MALICIOUS
64
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1566.001 Spearphishing Attachment
T1204.002 Malicious File
The PDF file is flagged as malicious due to embedded JavaScript actions and an encrypted structure that hides its payload. The presence of multiple JavaScript streams indicates an attempt to execute code upon opening. This pattern is commonly used to download and execute further stages of malware. The obfuscated nature of the PDF and the lack of clear document body text prevent a more specific analysis of the lure.
Machine Learning
- Nyx PDF Classifier clean score 0.2202
Heuristics 4
-
Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JSPDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
-
JavaScript action low 1 related finding PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
AcroForm button with action trigger low PDF_ACROFORM_BUTTONPDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
Extracted artifacts 32
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0059_001.js |
pdf-javascript-stream | PDF /JS object 59 at offset 0x4890 | 55 bytes |
SHA-256: 9ccd736feab681797f0b48f5e440201f52e434540070cdb040d418fedde4dd45 |
|||
Preview scriptFirst 1,000 lines of the extracted script
if (event.value != ""){event.rc = ZeitFormat(event);}
|
|||
javascript_obj0060_002.js |
pdf-javascript-stream | PDF /JS object 60 at offset 0x48F9 | 41 bytes |
SHA-256: 80dd6053ca8195b2176af206a5917ea2ccb59fc72fe3ebc0d2865ab6fae5eebb |
|||
Preview scriptFirst 1,000 lines of the extracted script
if(event.change!=""){ZeitCheck(event);}
|
|||
javascript_obj0066_004.js |
pdf-javascript-stream | PDF /JS object 66 at offset 0x4C51 | 38 bytes |
SHA-256: fefbea8a61fff6d2a5e8d7c764a407c92249644f8a10b0dec3cfae812883a2b7 |
|||
Preview scriptFirst 1,000 lines of the extracted script
AFNumber_Format(0, 2, 0, 0, "", true); |
|||
javascript_obj0067_005.js |
pdf-javascript-stream | PDF /JS object 67 at offset 0x4CA5 | 41 bytes |
SHA-256: 572a91fc51702643df28955aaeeb86dd1625f4e3544ee1ba29446fcedc17c93d |
|||
Preview scriptFirst 1,000 lines of the extracted script
AFNumber_Keystroke(0, 2, 0, 0, "", true); |
|||
javascript_obj0069_006.js |
pdf-javascript-stream | PDF /JS object 69 at offset 0x4E77 | 87 bytes |
SHA-256: 7aac36d402801d7be6274c2bd02d21ca0770a642de04703845a70f95632303d9 |
|||
Preview scriptFirst 1,000 lines of the extracted script
var f = getField("MEAL");
var v = getField("MEALVAL");
v.value = f.value*4.50*(-1);
|
|||
javascript_obj0074_008.js |
pdf-javascript-stream | PDF /JS object 74 at offset 0x5106 | 38 bytes |
SHA-256: dd4e86ff46931388298d522a0c25afc2a74df361f28fb6ad9f104ffc1f5056c1 |
|||
Preview scriptFirst 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "", true); |
|||
javascript_obj0075_009.js |
pdf-javascript-stream | PDF /JS object 75 at offset 0x515A | 41 bytes |
SHA-256: 6aeb2fc8f6b0dba7b9d76914b437aa0140bcd183b4c2b0d2b66173e7a39a1974 |
|||
Preview scriptFirst 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "", true); |
|||
javascript_obj0079_010.js |
pdf-javascript-stream | PDF /JS object 79 at offset 0x538E | 52 bytes |
