Malicious PDF — malware analysis report

Static analysis result for SHA-256 f320a7188330b579…

MALICIOUS

PDF

790.6 KB Created: 2004-10-08 13:23:41 -05:00 Authoring application: UltraForms SDK (v2.0.2) (via www.ultraforms.com) First seen: 2026-05-07
MD5: 1bac92a7e22f4adb7885581fad1938df SHA-1: 8d48740a43a3c2ccd424b1a0c03e4a40b3f164de SHA-256: f320a7188330b579328d0c8006a1f60e91f68c0953fd4e3a195586413acb1007
176 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

This PDF contains numerous embedded JavaScript streams, with several triggering high-severity heuristics for eval() calls and ML classification as malicious. The presence of JavaScript actions and streams, combined with the high stream count and eval() usage, strongly suggests the execution of obfuscated code. The ML classifier's output further supports a malicious classification. No specific URLs or file hashes were extracted, limiting the ability to identify the exact payload or family.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5718

Heuristics 6

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    function UFaOOOOxx(){var a = ufga0x00x0;var s = 0;var q = UFG_q;var axx0000=(ufga000x0x+2)*8;var a0x0x00=0;var ax00x00 =0;var a00xxxx=99999;var ax000xx =99999;var ufxxOOOOb = true;var ax0x000 = 17;var W = 0;var H = 2;var x = 0;var y = (ufga0000xx*H);var a00xx00= UFG_a00xx00Res;if(UFG_a00xx00Res<(ufga0000xx*H)+H){a00xx00=(ufga0000xx*H)+H};var ufxOOOOxa = ((ufga000x0x+4)*17) + 2;var ufOxOOOxa = (ufga0000xx*H)+H;var a000xxx = "";var a0xx000= new Array();var a000xxxa = "";var txt1 = 0;var txt2 = axx …
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text
    • http://ns.adobe.com/exif/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/g/img/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj1912_000.js pdf-javascript-stream PDF /JS object 1912 at offset 0x5721 96 bytes
SHA-256: 72a67344d1b6b395570402b3c246229b0f48b4c3192ce9a317016a17178031c5
Preview script
First 1,000 lines of the extracted script
function UF_Validate(){
var result = UF_Required()	
return result
}
javascript_obj2181_003.js pdf-javascript-stream PDF /JS object 2181 at offset 0x3FDEA 42 bytes
SHA-256: a96fca058db56283c68e4d5bf34073bd79e36cc2f7becad8c19b1d749472bd24
Preview script
First 1,000 lines of the extracted script
event.value = GPF(event.value,6)
javascript_obj2183_005.js pdf-javascript-stream PDF /JS object 2183 at offset 0x3FE8A 38 bytes
SHA-256: ae95d6581723cae0c2c1e3044a60f6c91e032264799b53449cd6269e6993d7bc
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 0, 0, 0, "", true);
javascript_obj2184_006.js pdf-javascript-stream PDF /JS object 2184 at offset 0x3FEDA 41 bytes
SHA-256: 617ef4da07d9bc9d4e06a2320fe0d4cbacd3d6c2cc82039cf4e79e7facf7545f
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 0, 0, 0, "", true);
javascript_obj2201_014.js pdf-javascript-stream PDF /JS object 2201 at offset 0x40376 39 bytes
SHA-256: a38c01daa8a2de78b2151ee01d1c69e81170452d881008dd1b45953b3c94a808
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 0, 0, 0, "", false);
javascript_obj2203_015.js pdf-javascript-stream PDF /JS object 2203 at offset 0x403F6 42 bytes
SHA-256: bf6e5cec6b360b670b6bd2c73336d76c35e5f2336d421386785389d70cf8237a
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 0, 0, 0, "", false);
javascript_obj2217_018.js pdf-javascript-stream PDF /JS object 2217 at offset 0x40B4B 39 bytes
SHA-256: 3328eab8501405fcffcc95bb30fbb8bcb963b88928e4a40bd4be3a45d3e80107
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 2, 0, 0, "", false);
javascript_obj2219_019.js pdf-javascript-stream PDF /JS object 2219 at offset 0x40BD2 42 bytes
SHA-256: 1829f93c988f1bfcd4bf6a74fc06fa5705171ae9bf3ac877b13813c6b492c742
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 2, 0, 0, "", false);
javascript_obj2238_020.js pdf-javascript-stream PDF /JS object 2238 at offset 0x410E2 46 bytes
SHA-256: 094f9bd7196d381d9d9da41ae00a1960b056db1adab2c4cad456dc80e6493aa9
Preview script
First 1,000 lines of the extracted script
event.change = GPF(event.change,3)
javascript_obj2242_022.js pdf-javascript-stream PDF /JS object 2242 at offset 0x411FE 38 bytes
SHA-256: 7ecc3e3cb1163cdbe01231107ee5983df92e13911d468ed0c735c44bb980de6f
Preview script
First 1,000 lines of the extracted script
event.value = GPF(event.value,6)
javascript_obj2251_024.js pdf-javascript-stream PDF /JS object 2251 at offset 0x4145C 36 bytes
SHA-256: 006e280fcc63964d49bbe21a395d4fe08282796d47a55ce7b03b040db35820e2
Preview script
First 1,000 lines of the extracted script
event.value = GPF(event.value,6)
javascript_obj2265_025.js pdf-javascript-stream PDF /JS object 2265 at offset 0x417E8 255 bytes
SHA-256: 79b9b3b840ce58024a1aaaeacf5312f4d88eef476ec5a7692172fb62b0f0b69f
Preview script
First 1,000 lines of the extracted script
if(GV("SPSSN")!="" && GV("SSN")!= ""){
	if(GV("SPSSN")==GV("SSN")){
		app.alert("Your SSN and your spouse's SSN may NOT be the same. Please verify yours is correct and re-enter your spouse's SSN")
		SV("SPSSN", "")
		SF("SPSSN")
	}
}

