MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains embedded JavaScript that utilizes `eval()` and `unescape()` functions, indicating obfuscation and potential malicious intent. The primary finding is an embedded link pointing to 'https://www.familycredit.org/debtfree/enrollment.cfm', which is likely part of a phishing or social engineering scheme. The ML classifier also strongly flagged this PDF as malicious.
Machine Learning
- Nyx PDF Classifier malicious score 0.9979
Heuristics 6
-
eval() call high PDF_EVALeval() found — commonly used for obfuscated exploit execution
-
unescape() call high PDF_UNESCAPEunescape() found — often used to decode shellcode in PDF JS exploits
-
Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOADPDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://www.familycredit.org/debtfree/enrollment.cfm
- http://www.arachnophobia.no/users-manual-for-sprint-katana-top.html
- http://www.perfumessence.com.ve/health-food-store-austintown-oh-top.html
- http://animeentertainment.net/Order-Colospa-top.html
- http://ccrcosa.com/2006-america-model-next-top-top.html
- http://www.ipoint-tv.com/pink-porn-qidua.info-site-star-top.html
- http://www.ipoint-tv.com/free-pic-of-child-model-top.html
- http://animeentertainment.net/buy-fipronil-for-ants-top.html
- http://ccrcosa.com/young-ebony-ass-top.html
- http://www.arachnophobia.no/i-believe-yolanda-adams-sheet-music-top.html
- http://www.lacapelle-masmolene.fr/nowadays-sheet-music-top.html
- http://www.lacapelle-masmolene.fr/goa-india-print-top.html
- http://www.ipoint-tv.com/magic-shave-top.html
- http://www.perfumessence.com.ve/architectural-house-plans-blueprints-top.html
- http://www.perfumessence.com.ve/goody-hall-activity-sheet-top.html
- http://www.ecosystems.nl/tag/zvcm.php?arg=Get+Levaquin
- http://animeentertainment.net/Buy-Orlistat-top.html
- http://www.arachnophobia.no/xml-spreadsheet-compatibility-top.html
- http://ccrcosa.com/extreme-toon-sex-top.html
- http://www.perfumessence.com.ve/b-blood-food-type-top.html
- http://www.arachnophobia.no/food-analysis-software-free-downloads-top.html
- http://www.perfumessence.com.ve/ipod-print-ads-2009-top.html
- http://www.lacapelle-masmolene.fr/basic-character-sheet-d-d-top.html
- http://www.perfumessence.com.ve/wells-fargo-financial-worksheet-top.html
- http://acps.allconet.org/kjdsuy/mjhy.php?arg=sheet+music+heavy+action+johnny+pearson
- http://www.ipoint-tv.com/cummings-lesbian-summer-top.html
- http://animeentertainment.net/Order-Premarin-top.html
- http://ccrcosa.com/certificate-city-gift-havasu-lake-restaurant-top.html
- http://www.zenithadmin.com/jsgtde/gyav.php?arg=Lanoxin+Sale
- http://acps.allconet.org/kjdsuy/mjhy.php?arg=review+sheet+rappaccini%27s+daughter
- http://acps.allconet.org/kjdsuy/mjhy.php?arg=sprint+car+phrases
- http://www.lacapelle-masmolene.fr/friskies-can-cat-food-review-top.html
- http://www.arachnophobia.no/dts-delete-worksheet-top.html
- http://www.ipoint-tv.com/1920-kkk-leaders-top.html
- http://animeentertainment.net/wellbutrin-online-prescription-top.html
- http://ccrcosa.com/meagan-good-oops-top.html
- http://www.lacapelle-masmolene.fr/food-testing-lab-pune-top.html
- http://www.arachnophobia.no/escondido-california-sprint-dsl-top.html
- http://www.zenithadmin.com/jsgtde/gyav.php?arg=Parlodel+Sale
- http://www.arachnophobia.no/food-safety-free-video-top.html
- http://ccrcosa.com/teenage-mutant-ninja-turtles-rom-top.html
- http://animeentertainment.net/Purchase-Tiazac-top.html
- http://acps.allconet.org/kjdsuy/mjhy.php?arg=blueprint+mark-up+software
- http://acps.allconet.org/kjdsuy/mjhy.php?arg=interfaith+food+shelf+plattsburgh
- http://www.ipoint-tv.com/adam-sandler-hanukkah-song-3-top.html
- http://www.ipoint-tv.com/asian-hard-ass-top.html
- http://www.ecosystems.nl/tag/zvcm.php?arg=Generic+Lasix
- http://www.ecosystems.nl/tag/zvcm.php?arg=Aleve+For+Less
- http://animeentertainment.net/Buy-BuSpar-top.html
- http://ccrcosa.com/stretched-ass-hole-top.html
+46 more URL(s)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_002_off0000bfa0.bina5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xBFA0 | 264072 bytes |
embedded_pdf_script_0003d812.binf382ec559ac696bcff76647adf3230fe6248ad9946c7e1b2d5197b9c002c353e |
pdf-embedded-script | PDF decompressed stream script payload at offset 0x3D812 | 252125 bytes |
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.