SHA-256: 85297b227c0a413c81c3ed3e82000ee8e6466834ae9bd2c3f8de64784d2b0b57 |
|||
Preview scriptFirst 1,000 lines of the extracted script
var tip = getField("Hinweis");
tip.hidden = true;
|
|||
javascript_obj0080_011.js |
pdf-javascript-stream | PDF /JS object 80 at offset 0x53F4 | 73 bytes |
SHA-256: a7117a4683ffb669a9dbd6d7e95d0563ce4e860071fbf8b4a05b38916e2b980b |
|||
Preview scriptFirst 1,000 lines of the extracted script
var tip = getField("Hinweis");
tip.hidden = false;
tip.print = false;
|
|||
javascript_obj0088_012.js |
pdf-javascript-stream | PDF /JS object 88 at offset 0x5A95 | 56 bytes |
SHA-256: c273dc2a1188be145daea9eb38ff60ea449e0c6f9f8025b10bd151b39747486c |
|||
Preview scriptFirst 1,000 lines of the extracted script
if (event.value != ""){event.rc = DatumFormat(event);}
|
|||
javascript_obj0089_013.js |
pdf-javascript-stream | PDF /JS object 89 at offset 0x5AFF | 42 bytes |
SHA-256: 17f4a1a302ecbe9988a2cd5e9edb07555e073b65efd163f3676ebd404adbfbf6 |
|||
Preview scriptFirst 1,000 lines of the extracted script
if(event.change!=""){DatumCheck(event);}
|
|||
javascript_obj0153_015.js |
pdf-javascript-stream | PDF /JS object 153 at offset 0x89BA | 38 bytes |
SHA-256: ff0b1e0798b55aee9e494d4b5046c0d747ee05557796f33002cd8f8168a10b67 |
|||
Preview scriptFirst 1,000 lines of the extracted script
AFNumber_Format(0, 3, 0, 0, "", true); |
|||
javascript_obj0154_016.js |
pdf-javascript-stream | PDF /JS object 154 at offset 0x8A0F | 41 bytes |
SHA-256: 5b4e1a57bf6476c87a1db4d415eeb42e1477d446a4236b8ae4189d3d8f669dde |
|||
Preview scriptFirst 1,000 lines of the extracted script
AFNumber_Keystroke(0, 3, 0, 0, "", true); |
|||
javascript_obj0157_017.js |
pdf-javascript-stream | PDF /JS object 157 at offset 0x8C9D | 38 bytes |
SHA-256: 6f4ebd4f520911136751e3878ad4b37118b4c12f3bcf22c8ada375ca49290802 |
|||
Preview scriptFirst 1,000 lines of the extracted script
AFNumber_Format(2, 3, 0, 0, "", true); |
|||
javascript_obj0158_018.js |
pdf-javascript-stream | PDF /JS object 158 at offset 0x8CF2 | 41 bytes |
SHA-256: 969138dc842bacdbedfeaf4aaf6e3a512fdc0a2d7ed5d6a300c5a280fccb3bd0 |
|||
Preview scriptFirst 1,000 lines of the extracted script
AFNumber_Keystroke(2, 3, 0, 0, "", true); |
|||
javascript_obj0162_020.js |
pdf-javascript-stream | PDF /JS object 162 at offset 0x8FCD | 32 bytes |
SHA-256: 7f178003088ca15e9ff77cee099e1df317b1d69f74c386719c66e405fbcfff19 |
|||
Preview scriptFirst 1,000 lines of the extracted script
AFDate_KeystrokeEx("mm/dd/yyyy")
|
|||
javascript_obj0174_021.js |
pdf-javascript-stream | PDF /JS object 174 at offset 0x9D23 | 222 bytes |
SHA-256: 94b93029ff9108120e90a7c105911716f881cb2dbc6ff6862915d9ceabd21a38 |
|||
Preview scriptFirst 1,000 lines of the extracted script
var f = this.getField("Abreise_am");
if (f.value + "" == "") f.value = util.printd("dd.mm.yyyy", new Date())
var f = this.getField("Rueck_am");
if (f.value + "" == "") f.value = util.printd("dd.mm.yyyy", new Date())
|
|||
javascript_obj0175_022.js |
pdf-javascript-stream | PDF /JS object 175 at offset 0x9E46 | 136 bytes |
SHA-256: 5c016a8ad1b06d819b1b87035deff24df51ac2ea1c2328eb18a8084f48736ea5 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function ToDot(Zahl)
