MALICIOUS
312
Risk Score
Malware Insights
MITRE ATT&CK
T1059 Command and Scripting Interpreter
T1539 Steal or Harvest Data
T1078 Valid Accounts
The PDF contains an embedded script payload and multiple heuristics indicate malicious intent. Specifically, the document lures the user with urgency and requests for MFA codes or recovery secrets, which are high-risk lures. It also contains instructions for executing commands via LOLBins. The embedded script and the nature of the lures suggest an attempt to harvest credentials or session tokens.
Machine Learning
- Nyx PDF Classifier clean score 0.0246
Heuristics 11
-
Recovery secret / private key request critical SE_SECRET_RECOVERY_LUREDocument requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
-
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOADPDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
-
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LUREDocument tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
-
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMANDExtracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
MFA / one-time-code harvesting lure high SE_MFA_LUREDocument asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
-
Unusually high stream count medium PDF_MANY_STREAMSPDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Urgency / deadline lure low SE_URGENCY_LUREDocument contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.counterhack.net/permission_memo.html In PDF document text
- https://portal.azureIn PDF document text
- https://github.com/gentilkiwi/mimikatz/In PDF document text
- https://github.com/PowerShellMafia/PowerSploit/In PDF document text
- https://github.com/vanhauser-thc/In PDF document text
- https://github.com/gentilkiwi/mimikatz/wiki/In PDF document text
- http://blog.cobaltstrike.com/In PDF document text
- https://cobaltstrike.com/help-browser-pivotingIn PDF document text
- https://www.microsoftIn PDF document text
- https://github.com/azure/In PDF document text
- https://blogs.msdn.microsoftIn PDF document text
- http://gauravmantri.com/2012/09/14/about-windows-azure-publishIn PDF document text
- https://azure.microsoftIn PDF document text
- https://github.com/Azure/azure-powershell/In PDF document text
- https://docs.microsoftIn PDF document text
- https://storagerm.blob.coreIn PDF document text
- https://storeasm.queue.core.windows.net/testqueueIn PDF document text
- http://www.oxid.it/cain.htmlIn PDF document text
- https://github.com/In PDF document text
- http://www.mitec.cz/wrr.htmlIn PDF document text
- https://www.chiark.greenendIn PDF document text
- http://www.freerdpIn PDF document text
- https://name.servicebus.windows.net:443/In PDF document text
- https://github.com/paolosalvatori/In PDF document text
- https://lccn.loc.gov/2017051237In PDF document text
- https://nostarch.com/azure/In PDF document text
- https://portal.msrc.microsoft.com/en-us/PDF link annotation
- https://portal.msrc.microsoft.com/en-us/engage/pentest#pentesttermsIn PDF document text
- https://manage.windowsazure.com/In PDF document text
- https://docs.microsoft.com/en-us/azure/In PDF document text
- https://technet.microsoft.com/en-us/itpro/windows/In PDF document text
- https://www.thc.org/thc-hydra/In PDF document text
- https://docs.microsoft.com/en-us/In PDF document text
- https://docs.microsoft.com/en-us/azure/active-directory/In PDF document text
- https://blogs.msdn.microsoft.com/powershell/2015/06/09/In PDF document text
- http://portal.azure.com/In PDF document text
- https://msdn.microsoft.com/en-us/library/windows/In PDF document text
- https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/In PDF document text
- https://docs.microsoft.com/en-us/azure/virtual-machines/virtual-machinesIn PDF document text
- https://www.shodan.io/In PDF document text
- https://docs.microsoft.com/en-us/azure/sql-database/sql-database-threatIn PDF document text
- https://docs.microsoft.com/en-us/azure/storage/In PDF document text
- https://lasec.epfl.ch/In PDF document text
