Malicious PDF — malware analysis report

Static analysis result for SHA-256 f73162e08caf9349…

MALICIOUS

PDF

212.5 KB Created: QÁ< 0^§ÊÙþ§ Authoring application: E¨m]OIt_û—ÎÍb©ä5yŸÞpìÁ (via T˜|@DXtJdöˆÖ„X ó40Ş`÷ÓýõóÀ͓â() First seen: 2026-05-11
MD5: cbf783ac98827638d63b45598e7266d7 SHA-1: 4cb71ed2f3635dbb18cff745f989587f47e5380e SHA-256: f73162e08caf934998ee525dff43a74dc34c132a6bc19fd603aeb182169b59ba
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

The PDF file contains embedded JavaScript streams and is encrypted with JavaScript, indicating an attempt to obfuscate its content and hide malicious actions. The presence of a Remote GoTo action further suggests redirection or execution of external content. While the document body is unreadable, the heuristics strongly point to a malicious PDF designed to conceal and execute code, likely for further exploitation.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4778

Heuristics 9

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Remote GoTo action medium PDF_GOTO_REMOTE
    PDF references a remote or embedded document via GoToR/GoToE with an extension-less or unresolved target
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype Referenced by PDF JavaScript
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 21

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0130_000.js pdf-javascript-stream PDF /JS object 130 at offset 0x198BF 48 bytes
SHA-256: c9d3ff2f1e1eaf5a1b9c8e76722aeb35b2093f4d26cc7983905010475cb39437
Preview script
First 1,000 lines of the extracted script
// nix

AFNumber_Format(2, 2, 0, 0, "", false);
javascript_obj0158_003.js pdf-javascript-stream PDF /JS object 158 at offset 0x1ABBF 33 bytes
SHA-256: c4287c5c3e37d48b98ace11b04930d19e8be4d405af6749d7e51f8d70a59029e
Preview script
First 1,000 lines of the extracted script
AFDate_KeystrokeEx("dd.mm.yyyy");
javascript_obj0186_004.js pdf-javascript-stream PDF /JS object 186 at offset 0x1C542 865 bytes
SHA-256: f905788c5cc40567b0e67fab266534b05a701d79c57b6e478c116172b4d750b3
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function zw�lf()
{
var r = /[^\d,]/g;       // nur Zahlen oder : erlaubt
var str = event.value + event.change;
var neu = str.match(eval(r));
if (neu) {
app.alert("Es sind nur ganze Zahlen und Kommas erlaubt");
  event.rc = false;            
}
else{
var ev = event.value;
var svor = ev.substring(0,event.selStart);
var snach = ev.substring(event.selEnd,event.value.length);
sneu = svor+event.change+snach;
var komar = sneu.split(","); 
if(komar.length>2){
app.alert("mehr als ein Komma geht nicht!");
  event.rc = false; 
}

if(komar.length==2){
if(komar[1].length>2){//Nachkommastellen
  event.rc = false;
}
if(komar[0].length>12){//Anzahl vor dem Komma
  event.rc = false;
}
}
if(komar.length==1){            
if(sneu.length>12){//Anzahl vor dem Komma
  event.rc = false;
  app.alert("Es sind nur 12-stellige Zahlen vor dem Komma erlaubt");
}
}
}