SN()
javascript_obj2266_026.js pdf-javascript-stream PDF /JS object 2266 at offset 0x4193D 38 bytes
SHA-256: b45917730170d966e2727500fcec39c1f2827921e9bccf2db1009a0b2ce8ad10
Preview script
First 1,000 lines of the extracted script
event.change = GPF(event.change,3)
javascript_obj2296_027.js pdf-javascript-stream PDF /JS object 2296 at offset 0x4225E 65 bytes
SHA-256: 3e2da4e9bf4864a118727a1384aa1f47b7763a34f28318b5f40545a9896053d6
Preview script
First 1,000 lines of the extracted script
if(app.viewerVersion>4.0) getField("ELINE1").setFocus()
javascript_obj2298_028.js pdf-javascript-stream PDF /JS object 2298 at offset 0x4231A 65 bytes
SHA-256: d58fdc3ea9ab57d69349fcd06442493cef7e6b03d1918f44316d35b85fbb1bf2
Preview script
First 1,000 lines of the extracted script
if(app.viewerVersion>4.0) getField("DLINE1").setFocus()
javascript_obj2300_029.js pdf-javascript-stream PDF /JS object 2300 at offset 0x423CF 59 bytes
SHA-256: 55fc45c8c56075c4a28422683b96ce088d3ba3194172acfa54a027d0d2fecf4a
Preview script
First 1,000 lines of the extracted script
if(app.viewerVersion>4.0) getField("CLINE1").setFocus()
javascript_obj2302_030.js pdf-javascript-stream PDF /JS object 2302 at offset 0x42478 59 bytes
SHA-256: 09eef5cddea81a667309d87e55c29b2da2ba8f8eb161b75c50387cbcb9e497f3
Preview script
First 1,000 lines of the extracted script
if(app.viewerVersion>4.0) getField("BLINE1").setFocus()
javascript_obj2306_031.js pdf-javascript-stream PDF /JS object 2306 at offset 0x426BE 65 bytes
SHA-256: 5c32b9bf0f34030031a8a841b68a515c6695029bee496078d61c025fc8633491
Preview script
First 1,000 lines of the extracted script
if(app.viewerVersion>4.0) getField("ALINE1").setFocus()
javascript_obj2311_034.js pdf-javascript-stream PDF /JS object 2311 at offset 0x42842 153 bytes
SHA-256: a9bf44866021eb4810c964f1a2149a6251c6e4ce2d51b1a645f7bc671de0a1ee
Preview script
First 1,000 lines of the extracted script
if(event.target.value!="Off")getField("SCHKOVER65").value = "X"
else{
	if(getField("CHKYOU65").value=="Off")getField("SCHKOVER65").value = "Off"
}
javascript_obj2314_035.js pdf-javascript-stream PDF /JS object 2314 at offset 0x42983 156 bytes
SHA-256: 75e6058349f6513f9b377af038a0a9c5b612424534a150fe000a148aa2aa445b
Preview script
First 1,000 lines of the extracted script
if(event.target.value!="Off")getField("SCHKOVER65").value = "X"
else{
	if(getField("CHKSP65").value=="Off")getField("SCHKOVER65").value = "Off"
}
javascript_obj2334_038.js pdf-javascript-stream PDF /JS object 2334 at offset 0x42EFC 54 bytes
SHA-256: 812b02f6ce60edd57d85e2547e6545096d50c9a3d33d3c755f370a7ac9730263
Preview script
First 1,000 lines of the extracted script
MultiCB_01(event.target.name,event.target.value)
javascript_obj2337_039.js pdf-javascript-stream PDF /JS object 2337 at offset 0x42FCE 62 bytes
SHA-256: 2fb38f55912a1ae89f04fe1254c56222ac715235f2265fe26bec9747f68342d2
Preview script
First 1,000 lines of the extracted script
MultiCB_01(event.target.name,event.target.value)
javascript_obj2343_040.js pdf-javascript-stream PDF /JS object 2343 at offset 0x43182 66 bytes