- https://nmap.org/In PDF document text
- https://nmap.orgIn PDF document text
- https://nmap.org/submit/In PDF document text
- https://docs.microsoft.com/en-us/azure/best-practices-network-security/In PDF document text
- https://docs.microsoft.com/en-us/azure/��security/In PDF document text
- https://docs.microsoft.com/en-us/azure/service-bus-messaging/In PDF document text
- https://docs.microsoft.com/en-us/azure/key-vault/key-vault-secure-your-key-vault/In PDF document text
+28 more URL(s)
Extracted artifacts 32
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
embedded_pdf_script_00104851.bin |
pdf-embedded-script | PDF decompressed stream script payload at offset 0x104851 | 9489 bytes |
SHA-256: 748aa82b1245413bef2e19b9ccc2ea2387314c878e9b862b0d839aaa4cb1b9cc |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 5 shell/COM execution token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
BT /CS0 cs 0 0 0 scn /GS0 gs /T1_0 1 Tf 0.034 Tc -0.034 Tw 9 0 0 9 49.5 24 Tm [(xi)-12.2(i)]TJ /T1_1 1 Tf 0 Tc 0 Tw /Span<</ActualText<FEFF00A000A000A0>>> BDC 8.5 0 0 8.5 58.6125 24 Tm ( )Tj EMC /T1_2 1 Tf 0.025 Tc 6 0 0 6 71.3625 24 Tm [(C)-11(o)-16.7(n)-6.4(t)-15.4(e)-14.1(n)-6.4(t)-17(s i)1.3(n D)-23.4(e)-11.5(t)-15.4(a)-0.8(i)0.5(l)]TJ /T1_3 1 Tf 0 Tc 9 0 0 9 49.5 622.9549 Tm (Encountering Two-Factor Authentication)Tj 0.308 Tc -0.121 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (..................................)Tj 0 Tc 0 Tw 38.768 0 Td (26)Tj -34.768 -1.222 Td (Using Certificate Authentication)Tj 0.308 Tc -0.108 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (.................................)Tj 0 Tc 0 Tw 34.768 0 Td (28)Tj -34.768 -1.222 Td (Using a Service Principal or a Service Account)Tj 0.308 Tc -0.308 Tw 20.332 0 Td (.......................)Tj 0 Tc 0 Tw 14.436 0 Td (28)Tj -34.768 -1.222 Td (Accessing Cookies)Tj 0.308 Tc -0.125 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (..........................................)Tj 0 Tc 0 Tw 34.768 0 Td (28)Tj -34.768 -1.222 Td (Proxying Traffic Through the User\222s Browser)Tj 0.308 Tc -0.308 Tw 19.1 0 Td (.........................)Tj 0 Tc 0 Tw 15.668 0 Td (29)Tj -34.768 -1.222 Td (Utilizing Smartcards)Tj 0.308 Tc -0.088 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (.........................................)Tj 0 Tc 0 Tw 34.768 0 Td (30)Tj -34.768 -1.222 Td (Stealing a Phone or Phone Number)Tj 0.308 Tc -0.308 Tw 15.404 0 Td (...............................)Tj 0 Tc 0 Tw 19.364 0 Td (31)Tj -34.768 -1.222 Td (Prompting the User for 2FA)Tj 0.308 Tc -0.068 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (....................................)Tj 0 Tc 0 Tw 34.768 0 Td (32)Tj -38.768 -1.222 Td (Summary)Tj 0.308 Tc -0.013 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (.......................................................)Tj 0 Tc 0 Tw 38.768 0 Td (33)Tj /T1_4 1 Tf 10 0 0 10 49.5 510.9549 Tm (3)Tj ( )Tj 0.01 Tc 24.374 Tw /Span<</ActualText<FEFF0052>>> BDC 0 -1.2 TD (R)Tj EMC (ECONN)Tj /Span<</ActualText<FEFF00610069007300730061>>> BDC (AISSA)Tj EMC (NCE)Tj /Span<</ActualText<FEFF0009>>> BDC ( )Tj EMC (35)Tj /T1_3 1 Tf 0 Tc 0 Tw 9 0 0 9 49.5 483.9549 Tm (Installing PowerShell and the Azure PowerShell Module)Tj 0.308 Tc -0.263 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (.......................)Tj 0 Tc 0 Tw 38.768 0 Td (36)Tj -34.768 -1.222 Td (On Windows)Tj 0.308 Tc -0.308 Tw 6.164 0 Td (..............................................)Tj 0 Tc 0 Tw 28.604 0 Td (36)Tj -34.768 -1.222 Td (On Linux or macOS)Tj 0.308 Tc -0.308 Tw (..........................................)Tj 0 Tc 0 Tw 34.768 0 Td (36)Tj -34.768 -1.222 Td (Running Your Tools)Tj 0.308 Tc -0.306 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (..........................................)Tj 0 Tc 0 Tw 34.768 0 Td (37)Tj -38.768 -1.222 Td (Service Models)Tj 0.308 Tc -0.153 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (...................................................)Tj 0 Tc 0 Tw 38.768 