}
stream_008_off00008dac.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8DAC 107773 bytes
SHA-256: f8b5634482dabaf0040161953b708d7648a1dc1459beb6e63bf997bafb4818f7
font_00_cff_off0001dd6f.bin pdf-font-stream PDF embedded font (cff) at offset 0x1DD6F 7133 bytes
SHA-256: f8e22a6e8eae4b6e9a5ba3985f3a2a1162096e9152eaffd9f2bf8b43d443b2f2
font_01_cff_off0001f57f.bin pdf-font-stream PDF embedded font (cff) at offset 0x1F57F 1711 bytes
SHA-256: 4f3bb97afabdaf25aa21941d026ce0e1441a5de6bd5172a8b18c9f99f134526e
font_02_cff_off0001fc2d.bin pdf-font-stream PDF embedded font (cff) at offset 0x1FC2D 7902 bytes
SHA-256: c7730caa81be40d096475506f934287a87493b940abeedb882ab47263a383813
font_03_cff_off000217e2.bin pdf-font-stream PDF embedded font (cff) at offset 0x217E2 2836 bytes
SHA-256: 6e6a757d262a8981a3b0c8f134c45dcc474b7542546ac44bd85574ef86e078ee
font_04_sfnt_off000223ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x223AC 5236 bytes
SHA-256: bff5b8eb48da15934885c1d5dac82325fb755639d962a8cacaa54f38cad51f40
javascript_obj0168_001.js pdf-javascript-stream PDF /JS object 168 at offset 0x29C87 33 bytes
SHA-256: 73b6244e37b15102e7d6b1fc284e106dcf54d64e67aec95bbea51416a042933b
Preview script
First 1,000 lines of the extracted script
� �� � �
Ps;��q��� gq��  K�*��cd
javascript_obj0170_003.js pdf-javascript-stream PDF /JS object 170 at offset 0x29D17 33 bytes
SHA-256: 07a1d151dfe765d35de27c7f727dc1efbf0215767189fd3e37c26a6e60b4ed56
Preview script
First 1,000 lines of the extracted script
�Sr��f� (1�xԔ��3|��:T :U E�=4�z
javascript_obj0172_005.js pdf-javascript-stream PDF /JS object 172 at offset 0x29DA8 33 bytes
SHA-256: 1bf3474434a77462603474fc1b5aa94ae3b4c2d989428b756bf8101e697505a9
Preview script
First 1,000 lines of the extracted script
��8!� ��F@�VE0�Q� � �
�,y�u�� �
javascript_obj0174_007.js pdf-javascript-stream PDF /JS object 174 at offset 0x29E38 33 bytes
SHA-256: e84bc6df75206f8f0a102543463431f27d9adabbd4a2e6e275d19b6b21be2519
Preview script
First 1,000 lines of the extracted script
�Z� I�R��%C~�Ճ �W|r����{G�
D��k
javascript_obj0175_008.js pdf-javascript-stream PDF /JS object 175 at offset 0x29E82 48 bytes
SHA-256: 50a21f9867b19ae9e8628f17c4c27bb58645063b342e253ccebe85a2276ce4d7
Preview script
First 1,000 lines of the extracted script
�� ʒ�o�8D A��s����	!� O?�S��88:R!  ��rsU�&C�
javascript_obj0177_010.js pdf-javascript-stream PDF /JS object 177 at offset 0x29F0A 48 bytes
SHA-256: 304afda89abb70f8305467819e92fc422fa765884572ab55fc663018eca856b2
Preview script
First 1,000 lines of the extracted script
���|K�%UL*�U�G�ne ?Z�wI�Ȏ�f 4 �<�-� "�ӊ fR�ױ
javascript_obj0179_012.js pdf-javascript-stream PDF /JS object 179 at offset 0x29F91 48 bytes
SHA-256: 6d3d2b892d0647e6b0da739afae92e412c4cd63cfdac136d99c774499210cf30
Preview script
First 1,000 lines of the extracted script
����l^�A	�F�V� v� U � R�Q� 	"��� &{)
 Ƶh�~��
javascript_obj0181_014.js pdf-javascript-stream PDF /JS object 181 at offset 0x2A01B 48 bytes
SHA-256: 1274cd06282e98c233a777af8b0abd168068846c6bd3490eddebc8ab9bfa1eae
Preview script
First 1,000 lines of the extracted script
-u ���� �e�; 
� >� w��K  �� d��`|�vȭ�k2�L"��L�
javascript_obj0183_016.js pdf-javascript-stream PDF /JS object 183 at offset 0x2A0A3 48 bytes
SHA-256: e410e5f7a077f606c976c672dfaedfd50d714998501f27fee99a8f8d42cc9eb5
Preview script
First 1,000 lines of the extracted script
/[;Ɉ�k?��� ��?��A���c%���e��=U��-RF��;j  �� ~
javascript_obj0185_018.js pdf-javascript-stream PDF /JS object 185 at offset 0x2A12A 48 bytes
SHA-256: 34a2fb9caf89274b038146d9b99b05a3e2d77db16f1d981160f57f7be4614757
Preview script
First 1,000 lines of the extracted script
�����[?X���
P'q=| w� 3A��$� �х  p>s 
�CpZ��[
javascript_obj0187_020.js pdf-javascript-stream PDF /JS object 187 at offset 0x2A1B3 46 bytes
SHA-256: 61589e83afe89748eb6d0255c876d528780ecb288f03ec12084329e76030638b
Preview script
First 1,000 lines of the extracted script
�Uh�4 �� ���Բ�W
@���C�B
n(�D��
9w��~|����7��
javascript_obj0189_022.js pdf-javascript-stream PDF /JS object 189 at offset 0x2A23E 48 bytes
SHA-256: d8feff6cd4212f659111f98a6be2f9d6909f2d38b9bee8268a85edad9499e822
Preview script
First 1,000 lines of the extracted script
{�  !� ��m i�\��� �O!��� �F� �)�k� ��� �y߀dh|

Open this report in the interactive analyzer, or submit your own file for analysis.