CVE Confidence
CVE exact The available structure and behavior identify exploitation of the specified vulnerability.
CVE likely The file contains the vulnerable primitive or a vulnerability-specific delivery pattern, but the complete exploit chain was not recovered.
The file exposes a component or attack surface associated with the vulnerability. This does not establish exploitation.
Shellcode
32
String 'CreateRemoteThread' found in file bytes.
CreateRemoteThread starts execution in another process. In documents or embedded payloads this is a strong process-injection indicator.
Byte signature matching Metasploit Framework bind_tcp shellcode.
This byte sequence matches Metasploit's bind TCP shell, which opens a listening port on the victim's machine for the attacker to connect to.
Byte signature matching Metasploit Framework reverse_tcp shellcode.
This exact byte sequence is the preamble of Metasploit's reverse TCP shell payload — one of the most widely-used exploitation tools. Its presence is consistent with a weaponised file.
The Metasploit reverse/bind-TCP connect-back address (host:port) was recovered from the stager's on-stack sockaddr.
Metasploit's block_api stager resolves Win32 APIs by hash and builds a sockaddr_in on the stack before calling connect()/bind(). Static analysis reads that structure directly to surface the C2 endpoint as a network IOC. Recovery is gated on the block_api resolver or a known msf API-hash, so it only fires on genuine stagers. The recovered host is classified as a public (actionable) C2, or a non-routable lab / placeholder / bind-any address (the author's own test environment, not an operational indicator).
String 'URLDownloadToFile' found in file bytes.
URLDownloadToFile downloads a file from the internet to disk. This is one of the most common APIs used by shellcode to fetch and save second-stage malware. Its presence is a high-signal indicator of malicious intent.
String 'WriteProcessMemory' found in file bytes.
WriteProcessMemory writes bytes into another process. Malware uses it with VirtualAllocEx and CreateRemoteThread for process injection.
Windows DLL or API names found XOR-encoded with a single-byte key.
Shellcode frequently XOR-encodes strings like 'kernel32.dll' or 'LoadLibraryA' to evade signature-based detection. At runtime, the shellcode decodes them with the same key before calling the APIs. Finding known library or API names encoded under a single-byte XOR key is a high-signal indicator of obfuscated shellcode. The analyzer brute-forces all 255 possible single-byte keys against common Windows DLL and API names to detect this technique.
String 'CreateProcess' found in file bytes.
CreateProcess starts a new process. Its presence in raw document bytes suggests embedded code intended to execute programs on the system.
Egg-hunter pattern that searches process memory for a marker ('egg').
When an exploit has limited buffer space, an egg-hunter is a small piece of shellcode that scans memory for a larger payload marked with a specific tag. This is a well-known exploitation technique.
String 'GetProcAddress' found in file bytes.
GetProcAddress resolves an exported function inside a loaded DLL. Together with LoadLibrary it is the foundational API resolution pair used by nearly all in-document shellcode. Ordinary documents rarely contain this string.
Repeated byte pattern typical of heap-spray payloads.
Heap spraying fills large areas of memory with repeated data (often NOP-sled + shellcode) so that a corrupted pointer is likely to land in attacker-controlled memory. Seeing long repeated byte patterns in a document is a strong exploit indicator.
String 'LoadLibrary' (or LoadLibraryA/W/Ex) found in file bytes.
LoadLibrary maps a DLL into the current process and returns its base address; combined with GetProcAddress it is the standard primitive for shellcode to resolve Win32 API functions without using the import table. Documents do not normally embed this string in their data.
PEB access combined with nearby ROR13-style API hashing.
Windows shellcode often walks the PEB to find loaded DLLs, then hashes export names to resolve APIs without storing cleartext imports. ROR13 hash loops are a common resolver primitive; seeing them near PEB access is a strong position-independent shellcode indicator.
Access to the Process Environment Block via GS:[0x60].
The 64-bit equivalent of PEB access. Shellcode reads GS:[0x60] to find the PEB on 64-bit Windows, then walks DLL lists to resolve API functions.
Access to the Process Environment Block via FS:[0x30].
Windows shellcode accesses the PEB to find loaded DLLs and resolve API addresses without using imports. Reading FS:[0x30] on x86 is the standard way to reach the PEB — a hallmark of position-independent shellcode.
String 'powershell' found in file bytes.
PowerShell is a powerful scripting environment frequently abused by attackers to download payloads, execute scripts in memory, and evade detection.
