Malicious PDF — malware analysis report

Static analysis result for SHA-256 e5dd14dc36b6a267…

MALICIOUS

PDF

709.4 KB Created: 2007-10-30 12:26:25 +01:00 Authoring application: Acrobat Distiller 7.0.5 for Macintosh First seen: 2026-05-10
MD5: 3d6c42fd7e8dc57e2e0ed4ff2b08d937 SHA-1: 09d8431032ef87f2491fec8111af51b3056215d6 SHA-256: e5dd14dc36b6a267cb5097965bddfcdc3af279ad50550b56abb3e4c48cb4fdc2
138 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript T1204.002 Malicious Link

The file is a PDF containing multiple embedded JavaScript streams and an AcroForm button with an action trigger, indicating an attempt to exploit PDF vulnerabilities. The ClamAV detection 'Pdf.Exploit.Agent-20775' strongly suggests malicious intent. The embedded JavaScript is likely responsible for downloading and executing a secondary payload, although the specific URLs for this are not directly extractable from the provided evidence. The high stream count also suggests obfuscation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5222

Heuristics 7

  • ClamAV: Pdf.Exploit.Agent-20775 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-20775
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/g/img/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj1312_009.js pdf-javascript-stream PDF /JS object 1312 at offset 0x77060 61 bytes
SHA-256: 6194bed55306139fa0613692ba8d7df6566d9b3e25e1da418cf5db1d4d1a07bc
Preview script
First 1,000 lines of the extracted script
if (!nichtVor2008(event.value)) {
    event.rc = false;
}
javascript_obj1430_013.js pdf-javascript-stream PDF /JS object 1430 at offset 0x787BE 64 bytes
SHA-256: b1eabd7002b3b6d4374372895528a4cc253665c9907fdfbc558550d6bb45b956
Preview script
First 1,000 lines of the extracted script
if (!checkGeburtsdatum(event.value)) {
    event.value = "";
}
javascript_obj1733_015.js pdf-javascript-stream PDF /JS object 1733 at offset 0x7DEC1 42 bytes
SHA-256: 38771303e5b133f65b24c6712ec9e6df4c1e3ff95fa802e5cb4ed740e2d70e27
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 3, 0, 0, "", false);
javascript_obj1734_016.js pdf-javascript-stream PDF /JS object 1734 at offset 0x7DF15 39 bytes
SHA-256: 3bc80ec40ddc2a11c8e2fe6adcd0b03351c4b296889df91d41bcbfba1fd9d4ad
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 3, 0, 0, "", false);
javascript_obj1760_017.js pdf-javascript-stream PDF /JS object 1760 at offset 0x7E2BB 65 bytes
SHA-256: eb5719eb3e51785b68ef3a44f9d246513081068502558bb59c2e44890eb06512
Preview script
First 1,000 lines of the extracted script
if (!checkGeburtsdatum(event.value)) {
    event.rc = false;
}
javascript_obj2908_018.js pdf-javascript-stream PDF /JS object 2908 at offset 0x813BA 42 bytes
SHA-256: 1829f93c988f1bfcd4bf6a74fc06fa5705171ae9bf3ac877b13813c6b492c742
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 2, 0, 0, "", false);
javascript_obj2909_019.js pdf-javascript-stream PDF /JS object 2909 at offset 0x8140E 39 bytes
SHA-256: 3328eab8501405fcffcc95bb30fbb8bcb963b88928e4a40bd4be3a45d3e80107
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 2, 0, 0, "", false);
javascript_obj2913_020.js pdf-javascript-stream PDF /JS object 2913 at offset 0x8151A 42 bytes
SHA-256: 2927a11b5de8196505468218d0335e4457345716313d2e477e9af256a6453087
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(1, 2, 0, 0, "", false);
javascript_obj2914_021.js pdf-javascript-stream PDF /JS object 2914 at offset 0x8156E 39 bytes
SHA-256: 483e06f06445cc39e6730dde13e0b0119b05238d991f965fa3cc0c1fa3e06089
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(1, 2, 0, 0, "", false);
javascript_obj3083_022.js pdf-javascript-stream PDF /JS object 3083 at offset 0x83982 237 bytes
SHA-256: 518e1fe2f37fea57fb397cd9512a204da5de881d8b692e9d3695b4c9148f63c0
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
datum = event.value;
if (datum != "") {
datum = getDatum(datum);
limit = getDatum('01102007');

