide;
}
}
function formaterNas()
{
event.value = util.printx("999 999 999",event.value);
}
function validerTel()
{
var tel = util.printx("9999999999", event.value);
var telValide = true;
var messageErreur = arguments.length ? "messageErreur_" + arguments[0] : "messageErreur_tel";
if (tel.length != 10 && tel.length != 7 && tel.length != 0)
{
telValide = false;
event.rc = false;
obtenirMessage(messageErreur);
}
return telValide;
}
function validerFax()
{
validerTel("fax");
}
function formaterTel()
{
format = event.value.length == 10 ? "(999) 999-9999" : "999-9999";
if (event.value) event.value = util.printx(format, event.value);
}
function colorerChamp(colorSpace, c1, c2, c3)
{
f = event.target;
if(arguments.length == 1) /*Valeur par d�faut*/ {c1 = 0; c2 = 0; c3 = 255; c4 = 1;} else c4 = c1;
switch(colorSpace)
{
case "RGB" : c1 = c1/255; c2 = c2/255; c3 = c3/255;
break;
case "T" : c1 = ""; c2 = ""; c3 = "";
break;
case "G" : c1 = c4/255; c2 = ""; c3 = "";
break;
}
f.strokeColor = [colorSpace, c1, c2, c3];
f.lineWidth = 1;
f.borderStyle = border.s;
}
function activerChamp(champ) //Pour les bouton d'aide, apr�s obtenirMessage("...
{
var champActiver = arguments.length ? champ : event.target.name.substr(5);
this.getField(champActiver).setFocus();
}
function reporterChamp(valeur) //Pour les champ report�, dans l'onglet Valider
{
var valeurRep = arguments.length ? valeur : event.value;
this.getField("rep_" + event.target.name).value = valeurRep;
}
function gererAffichageBulle()
{
var bulle = this.getField("text_" + event.target.name);
var evnmt = event.name;
switch(evnmt)
{
case "Focus" : bulle.display = display.noPrint;
break;
case "Mouse Enter" : bulle.display = display.noPrint;
break;
case "Blur" : bulle.display = display.hidden;
break;
case "Mouse Exit" : bulle.display = display.hidden;
break;
}
}
// "valeur" est le nombre "non-format�" re�u en param�tre.
// Par d�faut: event.value
// "nb_Decimales" sp�cifie le nombre de d�cimale que le nombre doit avoir � la sortie.
// Par d�faut, il y en aura 2.
// "separateur" est le caract�re utilis� pour s�parer les groupes de trois chiffres, les milliers.
// Pour ne pas en mettre : "", par d�faut, c'est l'espace;
// "carAAjouter" sont les caract�res qu'il est possible d'ajouter au nombre AVANT ou APR�S le nombre...
// selon le param�tre "endroit" qui peut �tre sp�cifi� � 1 pour AVANT.
// Par d�faut, les carAAjouter, � "" par d�faut, sont plac�s APR�S(2).
function formaterArgent()
{
return formaterNombre(event.value,2,","," "," $",2);
}
function formaterNombre(valeur,nb_Decimales,sep_Dec,sep_Milliers,carAAjouter,endroit)
{
if (typeof valeur =="undefined") {valeur = event.value;}
else if(valeur == ".") {valeur = 0;}
if (typeof nb_Decimales =="undefined") {nb_Decimales = 2;}
if (typeof sep_Dec =="undefined") {sep_Dec = ",";}
if (typeof sep_Milliers =="undefined") {sep_Milliers =" ";}
if (typeof carAAjouter =="undefined") {carAAjouter = "";}
if (typeof endroit =="undefined") {endroit = 2;}
var facteur = "1";
for (var i=0;i<nb_Decimales;i++)
{
facteur += "0";
}
facteur = facteur*1;
var resultat = valeur * facteur;
resultat = Math.round(resultat);
resultat = resultat/facteur;
str_Resultat = resultat.toString();
var posPoint = str_Resultat.indexOf(".");
if (posPoint == -1 && nb_Decimales)
{
str_Resultat += ".";
posPoint = str_Resultat.length-1;
}
var longueur = str_Resultat.length;
nbCAP = longueur - (posPoint+1);
for(var i = nbCAP;i<nb_Decimales;i++)
{
str_Resultat += "0";
}
if(sep_Milliers !="")
{
var dernierEntier = posPoint == -1 ? str_Resultat.length-1 : posPoint-1;
if (dernierEntier>2)
{
var car = "";
var cpt3 = 0;
resultat = str_Resultat.substr(dernierEntier,nb_Decimales+2);
for (var i = dernierEntier-1;i>=0;i--)
{
if(cpt3==2)
{
resultat = sep_Milliers + resultat;
cpt3=0;
}
else
{
cpt3++;
}
resultat = str_Resultat.substr(i,1)+ resultat;
}
}
else
{
resultat = str_Resultat;
}
}
else
{
resultat = str_Resultat;
}
if(carAAjouter)
{
emplacement = endroit == 1 ? 1:2;
switch(emplacement)
{
case 1: resultat = carAAjouter + resultat;
break;
case 2: resultat = resultat + carAAjouter;
}
}
if(sep_Dec==","){resultat = resultat.replace(".",",");}
return resultat;
}
function validerArgent()
{
if(event.value.indexOf(".") == -1)
{
validerNum(".");
}
else
{
validerNum();
}
}
|
|||
javascript_obj0149_011.js |
