Malicious PDF — malware analysis report

Static analysis result for SHA-256 f90315be28a8443d…

MALICIOUS

PDF

64.8 KB Created: æÔAþë)KÍåˆPg{\N Authoring application: ¿”¬ºlZv‘§Ë <#fÁk"XΝ¬¤ã‘3¼±hÑ2 First seen: 2026-05-11
MD5: 9d11d3787c2953287852fe79ecf03f2d SHA-1: 37fcefa9df8592ac9dd42a5e484a6dd1e27b1013 SHA-256: f90315be28a8443dc7fc15b648334b7f1b03f54386419d87bce05900ed34db0d
64 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file is flagged as malicious due to embedded JavaScript actions and an encrypted structure that hides its payload. The presence of multiple JavaScript streams indicates an attempt to execute code upon opening. This pattern is commonly used to download and execute further stages of malware. The obfuscated nature of the PDF and the lack of clear document body text prevent a more specific analysis of the lure.

Machine Learning

  • Nyx PDF Classifier clean score 0.2202

Heuristics 4

  • Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0059_001.js pdf-javascript-stream PDF /JS object 59 at offset 0x4890 55 bytes
SHA-256: 9ccd736feab681797f0b48f5e440201f52e434540070cdb040d418fedde4dd45
Preview script
First 1,000 lines of the extracted script
if (event.value != ""){event.rc = ZeitFormat(event);}
javascript_obj0060_002.js pdf-javascript-stream PDF /JS object 60 at offset 0x48F9 41 bytes
SHA-256: 80dd6053ca8195b2176af206a5917ea2ccb59fc72fe3ebc0d2865ab6fae5eebb
Preview script
First 1,000 lines of the extracted script
if(event.change!=""){ZeitCheck(event);}
javascript_obj0066_004.js pdf-javascript-stream PDF /JS object 66 at offset 0x4C51 38 bytes
SHA-256: fefbea8a61fff6d2a5e8d7c764a407c92249644f8a10b0dec3cfae812883a2b7
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 2, 0, 0, "", true);
javascript_obj0067_005.js pdf-javascript-stream PDF /JS object 67 at offset 0x4CA5 41 bytes
SHA-256: 572a91fc51702643df28955aaeeb86dd1625f4e3544ee1ba29446fcedc17c93d
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 2, 0, 0, "", true);
javascript_obj0069_006.js pdf-javascript-stream PDF /JS object 69 at offset 0x4E77 87 bytes
SHA-256: 7aac36d402801d7be6274c2bd02d21ca0770a642de04703845a70f95632303d9
Preview script
First 1,000 lines of the extracted script
var f = getField("MEAL");
var v = getField("MEALVAL");
v.value = f.value*4.50*(-1);
javascript_obj0074_008.js pdf-javascript-stream PDF /JS object 74 at offset 0x5106 38 bytes
SHA-256: dd4e86ff46931388298d522a0c25afc2a74df361f28fb6ad9f104ffc1f5056c1
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "", true);
javascript_obj0075_009.js pdf-javascript-stream PDF /JS object 75 at offset 0x515A 41 bytes
SHA-256: 6aeb2fc8f6b0dba7b9d76914b437aa0140bcd183b4c2b0d2b66173e7a39a1974
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "", true);
javascript_obj0079_010.js pdf-javascript-stream PDF /JS object 79 at offset 0x538E 52 bytes
SHA-256: 85297b227c0a413c81c3ed3e82000ee8e6466834ae9bd2c3f8de64784d2b0b57