if (datum < limit) {
	app.alert(unescape("Der Versicherungsbeginn darf nicht vor dem 01.10.2007 liegen."),1);
	event.rc = false;
}
}
javascript_obj3192_023.js pdf-javascript-stream PDF /JS object 3192 at offset 0x84BB0 41 bytes
SHA-256: e934f6fac167651ff02757d601fcd47fc91f338316e9d9cfa095ff9749fa0cb1
Preview script
First 1,000 lines of the extracted script
AFRange_Validate(true, 500, true, 10000);
javascript_obj3193_024.js pdf-javascript-stream PDF /JS object 3193 at offset 0x84C03 107 bytes
SHA-256: 45932a0bdf1553f65fa81113a37ef4232edd7ba595d343a00555d0f37cdf2fe2
Preview script
First 1,000 lines of the extracted script
if (!checkGeburtsdatum(event.value)) {
    event.value = "";
} else {
    checkAlter(event.value,18);
}
javascript_obj3294_025.js pdf-javascript-stream PDF /JS object 3294 at offset 0x86348 199 bytes
SHA-256: bc5cabb464bd6493d4edb053df7d42aeb5db3d18737ab9cde38a91aff940bd47
Preview script
First 1,000 lines of the extracted script
var nachname = this.getField("nachname.ast");
var vorname = this.getField("vorname.ast");
var trenner = (vorname.value != "") ? ", " : "";
event.value = nachname.value + trenner + vorname.value;
javascript_obj3981_026.js pdf-javascript-stream PDF /JS object 3981 at offset 0x8FE5A 41 bytes
SHA-256: 6aeb2fc8f6b0dba7b9d76914b437aa0140bcd183b4c2b0d2b66173e7a39a1974
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "", true);
javascript_obj3982_027.js pdf-javascript-stream PDF /JS object 3982 at offset 0x8FEAD 38 bytes
SHA-256: dd4e86ff46931388298d522a0c25afc2a74df361f28fb6ad9f104ffc1f5056c1
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "", true);
javascript_obj3986_028.js pdf-javascript-stream PDF /JS object 3986 at offset 0x8FFC0 42 bytes
SHA-256: a22e7a3e6dbfb6427839e3a2fdcab1be9d58bdd666536d5308358ec98c59feed
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "", false);
javascript_obj3987_029.js pdf-javascript-stream PDF /JS object 3987 at offset 0x90014 39 bytes
SHA-256: cf3ef38cead83f4b1b39c7a061c8fef2c62d068861252a2b5ba7c0b959eec058
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "", false);
javascript_obj4665_030.js pdf-javascript-stream PDF /JS object 4665 at offset 0x971D4 140 bytes
SHA-256: 95066cd27f083b1a0413aadccb5835508c16082c9316fb48ecf4a641d2a49443
Preview script
First 1,000 lines of the extracted script
var beruf = this.getField("beruf.vp1");
if (beruf.value == "")  {
    beruf = this.getField("beruf.ast");
}