0 Td (38)Tj -38.768 -1.222 Td (Best Practices: PowerShell Security)Tj 0.308 Tc -0.308 Tw 15.092 0 Td (......................................)Tj 0 Tc 0 Tw 23.676 0 Td (39)Tj -38.768 -1.222 Td (Authenticating with the PowerShell Module and CLI)Tj 0.308 Tc -0.293 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (..........................)Tj 0 Tc 0 Tw 38.768 0 Td (40)Tj -38.768 -1.222 Td (Authenticating with Management Certificates)Tj 0.308 Tc -0.053 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (..............................)Tj 0 Tc 0 Tw 38.768 0 Td (40)Tj -34.768 -1.222 Td (Installing the Certificate)Tj 0.308 Tc -0.271 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (.......................................)Tj 0 Tc 0 Tw 34.768 0 Td (41)Tj -34.768 -1.222 Td (Authenticating)Tj 0.308 Tc -0.027 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (.............................................)Tj 0 Tc 0 Tw 34.768 0 Td (41)Tj -34.768 -1.222 Td (Connecting and Validating Access)Tj 0.308 Tc -0.18 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (...............................)Tj 0 Tc 0 Tw 34.768 0 Td (42)Tj -38.768 -1.222 Td (Best Practices: Service Principals)Tj 0.308 Tc -0.164 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (.......................................)Tj 0 Tc 0 Tw 38.768 0 Td (43)Tj -38.768 -1.222 Td (Authenticating with Service Principals)Tj 0.308 Tc -0.308 Tw 16.324 0 Td (....................................)Tj 0 Tc 0 Tw 22.444 0 Td (44)Tj -34.768 -1.222 Td (Using Service Principals with Passwords)Tj 0.308 Tc -0.014 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (...........................)Tj 0 Tc 0 Tw 34.768 0 Td (44)Tj -34.768 -1.222 Td (Authenticating with X)Tj /Span<</ActualText<FEFF002E>>> BDC (.)Tj EMC (509 Certificates)Tj 0.308 Tc -0.308 Tw 16.636 0 Td (.............................)Tj 0 Tc 0 Tw 18.132 0 Td (45)Tj -38.768 -1.222 Td (Best Practices: Subscription Security)Tj 0.308 Tc -0.308 Tw 15.708 0 Td (.....................................)Tj 0 Tc 0 Tw 23.06 0 Td (46)Tj -38.768 -1.222 Td (Gathering Subscription Information)Tj 0.308 Tc -0.077 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (.....................................)Tj 0 Tc 0 Tw 38.768 0 Td (47)Tj -34.768 -1.222 Td (Viewing Resource Groups)Tj 0.308 Tc -0.128 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (.....................................)Tj 0 Tc 0 Tw 34.768 0 Td (49)Tj -34.768 -1.222 Td (Viewing a Subscription\222s App Services \(Web Apps\))Tj 0.308 Tc -0.155 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (...................)Tj 0 Tc 0 Tw 34.768 0 Td (50)Tj -34.768 -1.222 Td (Gathering Information on Virtual Machines)Tj 0.308 Tc -0.064 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (.........................)Tj 0 Tc 0 Tw 34.768 0 Td (51)Tj -34.768 -1.222 Td (Finding Storage Accounts and Storage Account Keys)Tj 0.308 Tc -0.105 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (..................)Tj 0 Tc 0 Tw 34.768 0 Td (54)Tj -38.768 -1.222 Td (Gathering Information on Networking)Tj 0.308 Tc -0.044 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (...................................)Tj 0 Tc 0 Tw 38.768 0 Td (56)Tj -34.768 -1.222 Td (Network Interfaces)Tj 0.308 Tc -0.122 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (..........................................)Tj 0 Tc 0 Tw 34.768 0 Td (56)Tj -34.768 -1.222 Td (Obtaining Firewall Rules or Network Security Groups)Tj 0.308 Tc -0.275 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (..................)Tj 0 Tc 0 Tw 34.768 0 Td (59)Tj -34.768 -1.222 Td (Viewing Azure SQL Databases and Servers)Tj 0.308 Tc -0.308 Tw 19.1 0 Td (.........................)Tj 0 Tc 0 Tw 15.668 0 Td (61)Tj -38.768 -1.222 Td (Consolidated PowerShell Scripts)Tj 0.308 Tc -0.09 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (.......................................)Tj 0 Tc 0 Tw 38.768 0 Td (63)Tj -34.768 -1.222 Td (ASM Script)Tj 0.308 Tc -0.308 Tw 4.932 0 Td (................................................)Tj 0 Tc 0 Tw 29.836 0 Td (64)Tj -34.768 -1.222 Td (ARM Script)Tj 0.308 Tc -0.308 Tw 4.932 0 Td (................................................)Tj 0 Tc 0 Tw 29.836 0 Td (66)Tj -38.768 -1.222 Td (Summary)Tj 0.308 Tc -0.013 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (.......................................................)Tj 0 Tc 0 Tw 38.768 0 Td (68)Tj /T1_4 1 Tf 10 0 0 10 49.5 151.9549 Tm (4)Tj ( )Tj 0.01 Tc /Span<</ActualText<FEFF0045>>> BDC T* (E)Tj EMC (X)Tj /Span<</ActualText<FEFF0061006D0069>>> BDC (AMI)Tj EMC (N)Tj /Span<</ActualText<FEFF0069>>> BDC (I)Tj EMC (NG S)Tj /Span<</ActualText<FEFF0074>>> BDC (T)Tj EMC (OR)Tj /Span<</ActualText<FEFF0061>>> BDC (A)Tj EMC (GE)Tj /Span<</ActualText<FEFF0009>>> BDC ( )Tj EMC 34.618 0 Td (69)Tj /T1_3 1 Tf 0 Tc 9 0 0 9 49.5 124.9549 Tm (Best Practices: Storage Security)Tj 0.308 Tc -0.274 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (........................................)Tj 0 Tc 0 Tw 38.768 0 Td (70)Tj -38.768 -1.222 Td (Accessing Storage Accounts)Tj 0.308 Tc -0.206 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (..........................................)Tj 0 Tc 0 Tw 38.768 0 Td (71)Tj -34.768 -1.222 Td (Storage Account Keys)Tj 0.308 Tc -0.264 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (........................................)Tj 0 Tc 0 Tw 34.768 0 Td (71)Tj -34.768 -1.222 Td (User Credentials)Tj 0.308 Tc -0.308 Tw 7.396 0 Td (............................................)Tj 0 Tc 0 Tw 27.372 0 Td (71)Tj -34.768 -1.222 Td (SAS Tokens)Tj 0.308 Tc -0.141 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (...............................................)Tj 0 Tc 0 Tw 34.768 0 Td (72)Tj -38.768 -1.222 Td (Where to Find Storage Credentials)Tj 0.308 Tc -0.051 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (.....................................)Tj 0 Tc 0 Tw 38.768 0 Td (73)Tj -34.768 -1.222 Td (Finding Keys in Source Code)Tj 0.308 Tc -0.278 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (...................................)Tj 0 Tc 0 Tw 34.768 0 Td (73)Tj -34.768 -1.222 Td (Obtaining Keys from a Developer\222s Storage Utilities)Tj 0.308 Tc -0.182 Tw /Span<</ActualText<FEFF0020002E>>> BDC ( )Tj EMC (...................)Tj 0 Tc 0 Tw 34.768 0 Td (73)Tj ET |
|||
font_00_cff_off000db952.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0xDB952 | 1718 bytes |
SHA-256: af9afcd67e9eeb4430844c40b2fa711ab53bab642aab5b89dca83f873590e2f1 |
|||
font_01_cff_off000dbfeb.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0xDBFEB | 4511 bytes |
SHA-256: 0b448e2ad9f1991caf076f8cde59a43db33ef0fdf16c861b8160dd7d11d1410e |
|||
font_02_cff_off000dcea6.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0xDCEA6 | 5008 bytes |
SHA-256: ba51813b161ab6038fceee7c56ac2430bdd013fbd798b770aff0a8d56d4df830 |
|||
font_03_cff_off000ddec5.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0xDDEC5 | 789 bytes |
SHA-256: 4a31bb567ef785b648df2524b626d7d3cea2de5af57591011691ee2a7ace80b6 |
|||
font_04_cff_off000e43a1.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0xE43A1 | 2420 bytes |
SHA-256: edb4558428130c26a55aed01397a356e04f663a42f1644318c803ecd52dbd439 |
|||
font_05_cff_off000e4bfa.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0xE4BFA | 2859 bytes |
SHA-256: f2ad6280b5dfd6b74a31e29bce798db6e46fe7bdb31706ece9041ae38a1c0739 |
|||
font_06_cff_off000eb664.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0xEB664 | 1749 bytes |
SHA-256: 4fedc625ffcc901ca59f08c5a93f168246feea85ef2d8b4056f721d513ce35bf |
|||
font_07_cff_off000ebcbd.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0xEBCBD | 5123 bytes |
SHA-256: 4a58fcc12cafbee1e8fe6e1135a6dd551f59c6966864984367d5c80589052236 |
|||
font_08_cff_off000ecd56.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0xECD56 | 2161 bytes |
SHA-256: 41c036018e5f03fd9d346f9bed6d11607799cc29b026fb413368a06b3878beca |
|||
font_09_cff_off0012af59.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x12AF59 | 414 bytes |
