MALICIOUS
158
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1059.007 JavaScript
The PDF contains embedded JavaScript with multiple obfuscation techniques, including `unescape()` and `eval()` calls, indicating malicious intent. The ML classifier strongly flagged this PDF as malicious. The embedded script payload is likely designed to download and execute a second-stage payload from one of the numerous embedded URLs. The extensive use of obfuscation and the high ML score suggest a sophisticated threat.
Machine Learning
- Nyx PDF Classifier malicious score 0.9981
Heuristics 6
-
eval() call high PDF_EVALeval() found — commonly used for obfuscated exploit execution
-
unescape() call high PDF_UNESCAPEunescape() found — often used to decode shellcode in PDF JS exploits
-
Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOADPDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.arachnophobia.no/users-manual-for-sprint-katana-top.html
- http://www.perfumessence.com.ve/health-food-store-austintown-oh-top.html
- http://animeentertainment.net/Order-Colospa-top.html
- http://ccrcosa.com/2006-america-model-next-top-top.html
- http://www.ipoint-tv.com/pink-porn-qidua.info-site-star-top.html
- http://www.ipoint-tv.com/free-pic-of-child-model-top.html
- http://animeentertainment.net/buy-fipronil-for-ants-top.html
- http://ccrcosa.com/young-ebony-ass-top.html
- http://www.arachnophobia.no/i-believe-yolanda-adams-sheet-music-top.html
- http://www.lacapelle-masmolene.fr/nowadays-sheet-music-top.html
- http://www.lacapelle-masmolene.fr/goa-india-print-top.html
- http://www.ipoint-tv.com/magic-shave-top.html
- http://www.perfumessence.com.ve/architectural-house-plans-blueprints-top.html
- http://www.perfumessence.com.ve/goody-hall-activity-sheet-top.html
- http://www.ecosystems.nl/tag/zvcm.php?arg=Get+Levaquin
- http://animeentertainment.net/Buy-Orlistat-top.html
- http://www.arachnophobia.no/xml-spreadsheet-compatibility-top.html
- http://ccrcosa.com/extreme-toon-sex-top.html
- http://www.perfumessence.com.ve/b-blood-food-type-top.html
- http://www.arachnophobia.no/food-analysis-software-free-downloads-top.html
- http://www.perfumessence.com.ve/ipod-print-ads-2009-top.html
- http://www.lacapelle-masmolene.fr/basic-character-sheet-d-d-top.html
- http://www.perfumessence.com.ve/wells-fargo-financial-worksheet-top.html
- http://acps.allconet.org/kjdsuy/mjhy.php?arg=sheet+music+heavy+action+johnny+pearson
- http://www.ipoint-tv.com/cummings-lesbian-summer-top.html
- http://animeentertainment.net/Order-Premarin-top.html
- http://ccrcosa.com/certificate-city-gift-havasu-lake-restaurant-top.html
- http://www.zenithadmin.com/jsgtde/gyav.php?arg=Lanoxin+Sale
- http://acps.allconet.org/kjdsuy/mjhy.php?arg=review+sheet+rappaccini%27s+daughter
- http://acps.allconet.org/kjdsuy/mjhy.php?arg=sprint+car+phrases
- http://www.lacapelle-masmolene.fr/friskies-can-cat-food-review-top.html
- http://www.arachnophobia.no/dts-delete-worksheet-top.html
- http://www.ipoint-tv.com/1920-kkk-leaders-top.html
- http://animeentertainment.net/wellbutrin-online-prescription-top.html
- http://ccrcosa.com/meagan-good-oops-top.html
- http://www.lacapelle-masmolene.fr/food-testing-lab-pune-top.html
- http://www.arachnophobia.no/escondido-california-sprint-dsl-top.html
- http://www.zenithadmin.com/jsgtde/gyav.php?arg=Parlodel+Sale
- http://www.arachnophobia.no/food-safety-free-video-top.html
- http://ccrcosa.com/teenage-mutant-ninja-turtles-rom-top.html
- http://animeentertainment.net/Purchase-Tiazac-top.html
- http://acps.allconet.org/kjdsuy/mjhy.php?arg=blueprint+mark-up+software
- http://acps.allconet.org/kjdsuy/mjhy.php?arg=interfaith+food+shelf+plattsburgh
- http://www.ipoint-tv.com/adam-sandler-hanukkah-song-3-top.html
- http://www.ipoint-tv.com/asian-hard-ass-top.html
- http://www.ecosystems.nl/tag/zvcm.php?arg=Generic+Lasix
- http://www.ecosystems.nl/tag/zvcm.php?arg=Aleve+For+Less
- http://animeentertainment.net/Buy-BuSpar-top.html
- http://ccrcosa.com/stretched-ass-hole-top.html
- http://www.zenithadmin.com/jsgtde/gyav.php?arg=Get+Wellbutrin
+44 more URL(s)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_002_off0000bb23.bina5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xBB23 | 264072 bytes |
embedded_pdf_script_0003d447.bin3602f2a7dc2eccb77006ee219867944ce5a27c7e54f610e75c3fd18bbbb7be2a |
pdf-embedded-script | PDF decompressed stream script payload at offset 0x3D447 | 251154 bytes |
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.