Preview script
First 1,000 lines of the extracted script
var tip = getField("Hinweis");
tip.hidden = true;
javascript_obj0080_011.js pdf-javascript-stream PDF /JS object 80 at offset 0x53F4 73 bytes
SHA-256: a7117a4683ffb669a9dbd6d7e95d0563ce4e860071fbf8b4a05b38916e2b980b
Preview script
First 1,000 lines of the extracted script
var tip = getField("Hinweis");
tip.hidden = false;
tip.print = false;
javascript_obj0088_012.js pdf-javascript-stream PDF /JS object 88 at offset 0x5A95 56 bytes
SHA-256: c273dc2a1188be145daea9eb38ff60ea449e0c6f9f8025b10bd151b39747486c
Preview script
First 1,000 lines of the extracted script
if (event.value != ""){event.rc = DatumFormat(event);}
javascript_obj0089_013.js pdf-javascript-stream PDF /JS object 89 at offset 0x5AFF 42 bytes
SHA-256: 17f4a1a302ecbe9988a2cd5e9edb07555e073b65efd163f3676ebd404adbfbf6
Preview script
First 1,000 lines of the extracted script
if(event.change!=""){DatumCheck(event);}
javascript_obj0153_015.js pdf-javascript-stream PDF /JS object 153 at offset 0x89BA 38 bytes
SHA-256: ff0b1e0798b55aee9e494d4b5046c0d747ee05557796f33002cd8f8168a10b67
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 3, 0, 0, "", true);
javascript_obj0154_016.js pdf-javascript-stream PDF /JS object 154 at offset 0x8A0F 41 bytes
SHA-256: 5b4e1a57bf6476c87a1db4d415eeb42e1477d446a4236b8ae4189d3d8f669dde
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 3, 0, 0, "", true);
javascript_obj0157_017.js pdf-javascript-stream PDF /JS object 157 at offset 0x8C9D 38 bytes
SHA-256: 6f4ebd4f520911136751e3878ad4b37118b4c12f3bcf22c8ada375ca49290802
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 3, 0, 0, "", true);
javascript_obj0158_018.js pdf-javascript-stream PDF /JS object 158 at offset 0x8CF2 41 bytes
SHA-256: 969138dc842bacdbedfeaf4aaf6e3a512fdc0a2d7ed5d6a300c5a280fccb3bd0
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 3, 0, 0, "", true);
javascript_obj0162_020.js pdf-javascript-stream PDF /JS object 162 at offset 0x8FCD 32 bytes
SHA-256: 7f178003088ca15e9ff77cee099e1df317b1d69f74c386719c66e405fbcfff19
Preview script
First 1,000 lines of the extracted script
AFDate_KeystrokeEx("mm/dd/yyyy")
javascript_obj0174_021.js pdf-javascript-stream PDF /JS object 174 at offset 0x9D23 222 bytes
SHA-256: 94b93029ff9108120e90a7c105911716f881cb2dbc6ff6862915d9ceabd21a38
Preview script
First 1,000 lines of the extracted script
var f = this.getField("Abreise_am"); 
if (f.value + "" == "") f.value = util.printd("dd.mm.yyyy", new Date())
var f = this.getField("Rueck_am"); 
if (f.value + "" == "") f.value = util.printd("dd.mm.yyyy", new Date())
javascript_obj0175_022.js pdf-javascript-stream PDF /JS object 175 at offset 0x9E46 136 bytes
SHA-256: 5c016a8ad1b06d819b1b87035deff24df51ac2ea1c2328eb18a8084f48736ea5
Preview script
First 1,000 lines of the extracted script
function ToDot(Zahl)
{
	var t = Zahl.value+"";
	var s = t.replace(/,/, ".");

