PDF static analysis report

Static analysis result for SHA-256 f4585abdaf5b50ff…

SUSPICIOUS

PDF

283.7 KB Created: 2007-04-05 11:59:24 -05:00 Authoring application: Adobe PageMaker 7.0 (via Acrobat Distiller 7.0.5 (Windows)) First seen: 2026-05-11
MD5: 9e6dcfe9e3050ee5fa39584fd75b83a8 SHA-1: 6ff53e88b2a09fb3d47a1c27f9934467345ae83b SHA-256: f4585abdaf5b50ffbb3e65b805b864610f188b2444830a27b25c4b7258f04f69
56 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.5717

Heuristics 4

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype Referenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 19

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0171_000.js pdf-javascript-stream PDF /JS object 171 at offset 0xC3A0 39 bytes
SHA-256: 1d03a107e45160304b614e4ae31a0dc575017e5d6e59414bb8916127c3277507
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 0, 0, 0, "", false);
javascript_obj0172_001.js pdf-javascript-stream PDF /JS object 172 at offset 0xC3F1 42 bytes
SHA-256: edc81df06236f4f7f78ad6c2ad7367f010516682b9b95cf24321c54c44a61f34
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 0, 0, 0, "", false);
javascript_obj0218_034.js pdf-javascript-stream PDF /JS object 218 at offset 0x1E79A 117 bytes
SHA-256: e719f0bd5e6a38f0673534fdbe261a48d6224c1678bd57d3a452d4b13ffc206c
Preview script
First 1,000 lines of the extracted script
app.alert("Column F: \r\rEnter the 1-digit reason code that indicates the reason for the credit to be transferred.");
javascript_obj0219_035.js pdf-javascript-stream PDF /JS object 219 at offset 0x1E83B 188 bytes
SHA-256: 175df4894041bb93686e961f6a5ee5130949d2e377662b6b9ff57e3c67a6d0f9
Preview script
First 1,000 lines of the extracted script
app.alert("Column E: \r\rEnter the 2-digit \"Tax Sub Type\" for crude oil tax.\r\r- A purchaser is identified as \"Tax Sub Type\" 36.\r- A producer is identified as \"Tax Sub Type\" 48.");
javascript_obj0220_036.js pdf-javascript-stream PDF /JS object 220 at offset 0x1E92C 105 bytes
SHA-256: 3a9f7d613626fbc5d3cdcd8c8040442659629dd81fd72c5a865d14b5d7d65828
Preview script
First 1,000 lines of the extracted script
app.alert("Column D: \r\rEnter the year/month to which the credit is to be transferred in YYMM format.");
javascript_obj0221_037.js pdf-javascript-stream PDF /JS object 221 at offset 0x1E9C1 188 bytes
SHA-256: b647f6c5a191782c4d86cc48fe8ec3e0fa220133f8c0f3256d691ffd615aebee
Preview script
First 1,000 lines of the extracted script
app.alert("Column B: \r\rEnter the 2-digit \"Tax Sub Type\" for crude oil tax.\r\r- A purchaser is identified as \"Tax Sub Type\" 36.\r- A producer is identified as \"Tax Sub Type\" 48.");
javascript_obj0222_038.js pdf-javascript-stream PDF /JS object 222 at offset 0x1EAB2 136 bytes
SHA-256: 750afb6a6c469706d40c39808824355681e83762dcd1c9d8fb388dd55854d243
Preview script
First 1,000 lines of the extracted script
app.alert("Column C: \r\rEnter the amount of the credit to be transferred. \r\rDo not use credit brackets. \rEnter dollars and cents.");
javascript_obj0223_039.js pdf-javascript-stream PDF /JS object 223 at offset 0x1EB69 107 bytes
SHA-256: 1245211faeb73aa40b4349ef81ca5c01c7f123bcd96ccecea8e91b828b0b4c9b
Preview script
First 1,000 lines of the extracted script
app.alert("Column A: \r\rEnter the year/month from which the credit is to be transferred in YYMM format.");
javascript_obj0051_040.js pdf-javascript-stream PDF /JS object 51 at offset 0x1803 337 bytes