event.value = beruf.value;
javascript_obj4676_031.js pdf-javascript-stream PDF /JS object 4676 at offset 0x97298 134 bytes
SHA-256: a864be5d6a4c10f844b899fd655b85ccd76d2549394d2bb49087c933096a8cc5
Preview script
First 1,000 lines of the extracted script
bs_vp1 = this.getField("berufsstand.vp1");
if (bs_vp1.value == "Off") {
    this.getField("ges.berufsstand").value = event.value;
}
javascript_obj4688_032.js pdf-javascript-stream PDF /JS object 4688 at offset 0x97352 186 bytes
SHA-256: 3edbbd8092239ad80281cabaaad5b6111d8273b8e1f0a5d74399764696944cd2
Preview script
First 1,000 lines of the extracted script
if (event.value != "Off") {
    this.getField("ges.berufsstand").value = event.value;
} else {
    this.getField("ges.berufsstand").value = this.getField("berufsstand.ast").value
}
javascript_obj4774_033.js pdf-javascript-stream PDF /JS object 4774 at offset 0x977A1 184 bytes
SHA-256: 26ce941523556de27b633b09777f4608b8fe21356f667bed8cd4476d6d43e5a4
Preview script
First 1,000 lines of the extracted script
if (event.value != "Off") {
    this.getField("ges.berufsstand").value = event.value;
} else {
    this.getField("ges.berufsstand").value = this.getField("berufsstand.ast").value
}
javascript_obj3298_034.js pdf-javascript-stream PDF /JS object 3298 at offset 0x8651F 349 bytes
SHA-256: 996fc70e5de6677bdf952e8fbd0dc7b163da9aa135aa8ec75002e7168ddec1b7
Preview script
First 1,000 lines of the extracted script
var nachname = this.getField("nachname.vp1");
var vorname = this.getField("vorname.vp1");
if ((vorname.value == "") && (nachname.value == "")) {
    nachname = this.getField("nachname.ast");
    vorname = this.getField("vorname.ast");
}
var trenner = (vorname.value != "") ? ", " : "";
event.value = nachname.value + trenner + vorname.value ;
javascript_obj4461_035.js pdf-javascript-stream PDF /JS object 4461 at offset 0x93EE5 790 bytes
SHA-256: 624f09e12a56a347ca2dd695c161c1a87101c08e7323dcab9678589486c2b1c8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--)d[c.toString(a)]=k[c]||c.toString(a);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('r q(8,7,f,9){8=b.p(8*b.k(h,7))/b.k(h,7);g=8+"";2=g.o(".");6(!2[0])2[0]="0";6(!2[1])2[1]="";6(2[1].4<7){a=2[1];e(i=2[1].4+1;i<=7;i++){a+="0"}2[1]=a;6(2[1].4>0){2[1]=f+2[1]}}6(9!=""&&2[0].4>3){5=2[0];2[0]="";e(j=3;j<5.4;j+=3){d=5.n(5.4-j,5.4-j+3);2[0]=9+d+2[0]+""}c=5.m(0,(5.4%3==0)?3:(5.4%3));2[0]=c+2[0]}l 2[0]+2[1]}',28,28,'||arr_int||length|Begriff|if|laenge|number|th_sep|nachkomma|Math|str_first|Extrakt|for|sep|str_number|10|||pow|return|substr|slice|split|round|formatNumber|function'.split('|'),0,{}))
javascript_obj4463_036.js pdf-javascript-stream PDF /JS object 4463 at offset 0x94151 1538 bytes
SHA-256: 9f144a5d4114dc312550f4adb2da6a4d8420a0d4f2f67da33d93c58f789b1592
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('9 1g(5,Y){a(5==""){8}11=7(5.6(0,2));12=7(5.6(2,2))-1;13=7(5.6(4));5=z y(13,12,11);Z=z y();s=Z-5;s=X(((((s/x)/e)/e)/v)/W.V,10);a(s>=Y){k.j(i("n f%P b O N %M%L K J I H G F b E D C m B l."),1)}}9 1f(3){a(3!=""){d=7(3.6(4));a(d<u){k.j(i("n w%U b l T S m 1.1.u."),1);8 R}}8 t}9 h(3){p=7(3.6(0,2));o=7(3.6(2,2));d=7(3.6(4));3=z y(d,o-1,p);8 3}9 1e(5,g){5=h(5);g=h(g);r=g.1d();r=x*e*e*v+r;g.1c(r);q=g-5;q=X(((((q/x)/e)/e)/v)/W.V,10);8 q}9 1b(3){o=7(3.6(0,2));p=7(3.6(2,2));d=7(3.6(4));8 p+"."+o+"."+d}9 1a(3,c){a(3=="")8 t;3=h(3);a(c==19)c=\'18\';c=h(c);a(3<c){k.j(i("n w%U b l T S m 1.1.u."),1);8 R}8 t}9 17(Q){16(Q){15 4:A="n f%P b O N %M%L K J I H G F b E D C m B l.";14}k.j(i(A),1)}',62,79,'|||datum||geburtsdatum|substr|Number|return|function|if|Sie|limit|jahr|60||refdatum|getDatum|unescape|alert|app|ein|dem|Bitte|monat|tag|alter|sekunden|istAlter|true|2008|24||1000|Date|new|meldung|Antrag|mit|zusammen|dieses|reichen|und|aus|04|Abschnitt|in|22|22Gesundheitsfragen|Formular|das|FCllen|which|false|nach|Datum|E4hlen|25|365|parseInt|sollAlter|jetzt||gTag|gMonat|gJahr|break|case|switch|bitteFormular|01011900|null|checkGeburtsdatum|formatDatum|setTime|getTime|getAlter|nichtVor2008|checkAlter'.split('|'),0,{}))
javascript_obj4646_037.js pdf-javascript-stream PDF /JS object 4646 at offset 0x96E2A 1695 bytes
SHA-256: 4fc7a628209725ea2174e5f0a071abb1ebd48ccfb4c66d7c01712c0f3df12276
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var struktur = new Array();