//console.println("s: " + s);

	return  (s*1);
}
javascript_obj0200_023.js pdf-javascript-stream PDF /JS object 200 at offset 0xDFF9 89 bytes
SHA-256: 426f9b5804559434042e49b33aadde0ed4b441f198e76fad3c729ffde6e111c2
Preview script
First 1,000 lines of the extracted script
var KM = getField("KM");
var Miles = getField("KMGELD");
Miles.value = KM.value*0.30;
javascript_obj0204_024.js pdf-javascript-stream PDF /JS object 204 at offset 0xE2B2 428 bytes
SHA-256: e88f5a3df4ba60b9a0982a3f1e6a0cead94cbfb6bf9ed9ca018397b5dc6ae3a6
Preview script
First 1,000 lines of the extracted script
var f = getField("UEBER"); 
var g = getField("WERT_U"); 
var a = getField("ANZ_U");
var r = getField("SUMME_U");

// Essen: 4,50 Tagespauschale
if (f.value > 0)
{
	g.value = a.value*4.50;
	r.value = f.value - g.value;
}
else
{
	
if (a.value>0) al = app.alert("Anzahl �bernachtungen:\nOhne �bernachtungskosten macht dieser Eintrag keinen Sinn und wird gel�scht.",0,0);	
	a.value=0;
	g.value=0;
	r.value=0;
}
javascript_obj0213_025.js pdf-javascript-stream PDF /JS object 213 at offset 0xF0C0 349 bytes
SHA-256: 25cb1e10e414e8b5e73c4bc16dc21bd40231f693c4c935c6fb2edb882818d634
Preview script
First 1,000 lines of the extracted script
function DatumCheck(Datum)
{
 var laenge = Datum.value.length;
 var anders = event.change;

	if (anders < "0" || anders > "9")  // keine Zahl?
	{
	 if (anders != "." && anders != "," && anders != "-" && anders != "/" && anders != "+") 
	 	{
	   	app.beep(0);
   		Datum.rc = false;
  		}
	else
		{
			event.change = ".";
		}
 	}
}
javascript_obj0214_026.js pdf-javascript-stream PDF /JS object 214 at offset 0xF1D4 973 bytes
SHA-256: 9be97147e3771eec8271b9ab68e83161fb310efd07c61b971cac6cca31b21714
Preview script
First 1,000 lines of the extracted script
function DatumFormat(Datum)
{
	fstr = Datum.value;
	var CalcDat = Datum.value.split(".");

	switch(CalcDat.length)
	{
	case 0:
		CalcDat.push(util.printd("tt",new Date()));
	case 1:
		CalcDat.push(util.printd("mm",new Date()));
	case 2:
		CalcDat.push(util.printd("yyyy",new Date()));
	}

	var a = CalcDat[0];
	var b = CalcDat[1];
	var c = CalcDat[2];

	if(c=="0" || c=="00") c = "2000";

	var tag = a*1;
	var monat = b*1;
	var jahr = c*1;

	if (jahr>50 && jahr<100)	{	jahr += 1900	} //zweistellige Jahreszahl 
	if (jahr<50){	jahr += 2000;}

	Datum.value = (tag<10?"0"+tag:tag) + "." + (monat<10?"0"+monat:monat) + "." + jahr;

   var testit = util.scand("dd.mm.yyyy", Datum.value)+"";
	if (testit=="null")
	{
		if (Datum.value = "00."+util.printd("mm.yyyy",new Date()))
		{
			Datum.value = util.printd("dd.mm.yyyy", new Date());
			app.beep(1);
			console.println("Ung�ltiges Datum!\n\nErsetzt durch: " + Datum.value);
		}
	}
}
javascript_obj0215_027.js pdf-javascript-stream PDF /JS object 215 at offset 0xF3E6 348 bytes
SHA-256: 53ebae40fbcc1e2716e9795f734c35d5a27b3919a417b4722949a2c180f8d3fa
Preview script
First 1,000 lines of the extracted script
function ZeitCheck(Zeit)
{
 var laenge = Zeit.value.length;
 var anders = event.change;

	if (anders < "0" || anders > "9")  // keine Zahl?
	{
	 if (anders != "." && anders != "," && anders != ":" && anders != "-" && anders != "/") 
	 	{	   	
			app.beep(0);
   		Zeit.rc = false;
  		}
	else
		{
			event.change = ":";
		}
 	}
}
javascript_obj0216_028.js pdf-javascript-stream PDF /JS object 216 at offset 0xF4FB 597 bytes
SHA-256: 88724ec6e7ee8594f2470dd9c48c1d073344e6182e27e47982e48508af0472b2
Preview script
First 1,000 lines of the extracted script
function ZeitFormat(Zeit)
{
 fstr = Zeit.value;
 if (fstr.value != "#FEHLER#")
 {
   var erster = fstr.indexOf(":",0);  
	if (erster != -1)
	{
		var a = fstr.substring(0,erster);
		var b = fstr.substring(erster+1);
	}
	else
	{
		var a = fstr.substring(0,2);
		var b = fstr.substring(3,5);
	}
	
	var stunde = a*1;
	var minute = b*1;
	
	Zeit.value = (stunde<10?"0"+stunde:stunde+"") + ":" + (minute<10?"0"+minute:minute+"");

 	if ((stunde>23) || (minute>59))
	{
		app.alert("Ung�ltige Zeit - bitte pr�fen!!");
		Zeit.value = "#FEHLER#"
	}
	