{
var t = Zahl.value+"";
var s = t.replace(/,/, ".");
//console.println("s: " + s);
return (s*1);
}
|
|||
javascript_obj0200_023.js |
pdf-javascript-stream | PDF /JS object 200 at offset 0xDFF9 | 89 bytes |
SHA-256: 426f9b5804559434042e49b33aadde0ed4b441f198e76fad3c729ffde6e111c2 |
|||
Preview scriptFirst 1,000 lines of the extracted script
var KM = getField("KM");
var Miles = getField("KMGELD");
Miles.value = KM.value*0.30;
|
|||
javascript_obj0204_024.js |
pdf-javascript-stream | PDF /JS object 204 at offset 0xE2B2 | 428 bytes |
SHA-256: e88f5a3df4ba60b9a0982a3f1e6a0cead94cbfb6bf9ed9ca018397b5dc6ae3a6 |
|||
Preview scriptFirst 1,000 lines of the extracted script
var f = getField("UEBER");
var g = getField("WERT_U");
var a = getField("ANZ_U");
var r = getField("SUMME_U");
// Essen: 4,50 Tagespauschale
if (f.value > 0)
{
g.value = a.value*4.50;
r.value = f.value - g.value;
}
else
{
if (a.value>0) al = app.alert("Anzahl �bernachtungen:\nOhne �bernachtungskosten macht dieser Eintrag keinen Sinn und wird gel�scht.",0,0);
a.value=0;
g.value=0;
r.value=0;
}
|
|||
javascript_obj0213_025.js |
pdf-javascript-stream | PDF /JS object 213 at offset 0xF0C0 | 349 bytes |
SHA-256: 25cb1e10e414e8b5e73c4bc16dc21bd40231f693c4c935c6fb2edb882818d634 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function DatumCheck(Datum)
{
var laenge = Datum.value.length;
var anders = event.change;
if (anders < "0" || anders > "9") // keine Zahl?
{
if (anders != "." && anders != "," && anders != "-" && anders != "/" && anders != "+")
{
app.beep(0);
Datum.rc = false;
}
else
{
event.change = ".";
}
}
}
|
|||
javascript_obj0214_026.js |
pdf-javascript-stream | PDF /JS object 214 at offset 0xF1D4 | 973 bytes |
SHA-256: 9be97147e3771eec8271b9ab68e83161fb310efd07c61b971cac6cca31b21714 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function DatumFormat(Datum)
{
fstr = Datum.value;
var CalcDat = Datum.value.split(".");
switch(CalcDat.length)
{
case 0:
CalcDat.push(util.printd("tt",new Date()));
case 1:
CalcDat.push(util.printd("mm",new Date()));
case 2:
CalcDat.push(util.printd("yyyy",new Date()));
}
var a = CalcDat[0];
var b = CalcDat[1];
var c = CalcDat[2];
if(c=="0" || c=="00") c = "2000";
var tag = a*1;
var monat = b*1;
var jahr = c*1;
if (jahr>50 && jahr<100) { jahr += 1900 } //zweistellige Jahreszahl
if (jahr<50){ jahr += 2000;}
Datum.value = (tag<10?"0"+tag:tag) + "." + (monat<10?"0"+monat:monat) + "." + jahr;
var testit = util.scand("dd.mm.yyyy", Datum.value)+"";
if (testit=="null")
{
if (Datum.value = "00."+util.printd("mm.yyyy",new Date()))
{
Datum.value = util.printd("dd.mm.yyyy", new Date());
app.beep(1);
console.println("Ung�ltiges Datum!\n\nErsetzt durch: " + Datum.value);
}
}
}
|
|||
javascript_obj0215_027.js |
pdf-javascript-stream | PDF /JS object 215 at offset 0xF3E6 | 348 bytes |
SHA-256: 53ebae40fbcc1e2716e9795f734c35d5a27b3919a417b4722949a2c180f8d3fa |
|||
Preview scriptFirst 1,000 lines of the extracted script
function ZeitCheck(Zeit)
{
var laenge = Zeit.value.length;
var anders = event.change;
if (anders < "0" || anders > "9") // keine Zahl?