String 'ShellExecute' found in file bytes.
ShellExecute can open files, URLs, or run programs. In shellcode it is often used to launch payloads or open second-stage URLs.
String 'WinExec' found in file bytes.
WinExec is a Windows API that runs a command. Shellcode resolves and calls WinExec to launch malicious commands. Normal documents should not contain this raw API name in their binary data.
String 'wscript' or 'cscript' found in file bytes.
Windows Script Host (wscript/cscript) executes VBScript and JScript. In malicious documents it is often used to run downloader or installer scripts.
XOR-based decoder stub that decrypts shellcode at runtime.
Shellcode is often XOR-encoded to evade signature detection. A decoder stub at the start decrypts the real payload in memory. Finding a decoder stub strongly suggests the file carries encrypted shellcode.
A known shellcode XOR key decoded one or more network destinations.
After independently recovering a single-byte XOR key from an encoded Windows API or DLL name, the analyzer performs one bounded decode of the same payload. Absolute URLs are surfaced with their key and source offset; downloader and process-execution APIs raise the finding to high severity. The decoded configuration is also carved for authenticated analyst preview.
String 'bitsadmin' found in file bytes.
bitsadmin manages Background Intelligent Transfer Service jobs. Attackers abuse it to download files stealthily in the background.
String 'certutil' found in file bytes.
certutil is a legitimate Windows tool that attackers misuse to download files (-urlcache) or decode Base64 payloads (-decode). It is a commonly abused LOLBin.
String 'cmd.exe' followed by an execution switch (/c, /k, or /r) — i.e. an actual invocation, not just a bare reference.
The rule matches 'cmd.exe' immediately followed by /c, /k, or /r, which is the shape of a real command invocation by shellcode or a macro launching a payload. Plain documentation mentions of 'cmd.exe' (e.g. in user manuals or embedded paths) do not fire the detector.
String 'mshta' found in file bytes.
mshta.exe runs HTML Applications (.hta files) which can contain VBScript or JScript. It is a well-known 'living-off-the-land' binary (LOLBin) abused to execute malicious scripts.
x86 FSTENV-based instruction sequence to obtain the instruction pointer.
An alternative GetPC technique that uses floating-point environment save (FSTENV) to leak the instruction pointer. This is a strong shellcode indicator because this instruction pattern is uncommon in ordinary document data.
Long run of NOP-equivalent instructions (e.g. INC, DEC, POPA).
Some shellcode replaces 0x90 NOPs with other single-byte instructions that have no meaningful side-effect (like INC ECX) to evade simple NOP-sled detection.
String 'VirtualAlloc' found in file bytes.
VirtualAlloc allocates executable memory. Shellcode uses it to create a writable+executable memory region where decoded payloads can run.
String 'VirtualProtect' found in file bytes.
VirtualProtect changes memory page permissions. Shellcode uses it to make memory regions executable (bypassing DEP). Not expected in documents.
Two or more consecutive PUSH imm32 instructions whose decoded bytes spell a Windows API or shell-keyword string.
Shellcode frequently constructs strings (like 'cmd.exe' or 'WinExec') on the stack by pushing 4-byte immediates with the 0x68 opcode. The rule matches a run of ≥2 PUSH imm32 instructions and only fires when the decoded bytes contain a known execution, network, or Windows API keyword — so generic numeric pushes do not trigger it.
Long run of 0x90 (NOP) bytes detected in the file.
A NOP sled is a sequence of no-operation instructions used by attackers to pad shellcode so that execution 'slides' into the payload regardless of the exact jump address. Long NOP runs are unusual in normal documents.
x86 CALL $+5 instruction sequence that obtains the current instruction pointer.
Shellcode needs to know its own memory address to locate encoded payloads. CALL $+5 followed by POP is a common way to get the program counter (PC). This pattern is unusual in normal documents.
PDF
345
PDF /Launch action passes a `javascript:` URL as the /P parameter.
When mshta receives `javascript:...` as its argument, it can execute the script inside its scripting host. This converts the PDF /Launch action into an inline-script execution primitive. Combined with PDF_LAUNCH_MSHTA, this is T1218.005 + T1059.005.
PDF /Launch action specifies an executable target (and optionally parameters).
The /Launch action can run an external program when activated, or on open if paired with an open trigger. The finding records the launched command for display and elevates to CRITICAL when the target references a known-dangerous executable (cmd, PowerShell, etc.).
PDF /Launch action whose /F parameter explicitly names mshta.