 }	// keine Fehlerstring
}
javascript_obj0217_029.js pdf-javascript-stream PDF /JS object 217 at offset 0xF684 2667 bytes
SHA-256: 07456313629881513613c2550a8e374ce98a14ce39fb67ec93de9300c83fa2c8
Preview script
First 1,000 lines of the extracted script
function dauer()
{
	var tag_los = getField("Abreise_am");
	var tag_hom = getField("Rueck_am");
	var zeit_los = getField("Abreise_um");
	var zeit_hom = getField("Rueck_um");
	var jahr = tag_los.value.substring(6);
	var mon  = tag_los.value.substring(3,5)-1;
	var tag  = tag_los.value.substring(0,2);
	var std  = zeit_los.value.substring(0,2);
	var min  = zeit_los.value.substring(3,5);
	var a_tag = new Date(jahr,mon,tag,std,min,0);
	var a_comp = new Date(jahr,mon,tag);
	var a_diff = new Date(jahr,mon,tag,23,59,59);

	jahr = tag_hom.value.substring(6);
	mon  = tag_hom.value.substring(3,5)-1;
	tag  = tag_hom.value.substring(0,2);
	std  = zeit_hom.value.substring(0,2);
	min  = zeit_hom.value.substring(3,5);
	
	var z_tag = new Date(jahr,mon,tag,std,min,0);
	var z_comp = new Date(jahr,mon,tag);
	var z_diff = new Date(jahr,mon,tag,0,0,0);

	var tag_diff = 0;
	var T10 = getField("T10");
	var T14 = getField("T14");
	var T24 = getField("T24");

	T10.value = 0;
	T14.value = 0;
	T24.value = 0;

	if(a_comp.valueOf()==z_comp.valueOf()) //Tagereise
		{
			
//console.println ("Tagereise: (" + a_comp.valueOf() + " Seriennummer des Tages)");

			tag_diff = (z_tag.valueOf() - a_tag.valueOf())/1000/60/60;
			if(tag_diff>8 && tag_diff<=14) T10.value = T10.value + 1;
			if(tag_diff>14) T14.value = T14.value + 1;
			if(tag_diff<0){zeit_hom.value = zeit_los.value};		

//console.println("Dauer: " + tag_diff + " h");			
		}
	else
// Mehrt�gig
		{
			var tag_e = (a_diff.valueOf() - a_tag.valueOf())/1000/60/60;
			if(tag_e>8 && tag_e<=14) 
                            {T10.value = T10.value + 1;}
                        else if (tag_e>14) 
                            {T14.value = T14.value + 1;}

			var tag_l = (z_tag.valueOf() - z_diff.valueOf())/1000/60/60;

			if(tag_l>8 && tag_l<=14) 
                            {T10.value = T10.value + 1;}
			else if(tag_l>14) 
                            {T14.value = T14.value + 1;}

			tag_diff = ((z_tag.valueOf()- a_tag.valueOf()-(z_tag.valueOf() - z_diff.valueOf())-(a_diff.valueOf() - a_tag.valueOf()))/1000/60/60/24);

			T24.value=Math.round(tag_diff);// - (tag_diff % 1);
			if(tag_diff<0) 
				{
					tag_hom.value = tag_los.value;
					T24.value = 0;
				}
			else
				{
					T24.value = Math.round(tag_diff);
				}

	console.println("Mehrt�gige Reise:");
	console.println("Anfahrtstag: " + tag_e + " h");
	console.println("Abfahrtstag: " + tag_l + " h");
	console.println("Math.  Tage: " + ((z_tag.valueOf()- a_tag.valueOf()-(z_tag.valueOf() - z_diff.valueOf())-(a_diff.valueOf() - a_tag.valueOf()))/1000/60/60/24));
		}
	