SHA-256: a4be0a89271ca5207f61e3beb896ae4fb1f8f98856b7a63aea508e3b60cea0c7
Preview script
First 1,000 lines of the extracted script
MultiCB_01(event.target.name,event.target.value)
javascript_obj0076_042.js pdf-javascript-stream PDF /JS object 76 at offset 0x7BB67 54 bytes
SHA-256: c70b2b9d2231f05d0d1bb476c87868b2ff6c1ecaa7f0dbf0f4e18eb3a57604fd
Preview script
First 1,000 lines of the extracted script
SV("CHK37_2","Off")
SV("CHK37_OTHER","Off")
javascript_obj0079_043.js pdf-javascript-stream PDF /JS object 79 at offset 0x7BC3B 217 bytes
SHA-256: 4338b2c56c2f0889c576742a0841a925da0262a003dc269a0219f9ffe6509dc1
Preview script
First 1,000 lines of the extracted script
if(GN("LINE26")>200){
	SV("LINE26","")
	app.alert("You have exceeded the $200 limit of accepted Low Income Property Tax Credit.\rPlease enter the value on Line 26 again.\r\rThank you.")
	SF("LINE26")
}
SN()
javascript_obj0098_046.js pdf-javascript-stream PDF /JS object 98 at offset 0x7C436 50 bytes
SHA-256: 9ab3ff814d68f4c8b2c650dbda3d88296f92bcd7add8b5954698a79269264b7b
Preview script
First 1,000 lines of the extracted script
SV("CHK36_2","Off")
SV("CHK36_5","Off")
javascript_obj0103_047.js pdf-javascript-stream PDF /JS object 103 at offset 0x7C590 64 bytes
SHA-256: ab9963b3113e95266d94ae9c0e5e84b929e0bf758813ca9f36e1956200729078
Preview script
First 1,000 lines of the extracted script
if(app.viewerVersion>4.0) getField("SDEPNAME1").setFocus()
javascript_obj0104_048.js pdf-javascript-stream PDF /JS object 104 at offset 0x7C603 224 bytes
SHA-256: eeb4d5702a73114c9d972ed94e900ebf3ed4ed430394ce24c21e2b2ea11a44e9
Preview script
First 1,000 lines of the extracted script
if(GN("LINE28")>270){
	SV("LINE28","")
	app.alert("You have exceeded the allowable limit of accepted Earned Income Credit.\rPlease enter the value on Line 28 again.\r\rThank you.")
	SF("LINE28")
}
SN()
javascript_obj0109_050.js pdf-javascript-stream PDF /JS object 109 at offset 0x7C83F 54 bytes
SHA-256: b25caa2f46c8228a3f893c0730db0bb1f0a3b16d41c3c5809f439bbff159021f
Preview script
First 1,000 lines of the extracted script
SV("CHK36_5","Off")
SV("CHK36_OTHER","Off")
javascript_obj0110_051.js pdf-javascript-stream PDF /JS object 110 at offset 0x7C8AC 32 bytes
SHA-256: f3f44e03b5527709489f088b646efb2c0eb5fc3144eeac95a424565e18192350
Preview script
First 1,000 lines of the extracted script
CheckLength(event.value,9)
javascript_obj0118_052.js pdf-javascript-stream PDF /JS object 118 at offset 0x7CBFC 69 bytes
SHA-256: 978172c44b9564260d45a8fff4481dcbe5aa8cc236acea40fa40052e901ebebe
Preview script
First 1,000 lines of the extracted script
getField("CHKACCSAVINGS").value = "Off"
javascript_obj0121_055.js pdf-javascript-stream PDF /JS object 121 at offset 0x7CD0E 50 bytes
SHA-256: 7eb6e68ba99fd04a3029e1b9b62ad471af69ec1bae89d138655c0df7d687dd48
Preview script
First 1,000 lines of the extracted script
SV("CHK37_2","Off")
SV("CHK37_5","Off")

Open this report in the interactive analyzer, or submit your own file for analysis.