SHA-256: e227db915207dab0c838cc7a0295d86f17302b3aec348be57e755d7828115001
Preview script
First 1,000 lines of the extracted script
function SubType(ST)
{var Sub = this.getField(ST).valueAsString;
if (Sub != "36" && Sub != "48" && Sub != ""){app.alert("Only the following TAX SUB TYPES are valid on this form: \r\r                    36 - Crude Oil Purchaser or \r                    48 - Crude Oil Producer.", 1, 0);
this.getField(event.target.name).setFocus();}
}
javascript_obj0052_041.js pdf-javascript-stream PDF /JS object 52 at offset 0x1933 519 bytes
SHA-256: 72c6c62a3583b5840da8dd11b4e16fdff52f85f7313d695f881486366a06d378
Preview script
First 1,000 lines of the extracted script
function Reason(RC)
{var Code = this.getField(RC).valueAsString;
if (Code != "2" && Code != "4" && Code != "5" && Code != "6" && Code != "7" && Code != ""){app.alert("In COLUMN F, only the following REASON CODES are valid: \r\r                       2 - LEGISLATIVE EXEMPTION, \r                       4 - OVERPAID TAX, \r                       5 - VALUE REDUCTION, \r                       6 - CREDIT INTEREST, or \r                       7 - TRUCKING COSTS.", 1, 0); this.getField(event.target.name).setFocus();}
}
javascript_obj0210_042.js pdf-javascript-stream PDF /JS object 210 at offset 0xCD45 582 bytes
SHA-256: 9642e2be91e8515c2844179a25381925458b17a5ee8efccc05946e92bba7df13
Preview script
First 1,000 lines of the extracted script
var c1 = this.getField("Item.1c").value;
var c2 = this.getField("Item.2c").value;
var c3 = this.getField("Item.3c").value;
var c4 = this.getField("Item.4c").value;
var c5 = this.getField("Item.5c").value;
var c6 = this.getField("Item.6c").value;
var c7 = this.getField("Item.7c").value;
var c8 = this.getField("Item.8c").value;
var c9 = this.getField("Item.9c").value;
var c10 = this.getField("Item.10c").value;
var cSum = c1 + c2 + c3 + c4 + c5 + c6 + c7 + c8 + c9 + c10;
if (cSum > 0){this.getField("Item.11").value = cSum;}
else {this.getField("Item.11").value = "";}
javascript_obj0212_043.js pdf-javascript-stream PDF /JS object 212 at offset 0xCE6E 2254 bytes
SHA-256: 55c850c607378a11f82dafdcfc30c4f34c69a19db9b897c56115f51a52d6125a
Preview script
First 1,000 lines of the extracted script
var TYPED = this.getField("Item.c").valueAsString;
var t0 = TYPED.substr(0,1);
var t1 = TYPED.substr(1,1);
var t2 = TYPED.substr(2,1);
var t3 = TYPED.substr(3,1);
var t4 = TYPED.substr(4,1);
var t5 = TYPED.substr(5,1);
var t6 = TYPED.substr(6,1);
var t7 = TYPED.substr(7,1);
var t8 = TYPED.substr(8,1);
var t9 = TYPED.substr(9,1);
var t10 = TYPED.substr(10,1);
var t11 = TYPED.substr(11,1);
var t12 = TYPED.substr(12,1);
var t13 = TYPED.substr(13,1);
if (t0 >= 0 && t0 <= 9){var r0 = t0;} else{var r0 = "";}
if (t1 >= 0 && t1 <= 9){var r1 = t1;} else{var r1 = "";}
if (t2 >= 0 && t2 <= 9){var r2 = t2;} else{var r2 = "";}
if (t3 >= 0 && t3 <= 9){var r3 = t3;} else{var r3 = "";}
if (t4 >= 0 && t4 <= 9){var r4 = t4;} else{var r4 = "";}
if (t5 >= 0 && t5 <= 9){var r5 = t5;} else{var r5 = "";}
if (t6 >= 0 && t6 <= 9){var r6 = t6;} else{var r6 = "";}
if (t7 >= 0 && t7 <= 9){var r7 = t7;} else{var r7 = "";}
if (t8 >= 0 && t8 <= 9){var r8 = t8;} else{var r8 = "";}
if (t9 >= 0 && t9 <= 9){var r9 = t9;} else{var r9 = "";}
if (t10 >= 0 && t10 <= 9){var r10 = t10;} else{var r10 = "";}
if (t11 >= 0 && t11 <= 9){var r11 = t11;} else{var r11 = "";}
if (t12 >= 0 && t12 <= 9){var r12 = t12;} else{var r12 = "";}
if (t13 >= 0 && t13 <= 9){var r13 = t13;} else{var r13 = "";}