pdf-javascript-stream | PDF /JS object 149 at offset 0xC1A2 | 3517 bytes |
SHA-256: 41ec51841d5b43d22af3c7f0f1b101ac4f153dda663e18ffd5b9d8abb6143437 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 3 eval/decoder/string-building token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
function obtenirMessage(message)
{
messageInfo_cliquez = "BESOIN D'AIDE ?\nCliquez sur les hyperliens.\n\nNAVIGATION\nUtilisez la touche de tabulation.\n\nMISE EN FORME DE CERTAINS CHAMPS\nMise en forme automatique : date, num�ro d'assurance sociale, code postal et num�ro de t�l�phone (ne tapez que les caract�res essentiels, sans tiret, espace ou barre oblique).\n\nIMPRESSION\nUtilisez les boutons au bas du formulaire.\n\nD�CIMALES\nUtilisez le point et non l'espace ou la virgule.";
messageInfo_amj = "Entrez la date sous la forme � AAAAMMJJ �. Par exemple,\npour inscrire le 26 mars 2005, tapez � 20050326 �.";
messageInfo_mj = "Entrez la date sous la forme � MMJJ �. Par exemple,\npour inscrire le 26 mars, tapez � 0326 �.";
messageInfo_am = "Entrez la date sous la forme � AAAAMM �. Par exemple,\npour inscrire le mois de mars 2005, tapez � 200503 �.";
messageInfo_tel = "N'inscrivez que les chiffres de l'indicatif r�gional et du num�ro de t�l�phone. Ils seront mis en forme automatiquement.";
messageInfo_heure = "Entrez l'heure sous la forme � HHMM �. Par exemple, \npour inscrire 9h05, tapez � 0905 �."
messageInfo_imp14 = "Prenez soin de sp�cifier le format de papier appropri� pour l'impression du document, soit � 8� X 14 � (Legal US)."
messageInfo_imp11 = "Prenez soin de sp�cifier le format de papier appropri� pour l'impression du document, soit � 8� X 11 � (Lettre US)."
messageAvis_barrer = "Sauvegarde avec protection du document. Vous ne pourrez que consulter et imprimer le document.\n\nVoulez-vous continuer?";
messageAvis_effacer = " Tout effacer ? \n\nVoulez-vous vraiment effacer toutes les donn�es inscrites sur le formulaire ?";
messageErreur_amj = "Date invalide. Vous devez respecter le format � AAAAMMJJ �\n(par ex., tapez � 20050326 � pour inscrire le 26 mars 2005).";
messageErreur_am = "Date invalide. Vous devez respecter le format � AAAAMM �\n(par ex., tapez � 200503 � pour inscrire le mois de mars 2005).";
messageErreur_mj = "Date invalide. Vous devez respecter le format � MMJJ �\n(par ex., tapez � 0326 � pour inscrire le 26 mars).";
messageErreur_nas = "Num�ro d'assurance sociale invalide";
messageErreur_cp = "Code postal invalide";
messageErreur_tel = "Inscription incorrecte : inscrivez TOUS les chiffres de l'indicatif r�gional et du num�ro de t�l�phone.";
messageErreur_tel2 = "Valeur incorrecte. Vous devez entrer les sept chiffres, et seulement les sept chiffres, composant le num�ro de t�l�phone.";
messageErreur_fax = "Inscription incorrecte : inscrivez TOUS les chiffres de l'indicatif r�gional et du num�ro de t�l�copieur.";
messageErreur_reader = "La version d'Acrobat Reader que vous utilisez est ant�rieure � celle requise (4.05). Des erreurs peuvent survenir. T�l�chargez la plus r�cente version (www.adobe.com), ou imprimez le formulaire et remplissez-le � la main.";
messageErreur_heure = "Heure invalide. Vous devez respecter le format � HHMM �.\nPar exemple, pour inscrire 9 heures et 5 minutes, tapez � 0905 �."
messageErreur_pw = "Vous n'�tes pas autoris� ou vous avez le mauvais mot de passe.";
if(message.search(/messageInfo/g) != -1)
return app.alert(eval(message),4);
else if(message.search(/messageAvis/g) != -1)
return app.alert(eval(message),1,2);
else
return app.alert(eval(message),1);
}
|
|||
font_00_cff_off0000cad2.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0xCAD2 | 1727 bytes |
SHA-256: 55755829f9a5758fda88a297e902af710fbbf22cb76c21c5b1d18ccc8ddf10c0 |
|||
font_01_cff_off0000d0df.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0xD0DF | 2508 bytes |
SHA-256: 26c20047e987aa408d1cfb719de5adb97c3d71ffa7da9d5753b409594fffc492 |
|||
font_02_cff_off0000da07.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0xDA07 | 1406 bytes |
SHA-256: 7df8c2693a65acebd3f39ac471283ed5a5c344f90f6867811b626b6a8177eb69 |
|||
font_03_cff_off0000df84.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0xDF84 | 1114 bytes |
SHA-256: c94f4c2931ef64ef1aac13c58c0665f682793edb004349704c208fdaa89f1f5d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.