MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1566.002 Spearphishing Attachment
T1071.001 Web Protocols
The PDF file contains embedded JavaScript that utilizes `eval()` and `unescape()` functions, indicating obfuscation and potential malicious code execution. The embedded script also contains a URI pointing to 'https://www.familycredit.org/debtfree/enrollment.cfm', which is likely a lure to a phishing or malware distribution site. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9981
Heuristics 6
-
eval() call high PDF_EVALeval() found — commonly used for obfuscated exploit execution
-
unescape() call high PDF_UNESCAPEunescape() found — often used to decode shellcode in PDF JS exploits
-
Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOADPDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://www.familycredit.org/debtfree/enrollment.cfm
- http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Germs+found+on+foods
- http://www.miperumarket.com/mnbvf/rnct.php?arg=Dog+won%27t+eat+dog+food
- http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Food+chemistry+journal+carbohydrates
- http://www.gadiago.org/pligg/jzrn.php?arg=worksheets+sandra+heyer+easy+true+stories
- http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=American+home+food+products
- http://www.gadiago.org/pligg/jzrn.php?arg=painted+antique+chest+beautiful+deal
- http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Food+with+long+chain+carbons
- http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Natri+dog+food
- http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Health+foods+algae
- http://www.vaqua.biz/home/tasr.php?arg=Foods+from+west+aftica
- http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Types+of+healthy+foods
- http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Slimming+world+free+food
- http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=How+long+do+refrigerated+foods+keep
- http://www.gadiago.org/pligg/jzrn.php?arg=yahoo+blank+planning+calendar
- http://www.gadiago.org/pligg/jzrn.php?arg=southeast+asia+map+blank
- http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Telephone+number+wico+foods
- http://www.miperumarket.com/mnbvf/rnct.php?arg=Jarred+baby+food
- http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Dorchester+ma+whole+food+store
- http://indianpharmacynoprescription.com/products/blood_pressure_heart/trental/order/
- http://indianpharmacynoprescription.com/products/men_s_health/ultimatecialispack/order/
- http://www.vaqua.biz/home/tasr.php?arg=Clib+art+of+food
- http://www.vaqua.biz/home/tasr.php?arg=Calcium+lowering+foods+calcitriol
- http://indianpharmacynoprescription.com/products/antibiotics/cefaclor/order/
- http://indianpharmacynoprescription.com/products/antibiotics/rulide/order/
- http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Best+food+for+puppy
- http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Food+game+2009+jelsoft+enterprises+ltd
- http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Food+staple+france+production
- http://www.gadiago.org/pligg/jzrn.php?arg=understanding+sadness+worksheets+and+activities
- http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Food+quantity+estimator+graduation+party+planning
- http://www.vaqua.biz/home/tasr.php?arg=Mexican+food+resturaunt+in+lindale+texas
- http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Popular+foods+in+bahama
- http://www.vaqua.biz/home/tasr.php?arg=Wysong+organic+animal+food
- http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Canned+foods+for+community+service
- http://indianpharmacynoprescription.com/products/antibiotics/erythromycin/order/
- http://www.gadiago.org/pligg/jzrn.php?arg=printable+verb+worksheets+for+3rd+grade
- http://www.miperumarket.com/mnbvf/rnct.php?arg=Vegetarian+party+food+children
- http://www.vaqua.biz/home/tasr.php?arg=The+rich+food+plan
- http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Food+distribution+u+s+a
- http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Good+cheap+food+san+ramon+ca
- http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Dold+foods+inc+hormel+foods+corporation
- http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Diagnostic+food+labs+grand+prarie
- http://www.vaqua.biz/home/tasr.php?arg=Sea+food+resturants+in+denver
- http://www.vaqua.biz/home/tasr.php?arg=Celtic+christmas+foods
- http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Food+storage+year+supply
- http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Signature+gourmet+foods+schaul%27s+order
- http://indianpharmacynoprescription.com/products/general_health/vasodilan/order/
- http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Gluten+free+dog+food+iams
- http://indianpharmacynoprescription.com/products/eye_care/pilocarpine/order/
- http://indianpharmacynoprescription.com/products/blood_pressure_heart/triamterene/order/
+51 more URL(s)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_002_off0000bfa0.bina5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xBFA0 | 264072 bytes |
embedded_pdf_script_0003e3c8.binda3e3f705a35401771a20b97d8eb2952deefdac025a7e46f53b5e1cdc9521c44 |
pdf-embedded-script | PDF decompressed stream script payload at offset 0x3E3C8 | 255120 bytes |
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.