{
if (anders != "." && anders != "," && anders != ":" && anders != "-" && anders != "/")
{
app.beep(0);
Zeit.rc = false;
}
else
{
event.change = ":";
}
}
}
|
|||
javascript_obj0216_028.js |
pdf-javascript-stream | PDF /JS object 216 at offset 0xF4FB | 597 bytes |
SHA-256: 88724ec6e7ee8594f2470dd9c48c1d073344e6182e27e47982e48508af0472b2 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function ZeitFormat(Zeit)
{
fstr = Zeit.value;
if (fstr.value != "#FEHLER#")
{
var erster = fstr.indexOf(":",0);
if (erster != -1)
{
var a = fstr.substring(0,erster);
var b = fstr.substring(erster+1);
}
else
{
var a = fstr.substring(0,2);
var b = fstr.substring(3,5);
}
var stunde = a*1;
var minute = b*1;
Zeit.value = (stunde<10?"0"+stunde:stunde+"") + ":" + (minute<10?"0"+minute:minute+"");
if ((stunde>23) || (minute>59))
{
app.alert("Ung�ltige Zeit - bitte pr�fen!!");
Zeit.value = "#FEHLER#"
}
} // keine Fehlerstring
}
|
|||
javascript_obj0217_029.js |
pdf-javascript-stream | PDF /JS object 217 at offset 0xF684 | 2667 bytes |
SHA-256: 07456313629881513613c2550a8e374ce98a14ce39fb67ec93de9300c83fa2c8 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function dauer()
{
var tag_los = getField("Abreise_am");
var tag_hom = getField("Rueck_am");
var zeit_los = getField("Abreise_um");
var zeit_hom = getField("Rueck_um");
var jahr = tag_los.value.substring(6);
var mon = tag_los.value.substring(3,5)-1;
var tag = tag_los.value.substring(0,2);
var std = zeit_los.value.substring(0,2);
var min = zeit_los.value.substring(3,5);
var a_tag = new Date(jahr,mon,tag,std,min,0);
var a_comp = new Date(jahr,mon,tag);
var a_diff = new Date(jahr,mon,tag,23,59,59);
jahr = tag_hom.value.substring(6);
mon = tag_hom.value.substring(3,5)-1;
tag = tag_hom.value.substring(0,2);
std = zeit_hom.value.substring(0,2);
min = zeit_hom.value.substring(3,5);
var z_tag = new Date(jahr,mon,tag,std,min,0);
var z_comp = new Date(jahr,mon,tag);
var z_diff = new Date(jahr,mon,tag,0,0,0);
var tag_diff = 0;
var T10 = getField("T10");
var T14 = getField("T14");
var T24 = getField("T24");
T10.value = 0;
T14.value = 0;
T24.value = 0;
if(a_comp.valueOf()==z_comp.valueOf()) //Tagereise
{
//console.println ("Tagereise: (" + a_comp.valueOf() + " Seriennummer des Tages)");
tag_diff = (z_tag.valueOf() - a_tag.valueOf())/1000/60/60;
if(tag_diff>8 && tag_diff<=14) T10.value = T10.value + 1;
if(tag_diff>14) T14.value = T14.value + 1;
if(tag_diff<0){zeit_hom.value = zeit_los.value};
//console.println("Dauer: " + tag_diff + " h");
}
else
// Mehrt�gig
{
var tag_e = (a_diff.valueOf() - a_tag.valueOf())/1000/60/60;
if(tag_e>8 && tag_e<=14)
{T10.value = T10.value + 1;}
else if (tag_e>14)
{T14.value = T14.value + 1;}
var tag_l = (z_tag.valueOf() - z_diff.valueOf())/1000/60/60;
if(tag_l>8 && tag_l<=14)
{T10.value = T10.value + 1;}
else if(tag_l>14)
{T14.value = T14.value + 1;}
tag_diff = ((z_tag.valueOf()- a_tag.valueOf()-(z_tag.valueOf() - z_diff.valueOf())-(a_diff.valueOf() - a_tag.valueOf()))/1000/60/60/24);
T24.value=Math.round(tag_diff);// - (tag_diff % 1);
if(tag_diff<0)
{
tag_hom.value = tag_los.value;
T24.value = 0;
}
else
{
T24.value = Math.round(tag_diff);
}
console.println("Mehrt�gige Reise:");
console.println("Anfahrtstag: " + tag_e + " h");
console.println("Abfahrtstag: " + tag_l + " h");
console.println("Math. Tage: " + ((z_tag.valueOf()- a_tag.valueOf()-(z_tag.valueOf() - z_diff.valueOf())-(a_diff.valueOf() - a_tag.valueOf()))/1000/60/60/24));
