Malicious Email / .MSG — malware analysis report

Static analysis result for SHA-256 dc0c26ed518affda…

MALICIOUS

Email / .MSG

3.41 MB
MD5: d97938e37512569c138f5067ea7a2db2 SHA-1: e987c15a61826f03a15571022a797f891c1342a3 SHA-256: dc0c26ed518affda004604a585a5d1cd023717bb800a0c4d31fd056d245dea7a
316 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File T1071.001 Web Protocols T1059.007 JavaScript

The MSG file contains an embedded PDF with multiple JavaScript-related heuristics firing, including eval(), unescape(), and fromCharCode(). These indicate the PDF is designed to execute obfuscated JavaScript, likely to download and run a second-stage payload. The presence of a UNC path related to CVE-2023-23397 suggests a potential delivery vector or an attempt to exploit Outlook vulnerabilities.

Heuristics 13

  • CVE-2023-23397 — UNC path in Outlook reminder property high CVE related CVE_2023_23397
    Outlook .msg file contains a UNC path (\\server\share) — this is related to the CVE-2023-23397 attack surface, but the exact ReminderFileParameter stream was not confirmed by property-aware parsing.
  • CCITTFaxDecode + active content — LibTIFF CVE-family indicator high CVE related PDF_CCITT_CVE_2010_0188_RELATED
    PDF uses /CCITTFaxDecode together with JavaScript, XFA, or RichMedia indicators. This matches the delivery pattern for Adobe Reader LibTIFF/CCITTFax parser exploit families, including CVE-2010-0188, but does not prove the exact malformed TIFF primitive.
  • U3D/3D content in PDF — Adobe Reader 3D parser CVE-family indicator high CVE related PDF_U3D_CVE_RELATED
    PDF contains U3D (Universal 3D) or 3D annotation content — CVE-2011-2462 and CVE-2009-3953 are critical vulnerabilities in Adobe Reader's U3D processing that allow arbitrary code execution. U3D content in PDFs is extremely rare in normal documents.
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/iX/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/tiff/1.0/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • String.fromCharCode low PDF_FROMCHARCODE
    String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules. (matched inside decoded stream)
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
  • Limited .msg parsing info EMAIL_MSG_LIMITED
    The .msg format requires the 'extract-msg' library for full analysis. Install it with: pip install extract-msg. Basic text scanning was performed.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/iX/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/tiff/1.0/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0256_000.js
f180e9c2a491686a53f8958784c0564b894e421d9af9f06a38358e067ef565a7		 pdf-javascript-stream PDF /JS object 256 at offset 0xF88D1 277708 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
stream_066_off000e0335.js
5c8b515f8fb35d2cc50e300d03f0203980fba1aa3a80728eb5408e4a9ef5211b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE0335 22212 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
stream_067_off000e13d2.js
f8b13a3863af702dcd7e3941443dec10025d7a2a53f54e108dfaf2b8e3f2695f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE13D2 17918 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
stream_068_off000e21d5.js
67fdedd6cb9a0e0b6e0eaba2f238ca5c983512f99a2092d586e4edea586be475		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE21D5 10626 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s).
stream_072_off000e4930.js
e268c3fa8753a7b53b3db467a54c42b8f9036543a6f7b6d4f1d02ccd59df16d3		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE4930 7253 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
stream_073_off000e50a8.js
77066a7a37b3af6ad53791d7f9457b7dfed3a8d84d4feaa7031d8ae355636408		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE50A8 2855 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
stream_074_off000e54cd.js
a1069b624d829f9ed15ef9dc70c98d2a23233bb0b080385f34e121a533ca365a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE54CD 10387 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s).
stream_078_off000e795f.js
09a1f6366bade2c781cbaf923095ea7085f8de7adb3a8c0b0b708123787b545f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE795F 7240 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
stream_079_off000e80e6.js
962623957d02896ce50ac303e11139789b7c547ef6f635834872fbf3a740a5c4		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE80E6 2629 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
stream_080_off000e84f3.js
252ea1aa6e45985d77ac5ab2582980690ed57e9f198ae81a80a56806c03a8ae3		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE84F3 10231 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 8 eval/decoder/string-building token(s).
