Malicious PDF — malware analysis report

Static analysis result for SHA-256 e646ea0ca21b6eb8…

MALICIOUS

PDF

101.3 KB First seen: 2026-05-10
MD5: 55ad970e2326bfb5111cf7f72eb7fd11 SHA-1: edc4eba899e4c0061fa2113e26a8b205470661bd SHA-256: e646ea0ca21b6eb88a1f25cb6ca3c2c3847023df6b3b6aa1980ded8f15d15a5f
350 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7983

Heuristics 9

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after nested-decoder de-obfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after nested-decoder de-obfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after nested-decoder de-obfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Obfuscated multi-stage PDF JavaScript heap-spray exploit critical CVE related PDF_JS_OBFUSCATED_MULTISTAGE_HEAPSPRAY
    PDF JavaScript hidden behind nested stream filters and/or a custom in-JS decoder (rolling-XOR stager) decodes to a heap-spray / ROP chain. The spray is only visible after unwinding those layers, which is why the raw heap-spray rules miss it. This is an obfuscated multi-stage Adobe Reader JavaScript exploit; the dropped Windows payload (often named Win.Trojan.Agent by signature AV) is the second stage, not the delivery mechanism.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://www.iec.chIn PDF document text

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0054_000.js pdf-javascript-stream PDF /JS object 54 at offset 0x561E 1058 bytes
SHA-256: 474eabdc32833fe1e19cac46928a30183f299b40531f62c371689de162566398
Preview script
First 1,000 lines of the extracted script
var ACRO_breakpoints = [{fileName:"Document-Actions:Document Open", lineNum:112, condition:"true"}, {fileName:"Document-Actions:Document Open", lineNum:1, condition:"true"}, {fileName:"Document-Actions:Document Open", lineNum:113, condition:"true"}, {fileName:"Document-Actions:Document Open", lineNum:114, condition:"true"}, {fileName:"Document-Actions:Document Open", lineNum:115, condition:"true"}, {fileName:"Document-Actions:Document Open", lineNum:116, condition:"true"}, {fileName:"", lineNum:110, condition:"true"}, {fileName:"", lineNum:116, condition:"true"}, {fileName:"Document-Actions:Document Will Save", lineNum:1, condition:"true"}, {fileName:"Document-Actions:Document Will Save", lineNum:112, condition:"true"}, {fileName:"Document-Actions:Document Will Save", lineNum:115, condition:"true"}, {fileName:"Document-Actions:Document Will Save", lineNum:118, condition:"true"}, {fileName:"Document-Actions:Document Will Print", lineNum:118, condition:"true"}, {fileName:"Document-Actions:Document Will Print", lineNum:119, condition:"true"}];
javascript_obj0092_001.js pdf-javascript-stream PDF /JS object 92 at offset 0x13217 1056 bytes
SHA-256: a1a83f2cb6d5786776cb226160c87df58cd8276c88b27b94d3583f0063d31490
Preview script
First 1,000 lines of the extracted script
var ACRO_breakpoints = [{fileName:"Document-Actions:Document Open", lineNum:112, condition:"true"}, {fileName:"Document-Actions:Document Open", lineNum:1, condition:"true"}, {fileName:"Document-Actions:Document Open", lineNum:113, condition:"true"}, {fileName:"Document-Actions:Document Open", lineNum:114, condition:"true"}, {fileName:"Document-Actions:Document Open", lineNum:115, condition:"true"}, {fileName:"Document-Actions:Document Open", lineNum:116, condition:"true"}, {fileName:"", lineNum:110, condition:"true"}, {fileName:"", lineNum:116, condition:"true"}, {fileName:"Document-Actions:Document Will Save", lineNum:1, condition:"true"}, {fileName:"Document-Actions:Document Will Save", lineNum:112, condition:"true"}, {fileName:"Document-Actions:Document Will Save", lineNum:115, condition:"true"}, {fileName:"Document-Actions:Document Will Save", lineNum:118, condition:"true"}, {fileName:"Document-Actions:Document Will Print", lineNum:118, condition:"true"}, {fileName:"Document-Actions:Document Will Print", lineNum:119, condition:"true"}];
objstm_0004_00.bin pdf-objstm-decoded PDF /ObjStm 4 0 obj (inflated) 383 bytes
SHA-256: 18329e2b80c18cbf6dfb4fabf3c6c1d05849403c4358fa6d6c100797ab551625
objstm_0046_00.bin pdf-objstm-decoded PDF /ObjStm 46 0 obj (inflated) 32 bytes
SHA-256: 131637e155398f0018c15de921c77047e3d365d596a8f52b1de5bb7d3fb1ccfe
objstm_0056_00.bin pdf-objstm-decoded PDF /ObjStm 56 0 obj (inflated) 32 bytes
SHA-256: b3ad6e4e5edb8ae59b204652b6a9c49bcd0d07013be334566b0effb00b98f7ba
objstm_0060_00.bin pdf-objstm-decoded PDF /ObjStm 60 0 obj (inflated) 32 bytes
SHA-256: 9d980f804cc8d1f54190535d39a135bc15acf9c58ea6bec03bb6e58760ba470c
icc_00_off0001676b.icc pdf-icc-profile PDF ICC profile at offset 0x1676B 408 bytes
SHA-256: 653b586c4707574ffcd648ba35494daed2c76ceafcf4c07d315ed961b1dc347f
icc_01_off000168c8.icc pdf-icc-profile PDF ICC profile at offset 0x168C8 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e

Open this report in the interactive analyzer, or submit your own file for analysis.