}
}
|
|||
javascript_obj0218_030.js |
pdf-javascript-stream | PDF /JS object 218 at offset 0xF980 | 712 bytes |
SHA-256: 4761fdb46819498363e66b75b07b4e23363b1d8203d0fc4e8dbde402ad89eeec |
|||
Preview scriptFirst 1,000 lines of the extracted script
function recalc()
{
var Train=getField("Eisenbahn_DM");
var Miles = getField("KMGELD");
var Zubringer=getField("Zubringer_DM");
var Unterbringung=getField("SUMME_U");
var Tagegeld=getField("TGELD");
var Essen=getField("MEALVAL");
var Div1=getField("SONST1");
var Div2=getField("SONST2");
var resultat=getField("TOTAL");
resultat.value = 0;
resultat.value += ToDot(Train);
resultat.value += ToDot(Miles);
resultat.value += ToDot(Zubringer);
resultat.value += ToDot(Unterbringung);
resultat.value += ToDot(Tagegeld);
resultat.value += ToDot(Essen);
resultat.value += ToDot(Div1);
resultat.value += ToDot(Div2);
if (resultat.value < 0.01)
{
resultat.value = -0.00;
}
}
|
|||
javascript_obj0219_031.js |
pdf-javascript-stream | PDF /JS object 219 at offset 0xFAD3 | 403 bytes |
SHA-256: 381b5791c3da855858d5aa56941dd252319bc159f53e15a55798307ba79b1dc3 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function tagegeld()
{
var t24 = getField("T24");
var t14 = getField("T14");
var t10 = getField("T10");
var s10=getField("S10");
var s14=getField("S14");
var s24=getField("S24");
var TGELD=getField("TGELD");
// 24h : 24 �, >14h : 12 �, > 8 h: 6�
s24.value = t24.value*24.00;
s14.value = t14.value*12.00;
s10.value = t10.value*6.00;
TGELD.value = s10.value + s14.value + s24.value;
}
|
|||
javascript_obj0025_000.js |
pdf-javascript-stream | PDF /JS object 25 at offset 0x18AB | 222 bytes |
SHA-256: 47c3edc7d1e9495adcf85ee757d5c7a12cef4a65d51e19808ae5ccc8d6a5b6d8 |
|||
Preview scriptFirst 1,000 lines of the extracted script
* W��X ��7�]?��� �k�:�a��� ��[����HY l��� X� ,N�,�Ս� ���o##��3��~��`^��ɅX!��B` �� tI :�>� #|��G N ��H����`�X���G� ���x06���]B� �x ܝ��_ �� U'�E�f��%�?wبA ���?4_�+J�A��z�� ؘ-% ��� T lJd��M� ��� P�V��䜲5E� � � |
|||
javascript_obj0026_001.js |
pdf-javascript-stream | PDF /JS object 26 at offset 0x19B1 | 136 bytes |
SHA-256: 8f72fd0af4ec5b0402f7c2fc3b347861b2a7320437864b9293fa82d9186becf3 |
|||
Preview scriptFirst 1,000 lines of the extracted script
ŋ ���$�� q�d g�!�QFK!����ZV � �Ԅ�n��H ��InEf�CὗCl� V �����,> � >�� �"�$cl ��5q�S�U H����$�� �A�i��ɽ�� + ־d � ɍ� �=,t�hw O � |
|||
javascript_obj0155_003.js |
pdf-javascript-stream | PDF /JS object 155 at offset 0xD60B | 38 bytes |
SHA-256: 9171b352f327754bf28e8a145df6a9f2b12e23bd8592f48b7204cef4140b9a5f |
|||
Preview scriptFirst 1,000 lines of the extracted script
x��3 � !�� �� �� �%ס��*5@ ����Y�{��
|
|||
javascript_obj0156_004.js |
pdf-javascript-stream | PDF /JS object 156 at offset 0xD658 | 41 bytes |
SHA-256: 3554ca2cc02572e44b9a815ec325e33f017b251c17321d0b57ab4e74134340e5 |
|||
Preview scriptFirst 1,000 lines of the extracted script
hV̰;%&.le�d�W2=��h����f�� � Ҡ�C9 ���� |
|||
javascript_obj0157_005.js |
pdf-javascript-stream | PDF /JS object 157 at offset 0xD6A8 | 87 bytes |
SHA-256: 2c86f0989e0fe7e1596b73f0b232311d323001dc84df9492226646d973e5025e |
|||
Preview scriptFirst 1,000 lines of the extracted script
�ϕU�`Ҹ{ ��|���N j�B<|��d�n��N�z� ֤Ah��b��� �x�ga��X����sC��g��� �� ��(�S)inzQ�ϡ
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.