}
javascript_obj0218_030.js pdf-javascript-stream PDF /JS object 218 at offset 0xF980 712 bytes
SHA-256: 4761fdb46819498363e66b75b07b4e23363b1d8203d0fc4e8dbde402ad89eeec
Preview script
First 1,000 lines of the extracted script
function recalc()
{
var Train=getField("Eisenbahn_DM");
var Miles = getField("KMGELD");
var Zubringer=getField("Zubringer_DM");
var Unterbringung=getField("SUMME_U");
var Tagegeld=getField("TGELD");
var Essen=getField("MEALVAL");
var Div1=getField("SONST1");
var Div2=getField("SONST2");
var resultat=getField("TOTAL");

resultat.value = 0;
resultat.value += ToDot(Train);
resultat.value += ToDot(Miles);
resultat.value += ToDot(Zubringer);
resultat.value += ToDot(Unterbringung);
resultat.value += ToDot(Tagegeld);
resultat.value += ToDot(Essen);
resultat.value += ToDot(Div1);
resultat.value += ToDot(Div2);

if (resultat.value < 0.01) 
   {
    resultat.value = -0.00;
   }
}
javascript_obj0219_031.js pdf-javascript-stream PDF /JS object 219 at offset 0xFAD3 403 bytes
SHA-256: 381b5791c3da855858d5aa56941dd252319bc159f53e15a55798307ba79b1dc3
Preview script
First 1,000 lines of the extracted script
function tagegeld()
{
var t24 = getField("T24");
var t14 = getField("T14");
var t10 = getField("T10");
var s10=getField("S10");
var s14=getField("S14");
var s24=getField("S24");
var TGELD=getField("TGELD");

// 24h : 24 �, >14h : 12 �, > 8 h: 6�
s24.value = t24.value*24.00;
s14.value = t14.value*12.00;
s10.value = t10.value*6.00;

TGELD.value = s10.value + s14.value + s24.value;

}
javascript_obj0025_000.js pdf-javascript-stream PDF /JS object 25 at offset 0x18AB 222 bytes
SHA-256: 47c3edc7d1e9495adcf85ee757d5c7a12cef4a65d51e19808ae5ccc8d6a5b6d8
Preview script
First 1,000 lines of the extracted script
*  W��X ��7�]?���  �k�:�a���
��[����HY l���  X� ,N�,�Ս� ���o##��3��~��`^��ɅX!��B` �� tI :�>� #|��G N ��H����`�X���G�
���x06���]B� �x ܝ��_ �� U'�E�f��%�?wبA ���?4_�+J�A��z�� ؘ-% ��� T lJd��M� ��� P�V��䜲5E� �  �
javascript_obj0026_001.js pdf-javascript-stream PDF /JS object 26 at offset 0x19B1 136 bytes
SHA-256: 8f72fd0af4ec5b0402f7c2fc3b347861b2a7320437864b9293fa82d9186becf3
Preview script
First 1,000 lines of the extracted script
ŋ  ���$��	q�d  g�!�QFK!����ZV
 � �Ԅ�n��H ��InEf�CὗCl� V �����,>	�
>�� �"�$cl ��5q�S�U H����$��  �A�i��ɽ�� +  ־d �
ɍ�  �=,t�hw
O �
javascript_obj0155_003.js pdf-javascript-stream PDF /JS object 155 at offset 0xD60B 38 bytes
SHA-256: 9171b352f327754bf28e8a145df6a9f2b12e23bd8592f48b7204cef4140b9a5f
Preview script
First 1,000 lines of the extracted script
x��3 � !�� �� ��  �%ס��*5@ ����Y�{��
javascript_obj0156_004.js pdf-javascript-stream PDF /JS object 156 at offset 0xD658 41 bytes
SHA-256: 3554ca2cc02572e44b9a815ec325e33f017b251c17321d0b57ab4e74134340e5
Preview script
First 1,000 lines of the extracted script
hV̰;%&.le�d�W2=��h����f�� � Ҡ�C9 ����
javascript_obj0157_005.js pdf-javascript-stream PDF /JS object 157 at offset 0xD6A8 87 bytes
SHA-256: 2c86f0989e0fe7e1596b73f0b232311d323001dc84df9492226646d973e5025e
Preview script
First 1,000 lines of the extracted script
�ϕU�`Ҹ{ ��|���޺N j�B<|��d�n��N�z� ֤Ah��b��� �x�ga��X����sC��g��� �� ��(�S)inzQ�ϡ