MALICIOUS
102
Risk Score
Malware Insights
MITRE ATT&CK
T1059.007 JavaScript
T1204.002 Malicious File
The sample is an HTML file disguised as a PDF, containing VBScript. The VBScript is designed to execute code assembled from the document's DOM elements, a common technique for delivering malicious payloads. The embedded URL, while marked as benign, is present in the document.
Heuristics 3
-
HTA/VBScript executes code assembled from DOM text critical HTML_HTA_VBSCRIPT_DOM_EXECUTEHTML masquerades as an HTA application and uses VBScript Execute on text pulled from page elements. This staged DOM-text execution pattern is typical of malicious HTA/script attachments that hide the real script body in visible or off-screen HTML nodes.
-
HTML contains VBScript high HTML_VBSCRIPTStandalone HTML contains VBScript. Local HTML/VBScript documents are a legacy Windows execution surface commonly used in malicious attachments and browser-exploit chains.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.w3.org/2000/svg
Open this report in the interactive analyzer, or submit your own file for analysis.