SHA-256: 6e10ccabf7ba6588816609200d1056bcf043e037b8ddff73ba8d3bcff3c9b4b9 |
|||
font_10_cff_off0017dce6.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x17DCE6 | 1236 bytes |
SHA-256: 08e52b42953a9c3e12230c8e3398ea7fb596884d40addd6568843f0482564a79 |
|||
font_11_cff_off003f9784.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x3F9784 | 966 bytes |
SHA-256: 8b8bb61925c499491cf6b7dd59fcc6ed82064372bc97c603c78f6d423889733a |
|||
font_12_cff_off0047d8ba.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x47D8BA | 3212 bytes |
SHA-256: ce2dfc60d30133a89f75c1066f3a5b8e3f5f55b7233af5548f0e4dbdbd89509f |
|||
font_13_cff_off0047e5cd.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x47E5CD | 440 bytes |
SHA-256: bcb845c9394c41f01cd0c0527e489250f3ebd05d0a41844a97b7b8a40d82a0f3 |
|||
font_14_cff_off0047e8d3.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x47E8D3 | 488 bytes |
SHA-256: e0ec761cef7d2a18c6de378ff3112321dbe06968258f06646e29aba1318d29b2 |
|||
font_15_cff_off0047ec25.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x47EC25 | 1197 bytes |
SHA-256: de1d0fd38ef49680c3f97a59d36960017fc80d1bd723547af77fa966ff569b34 |
|||
font_16_cff_off004a272d.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x4A272D | 4533 bytes |
SHA-256: fc2a68606e7770450af7cf51a8a4aee4897919f9fdeb14cd18761381c0955283 |
|||
font_17_cff_off004a382d.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x4A382D | 10628 bytes |
SHA-256: 22f4b403c583f4d83a2e3fc004b3916553e62ae8f497c68964affd24d8462415 |
|||
font_18_cff_off004a5b08.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x4A5B08 | 2916 bytes |
SHA-256: dd8848ab66c9ade9cc1f091d6f91da40bbba6f1f107deb3c4ff5828cf44de27d |
|||
font_19_cff_off004a64e6.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x4A64E6 | 3016 bytes |
SHA-256: 414cb072427e203c93d71b59fa6e09ca5c061bdc77834e4d58367da6cb0d5724 |
|||
font_20_cff_off004a6e42.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x4A6E42 | 6077 bytes |
SHA-256: 78803c16d9c6bb0b99bda72674aac381f63cfd039d8106351c1c9ce1b69055e1 |
|||
font_21_cff_off004a83e2.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x4A83E2 | 11203 bytes |
SHA-256: 356a99c5c134d8618c53ef58efd4148b5a9ab7e8efe2d5f26feda1892f8886e4 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact entropy is 7.42, consistent with packed or encrypted content.
|
|||
font_22_cff_off004ab14d.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x4AB14D | 3423 bytes |
SHA-256: 43c7e49409ae526f05bb0f963dbb0a04e23e698146890e64db9617c825561038 |
|||
font_23_cff_off004abf9b.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x4ABF9B | 4435 bytes |
SHA-256: 74ad099ea135dd32602247b5aeead46d1f0721638dbba4c0d25e8668bed8f5f5 |
|||
font_24_cff_off004d927e.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x4D927E | 7960 bytes |
SHA-256: 8bfe6ddced6fa88016c1040293345f1586c07f0f678c3432ab26c15e9005d231 |
|||
font_25_cff_off004dbdb8.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x4DBDB8 | 4939 bytes |
SHA-256: 37249032dbe1c2d486b7c8da30deacc1c0c8ee761529db7363ce349f719ec44e |
|||
font_26_cff_off004df9fb.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x4DF9FB | 4294 bytes |
SHA-256: ad200b7aa8c5dc789b33ad9911f2f3349877a590ededa36917e5ad294a3bac75 |
|||
font_27_cff_off004e0b00.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x4E0B00 | 5451 bytes |
SHA-256: ed4c5cbb66f37cb80aaee174375082b27a493768370374b16d35d7aae15bcff6 |
|||
font_28_cff_off004e1eb2.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x4E1EB2 | 3636 bytes |
SHA-256: e5bc0a2154b3a46424f7216ba63837ac4683eb3919302c2e356c85e7f748ff22 |
|||
font_29_cff_off004e2ba9.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x4E2BA9 | 835 bytes |
SHA-256: 3641a805d2f31c3b63f847f997a3d05e21bbb3f206df6fe73362e2595c51eab5 |
|||
font_30_cff_off004eb13c.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x4EB13C | 5525 bytes |
SHA-256: a0b7b1e9cc06b651d09067cb689ceb9cfc5d23384fd7b26e97075c43e682a460 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.