var TPN = r0 + r1 + r2 + r3 + r4 + r5 + r6 + r7 + r8 + r9 + r10 + r11 + r12 + r13;
var DIGITS = " " + (TPN.substr(0,1) * 1) + (TPN.substr(1,1) * 2) + (TPN.substr(2,1) * 1) + (TPN.substr(3,1) * 2) + (TPN.substr(4,1) * 1) + (TPN.substr(5,1) * 2) + (TPN.substr(6,1) * 1) + (TPN.substr(7,1) * 2) + (TPN.substr(8,1) * 1) + (TPN.substr(9,1) * 2) + (TPN.substr(10,1) * 1);

var MOD = ((1 * DIGITS.substr(1,1)) + (1 * DIGITS.substr(2,1)) + (1 * DIGITS.substr(3,1)) + (1 * DIGITS.substr(4,1)) + (1 * DIGITS.substr(5,1)) + (1 * DIGITS.substr(6,1)) + (1 * DIGITS.substr(7,1)) + (1 * DIGITS.substr(8,1)) + (1 * DIGITS.substr(9,1)) + (1 * DIGITS.substr(10,1)) + (1 * DIGITS.substr(11,1)) + (1 * DIGITS.substr(12,1)) + (1 * DIGITS.substr(13,1)) + (1 * DIGITS.substr(14,1)) + (1 * DIGITS.substr(15,1)) + (1 * DIGITS.substr(16,1))) % 10;

if (MOD != "0"){app.alert("You have entered an invalid taxpayer number", 1, 0);
this.getField(event.target.name).setFocus();}
javascript_obj0215_044.js pdf-javascript-stream PDF /JS object 215 at offset 0xD162 992 bytes
SHA-256: 6ea9534db391dd2fc1e8b10759b25778223a0091d552b1cc4434b41fc7e78b46
Preview script
First 1,000 lines of the extracted script
var acid = this.getField("ACID").value;
var a0 = (1 * acid.substr(0,1));
var a1 = (1 * acid.substr(1,1));
var a2 = (1 * acid.substr(2,1));
var a3 = (1 * acid.substr(3,1));
var a4 = (1 * acid.substr(4,3));
if (a0 >= 1 && a0 <= 9) {this.getField("Item.e").display = display.hidden; 
this.getField("Item.f").display = display.hidden;}
else if (a1 >= 1 && a1 <= 9) {this.getField("Item.e").display = display.hidden; 
this.getField("Item.f").display = display.hidden;}
else if (a2 >= 1 && a2 <= 9) {this.getField("Item.e").display = display.hidden; 
this.getField("Item.f").display = display.hidden;}
else if (a3 >= 1 && a3 <= 9) {this.getField("Item.e").display = display.hidden; 
this.getField("Item.f").display = display.hidden;}
else if (a4 >= 100 && a4 <= 999) {this.getField("Item.e").display = display.visible; 
this.getField("Item.f").display = display.visible;}
else {this.getField("Item.e").display = display.hidden; 
this.getField("Item.f").display = display.hidden;}
stream_021_off0000d2c6.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD2C6 78115 bytes
SHA-256: 30696640643b0edec5a1a3420cc17bf8a33bd99eac46cd0eb07ec3eb10f96176
stream_034_off0003ba89.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3BA89 71553 bytes
SHA-256: 290c44edf5934d6e58c31e84f54cf1540ea73c78af963d01237050bda8225c90
font_00_sfnt_off00023e58.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x23E58 41485 bytes
SHA-256: f86daab68aad393622f7b1525193c0017863c889ec4f6de933375f9d04e9eb29
font_01_sfnt_off00029555.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x29555 54212 bytes
SHA-256: 9e6632f0705802ab0e8ce4fb57dddac722d6ce5d290f57e639224138a58827ec
font_02_sfnt_off0002ec69.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2EC69 43993 bytes
SHA-256: 6ab19befec328852d7e19fc113fbd3eb5529aad97ae023160804b45c5e3ca32e
font_03_sfnt_off00034b79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x34B79 45153 bytes
SHA-256: 2722a75fbb3814684a70117c7987156d3c5cd09a0714203c103670e3e1ac0384

Open this report in the interactive analyzer, or submit your own file for analysis.