MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains embedded JavaScript and a hidden HTML iframe, both indicative of malicious intent. The embedded script contains multiple links to 'it.ph.affinity.com', which is likely a redirection or tracking domain used to obscure the final malicious destination. The ML classifier also flagged this PDF as malicious with high confidence.
Machine Learning
- Nyx PDF Classifier malicious score 0.9691
Heuristics 4
-
PDF contains hidden external HTML iframe high PDF_HIDDEN_HTML_IFRAMEPDF bytes contain a hidden zero-size HTML iframe pointing to an external HTTP(S) URL. This is a strong malicious dropper/redirect indicator and is not expected in ordinary PDF content.
-
Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOADPDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.gujaal.com/296/tamilnadu-election-results-2011-updates-tn-election-results-li In PDF document text
- http://it.ph.affinity.com/ctrack0.php?&cmpubid=xvj35&cmskps=&cmsite=www.gujaal.com&cmchannelid=&cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&cmoe=yahoo&cmoq=tamilnadu%20live%20news%20aiadmk&cmvd=1600900-3301361&cmvc=null&cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&rnd=1305270576026&q=result&at=XS&cmip=17&cmis=149&cmid=6&cmdt=pIn PDF document text
- http://it.ph.affinity.com/ctrack0.php?&cmpubid=xvj35&cmskps=&cmsite=www.gujaal.com&cmchannelid=&cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&cmoe=yahoo&cmoq=tamilnadu%20live%20news%20aiadmk&cmvd=1600900-3301361&cmvc=null&cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&rnd=1305270576026&q=government&at=XS&cmip=17&cmis=149&cmid=6&cmdt=pIn PDF document text
- http://it.ph.affinity.com/ctrack0.php?&cmpubid=xvj35&cmskps=&cmsite=www.gujaal.com&cmchannelid=&cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&cmoe=yahoo&cmoq=tamilnadu%20live%20news%20aiadmk&cmvd=1600900-3301361&cmvc=null&cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&rnd=1305270576026&q=bargain&at=XS&cmip=17&cmis=149&cmid=6&cmdt=pIn PDF document text
- http://it.ph.affinity.com/ctrack0.php?&cmpubid=xvj35&cmskps=&cmsite=www.gujaal.com&cmchannelid=&cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&cmoe=yahoo&cmoq=tamilnadu%20live%20news%20aiadmk&cmvd=1600900-3301361&cmvc=null&cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&rnd=1305270576026&q=data%20entry&at=XS&cmip=17&cmis=149&cmid=6&cmdt=pIn PDF document text
- http://it.ph.affinity.com/ctrack0.php?&cmpubid=xvj35&cmskps=&cmsite=www.gujaal.com&cmchannelid=&cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&cmoe=yahoo&cmoq=tamilnadu%20live%20news%20aiadmk&cmvd=1600900-3301361&cmvc=null&cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&rnd=1305270576026&q=home&at=XS&cmip=17&cmis=149&cmid=6&cmdt=pIn PDF document text
- http://it.ph.affinity.com/ctrack0.php?&cmpubid=xvj35&cmskps=&cmsite=www.gujaal.com&cmchannelid=&cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&cmoe=yahoo&cmoq=tamilnadu%20live%20news%20aiadmk&cmvd=1600900-3301361&cmvc=null&cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&rnd=1305270576026&q=candidate&at=XS&cmip=17&cmis=149&cmid=6&cmdt=pIn PDF document text
- http://it.ph.affinity.com/ctrack0.php?&cmpubid=xvj35&cmskps=&cmsite=www.gujaal.com&cmchannelid=&cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&cmoe=yahoo&cmoq=tamilnadu%20live%20news%20aiadmk&cmvd=1600900-3301361&cmvc=null&cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%2PDF link annotation
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off0000d477.bina5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xD477 | 264072 bytes |