stream_084_off000eba1c.js
9796998ca2c32756bf181ff5f4a60580d6fd55561b2050ddebc355d20055f667		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEBA1C 7036 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
stream_085_off000ec191.js
2a7255a2847947efcf8ff75cb73e57c1238de0b56ef725e3acb574238a620505		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEC191 2680 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
stream_086_off000ec5a8.js
34e199a7c93f33d1bb6f18620c86cff5d7bc5c68e1809e942ed0f3c0dc1515f9		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEC5A8 10563 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s).
stream_090_off000eea9b.js
12da33232a02682161413374f6f05c0210833edfde1a8ef6373b058eab29c831		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEEA9B 7349 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
stream_091_off000ef245.js
e35d38f817cd62db5a1f4554fb99f1e4ac0bd5e7e17c19dc1ad0afd56261c2cd		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEF245 2699 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
stream_092_off000ef658.js
f99b25026b97bbf0ee754128febcbd6731b4870a0b207a825858361537edb519		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEF658 10656 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 10 eval/decoder/string-building token(s).
stream_096_off000f19bf.js
f61d6d78585bf688bcd9976ab48d95b3ceeff76f145e26142d53f0c3f6f91422		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF19BF 7516 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 6 eval/decoder/string-building token(s).
stream_097_off000f216a.js
835ae1930debae0ff9f45f4d3af42c9838d14fc0ce7262bdf9b42f507a2f12bb		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF216A 2623 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
stream_098_off000f257a.js
0d67705a6bb1b0b689ce8dc5c8e2647f9ac5b389b7b962dac06623e78c805ec9		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF257A 10376 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 8 eval/decoder/string-building token(s).
stream_102_off000f4cbe.js
f1b809fcabd36a7b044d90b6113a89fff86070ac264f8499b1c49f20c8e11036		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF4CBE 7139 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
stream_103_off000f545c.js
8cf818474745e275d3a361ee51a325ca2da34fa2d6266b93bd6469334fb63052		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF545C 2719 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
stream_104_off000f587d.js
edf99511724f2fa86783da015818f61810939ca447b807b0b8c274f911c20ef9		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF587D 10455 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 10 eval/decoder/string-building token(s).
stream_108_off000f7ba4.js
0e39b508c23e49751ef8144517c5ab068efcd2c2e8347b74a648b3adeb7cf172		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF7BA4 7219 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
stream_109_off000f833c.js
575b0ab544d9a1d0fd5b4052fc85e291b9e65138e37005f64035bcb6a2a084bd		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF833C 2721 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 eval/decoder/string-building token(s).
stream_111_off001058ca.bin
1d949b4321e72a941028eedee52035a8ed5590fec17ffb3c67b4d01837e6c025		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1058CA 2859872 bytes
stream_112_off002f7741.js
dbc1dbabdc2baf9bc8781d47cac49ae28057fb9c8f16acebe21aed846f3a46bb		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2F7741 172124 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
objstm_0267_00.bin
0b0d272b75744fd65991a38e8edb55466d01fd4d5d2b1b775dca99da7e73f4d9		 pdf-objstm-decoded PDF /ObjStm 267 0 obj (inflated) 524 bytes
objstm_0268_00.bin
b14cf8625cf28a62dd3ffa238b71372931928293b97cb4018cae9e713c2ab27e		 pdf-objstm-decoded PDF /ObjStm 268 0 obj (inflated) 3871 bytes
icc_00_off00002580.icc
2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e		 pdf-icc-profile PDF ICC profile at offset 0x2580 3144 bytes
font_00_cff_off00002fe4.bin
198fc4d108280c30d8cd7ed038e8664b5585a4c4f5e222829aa70cdd7950d8c2		 pdf-font-stream PDF embedded font (cff) at offset 0x2FE4 7976 bytes
font_01_cff_off0007fc96.bin
3fd13bbbcd1be96d94089aef073018d945302d1df650c32525b380db167373a1		 pdf-font-stream PDF embedded font (cff) at offset 0x7FC96 2577 bytes
font_02_cff_off00080a1c.bin
bdf067c02198f08eb927110420fdd6dbfc949f953f395ed4283798ebea58cc7c		 pdf-font-stream PDF embedded font (cff) at offset 0x80A1C 9294 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.