struktur[0] = new Array();
struktur[0]["first"] = 3;
struktur[0]["last"] = 3;

struktur[1] = new Array();
struktur[1]["first"] = 4;
struktur[1]["last"] = 8;

struktur[2] = new Array();
struktur[2]["first"] = 9;
struktur[2]["last"] = 12;
struktur[2][0] = new Array();
struktur[2][0]["first"] = 10;
struktur[2][0]["last"] = 10;
struktur[2][1] = new Array();
struktur[2][1]["first"] = 11;
struktur[2][1]["last"] = 12;

struktur[3] = new Array();
struktur[3]["first"] = 13;
struktur[3]["last"] = 18;
struktur[3][0] = new Array();
struktur[3][0]["first"] = 14;
struktur[3][0]["last"] = 14;
struktur[3][1] = new Array();
struktur[3][1]["first"] = 15
struktur[3][1]["last"] = 18;

struktur[4] = new Array();
struktur[4]["first"] = 19;
struktur[4]["last"] = 24;
struktur[4][0] = new Array();
struktur[4][0]["first"] = 20;
struktur[4][0]["last"] = 20;
struktur[4][1] = new Array();
struktur[4][1]["first"] = 21;
struktur[4][1]["last"] = 24;

struktur[5] = new Array();
struktur[5]["first"] = 25;
struktur[5]["last"] = 34;


function drucke(mainIndex,subIndex) {

	
	if (subIndex != null) {
		firstPage = struktur[mainIndex][subIndex]["first"];
		lastPage = struktur[mainIndex][subIndex]["last"];
	} else {
		firstPage = struktur[mainIndex]["first"];
		lastPage = struktur[mainIndex]["last"];
	}
	firstPage--;
	lastPage--;
    
	this.print(false, firstPage, lastPage);
}

function meldung () {
	app.alert(unescape("Bitte denken Sie daran%2C das Formular %2202 - BEST%C4TIGUNG %DCBER DEN EMPFANG VON INFORMATIONEN%22 ausgef%FCllt und unterschrieben zusammen mit den notwendigen Antr%E4gen einzureichen%21"),1);

}
stream_084_off0004db1a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4DB1A 19736 bytes
SHA-256: d10d11cc944ddfd9fabc799332b25c672db35a7d57174a3906498069b6dba605
icc_00_off0001e219.icc pdf-icc-profile PDF ICC profile at offset 0x1E219 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_cff_off0001ef0d.bin pdf-font-stream PDF embedded font (cff) at offset 0x1EF0D 5470 bytes
SHA-256: 07a25b424b8a1abe69f035df45e0c7239766d4b1d6500319ffccf9f7955bc3c2
font_01_cff_off000206a8.bin pdf-font-stream PDF embedded font (cff) at offset 0x206A8 5615 bytes
SHA-256: 29f4177ad59a582aba22e68bc5d620091288026b5e41569b7d4fc6bbfedfbc47
font_02_cff_off00021ea5.bin pdf-font-stream PDF embedded font (cff) at offset 0x21EA5 5470 bytes
SHA-256: 0f59f113bc5ceff8fc8fb01d8e5d29e5bab4d6b9be50945c446ce1b8b3cb03bc
font_03_cff_off000234d1.bin pdf-font-stream PDF embedded font (cff) at offset 0x234D1 5615 bytes
SHA-256: 181947beade60771eec8ecbdcb94253ae10085b0e18a0ecf34a69fd81cc2b340
font_04_cff_off00024b33.bin pdf-font-stream PDF embedded font (cff) at offset 0x24B33 5470 bytes
SHA-256: d083ed40134c489dd152b6940b750d97c1a0f3190f99a2791a17c0b0b448ee34

Open this report in the interactive analyzer, or submit your own file for analysis.