embedded_pdf_script_0003c637.binf6ac7e32d2c411a98ab6792a80a5fb8ba5fbb026e742407a62e20a2e1f217022 |
pdf-embedded-script | PDF decompressed stream script payload at offset 0x3C637 | 248262 bytes |
Preview scriptFirst 1,000 lines of the extracted script
%PDF-1.5
3 0 obj
<</Type /Page
/Parent 1 0 R
/Resources 2 0 R
/Annots [<</Type /Annot /Subtype /Link /Rect [336.05 733.85 365.39 721.85] /Border [0 0 0] /A <</S /URI /URI (http://it.ph.affinity.com/ctrack0.php?&cmpubid=xvj35&cmskps=&cmsite=www.gujaal.com&cmchannelid=&cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&cmoe=yahoo&cmoq=tamilnadu%20live%20news%20aiadmk&cmvd=1600900-3301361&cmvc=null&cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&rnd=1305270576026&q=result&at=XS&cmip=17&cmis=149&cmid=6&cmdt=p)>>>><</Type /Annot /Subtype /Link /Rect [304.02 523.85 367.38 511.85] /Border [0 0 0] /A <</S /URI /URI (http://it.ph.affinity.com/ctrack0.php?&cmpubid=xvj35&cmskps=&cmsite=www.gujaal.com&cmchannelid=&cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&cmoe=yahoo&cmoq=tamilnadu%20live%20news%20aiadmk&cmvd=1600900-3301361&cmvc=null&cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&rnd=1305270576026&q=government&at=XS&cmip=17&cmis=149&cmid=6&cmdt=p)>>>>]
/Contents 4 0 R>>
endobj
4 0 obj
<</Filter /FlateDecode /Length 1619>>
stream
x��XKs�6 ��מzñ�� >E��&M2q�N����� M��Z U��b���~ H@��x<�� ���� ������T �'�bi ����|�.�A����-���� �ԧ����q�E�̂� R9+��?�?�N�" ���VH1 ���X�uAw+Q�-����{��aݯ��^� �GήI��C) e��U�N#/6�oDCb:(g%�⁎9 ���[K�)I��M��w�Ď<�K� ����p-E(|� Й/R� �镐� �� ĕռ��C/ e��^�ɍL��K'�z-�H� �v8��� �^��4��0� ��4vrM����o�z�� �Z�sIr���
�;� ����{� u pl`\ M<?q�k ���~]�ű �^ �+ߛ���\ �(�d^r� ��O���� �FIW �
��V- �BBE؟ �~�� ��~�YEzk�HѪ�� 6� =��~s r� ����+`ytu�� �J|իvx��;C�� �sZ�o� �Z�.��yv���Ԋ'g��*$--`�iD�'�=*"����X��\!�A ���� � k Ⱥ�㜬3���
Y軜 ���ߚ�L� �9�+dU�� ��[��Nm?;�fn!HY�����.�>hm�P
�������0D�{�5��J�(� �5,WD�k�6�ѵΩ[��1�F��Xy�H���xOڽ�w#��NU���wXG��"=K�u�� qR��Z�8��
�`� ��s��챠"}��c�-��-��R�P� K#���.�,�T���UM
YW�c� Ļ<�ؠ: B82#�H�� r��ӧ�0�p����CD � Jج�mZ��$� �%��m�M� ��� {��; ���� u�+#U� �Mͫ�>8 ��� Xk���'��uY! q� ,��b�� ����o�sT ~�ڸ����-E��k�;� �n y��\�K}�w��K�E rk3�] Y a����c O-,����Q��Z��IN�h����_�_��f65���(�0 4p�<��^驄Yw��;�|��P<yI
ő��5x|eU�N�.�� ��'�� � 5 �z 0�����9 � �� gPǸέ )!�T.G��Ȯ5_ޏfӞ�TWU� u���ԡv6���^5�صf�3�n�H�� ���&����DvW3�l5� �߶@�O6�1�k�/� ?�� �U�6q� ֠p�<5� ouo���Q�+G<�-ԭ5� L�.r��-�� ��g�d[8��POO�P� �Kp��q�~�w �g�4�" ;�~� � �b %T?}�ON1���V:� W�a� ���Ĝsz� ��� 0a�� �vz~�cwe��|`g�� y, ��ɜ��ܢ����d2�{ ������ ,Y�LXX�W i�R�� �_�ώk����P�� + � ��w] *� 3J�� ���># ����Ժ� �� { F��-����! 9�;w�{ < ���^ �� >̱�
�U�;�B�I$�D�F��Npc U�/u ��4���L�fȁ;ӵ��D�MN�q� �K0 � �ƚj\�3� ��ZO �� ��ʠ��<�h��Q��.�����J� *DD���;��G߰�ü7�� ��z �ݔ �~�s��v��� g�ϥ�Ȟ�$ꦠ
*����\ ��z�=$s��G�r���
MA �r�>;b��W����ԗ�(�on��0u��� e �$� s{�A w{Ů9_۞�x�?���
endstream
endobj
5 0 obj
<</Type /Page
/Parent 1 0 R
/Resources 2 0 R
/Annots [<</Type /Annot /Subtype /Link /Rect [490.13 748.85 530.15 736.85] /Border [0 0 0] /A <</S /URI /URI (http://it.ph.affinity.com/ctrack0.php?&cmpubid=xvj35&cmskps=&cmsite=www.gujaal.com&cmchannelid=&cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&cmoe=yahoo&cmoq=tamilnadu%20live%20news%20aiadmk&cmvd=1600900-3301361&cmvc=null&cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&rnd=1305270576026&q=bargain&at=XS&cmip=17&cmis=149&cmid=6&cmdt=p)>>>><</Type /Annot /Subtype /Link /Rect [341.36 568.85 398.05 556.85] /Border [0 0 0] /A <</S /URI /
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.