Mshta is the Microsoft HTML Application host and a documented LOLBIN. Modern PDF launcher campaigns prefer it because mshta accepts a `javascript:` URL as its /P parameter, which executes inline JScript without requiring a dropper file on disk. The PDF /Launch carrier plus an mshta target is the unambiguous shape of MITRE ATT&CK T1218.005.
An Adobe security notice instructs the user to scan a QR code to unlock a document.
The behavioral finding remains valid when a dense, damaged, or composited QR payload cannot be decoded.
PDF OpenAction JS uses a this.URL-keyed cipher + hex-decode + eval — a known anti-analysis Adobe Reader exploit kit.
Fires when the PDF OpenAction JavaScript contains the fingerprint of a specific anti-analysis Adobe Reader exploit kit: a substitution cipher keyed on this.URL (the delivery filename, extracted via indexOf('rtl')), a decoy fallback key when the URL contains ':' (so sandboxes/static analysis decode to garbage by design), and a parseInt(pair,16)->fromCharCode hex decoder feeding eval. The kit bundles the classic Adobe Reader JavaScript CVEs (CVE-2007-5659, CVE-2008-2992, CVE-2009-0927, CVE-2009-4324, CVE-2010-0188) and selects one at runtime by viewer version. Because the decode key is the runtime delivery URL, the specific CVE is not statically recoverable, so the loader fingerprint attributes the Reader-exploit family at related confidence (which removes it from the unknown-exploit/0-day hunt queue).
Adobe Reader U3D auto-activated 3D annotation — CVE-2009-2990
critical
CVE_2009_2990_U3D_AUTOACTIVATE
PDF embeds a U3D stream behind a /3D annotation set to auto-activate on page view.
CVE-2009-2990 is a heap buffer overflow in Adobe Reader / Acrobat's U3D (Universal 3D, ECMA-363) CLODProgressiveMeshDeclaration parser, patched in APSB09-15 (Reader 9.2 / 8.1.7 / 7.1.4) alongside the sibling FlateDecode-predictor overflow CVE-2009-3459. The exploitable document shape is a /Subtype /3D annotation whose /3DA activation dictionary binds /A /PV with /AIS /I — that combination makes the U3D parser run on page view with no click required. Real-world samples pair this with a 0x0c0c0c0c heap-spray JavaScript that lays a urlmon-based download shellcode at the corrupted allocation. Legitimate 3D PDFs almost never use the auto-activate + JS combination.
OpenAction JavaScript evaluates an annotation subject stage, which then evaluates the annotation author field.
JavaScript uses syncAnnotScan()/getAnnots({nPage:0}) to read annotation fields, resolves an annotation name to eval, evaluates the subject stage, then evaluates getAnnot(0, "eval").author. This sequence implements an annotation payload loader. The getAnnots call is transport glue, not proof of CVE-2009-1492 unless it carries crafted integer-overflow arguments.
PDF JavaScript decodes dash-delimited hex from annotation subjects and evals the result.
Old PDF exploit kits often hide second-stage JavaScript in annotation /Subject fields. The rule requires the full staging shape: OpenAction JavaScript that enumerates annotations, converts dash-delimited hex bytes with String.fromCharCode(), and evals the recovered stage. This avoids flagging ordinary annotations or benign hexadecimal text.
OpenAction JavaScript reads an annotation /Subject payload, rewrites marker bytes into percent escapes, unescapes the result, and dispatches it through eval.
The transport requires an /OpenAction launcher, an annotation /Subj payload, syncAnnotScan/getAnnots annotation enumeration, marker-to-% rewriting, unescape(), and direct or indirect eval dispatch. These conditions identify exploit-kit staging but do not attribute a CVE. Plain getAnnots({nPage:0}) is not enough; CVE-2009-1492 is only assigned by the separate CVE rule when getAnnots() carries crafted integer-overflow or long string arguments.
Numeric string arrays reconstruct a WScript download, file-write, and execution stage.
The radix is inferred within JavaScript's bounded radix range; a finding requires a complete CreateObject, responseBody, SaveToFile, execution, and network chain.
PDF text contains a long base64 blob that decodes to a verified MZ/PE executable payload.
Malicious PDFs may hide a Windows executable as base64 in comments, after %%EOF, or in plain object text rather than as a declared attachment or stream. Decoding to a verified PE header is a strong payload-smuggling indicator.
PDF impersonates a branded invoice workflow but links outside the brand's own domains.
The PDF presents a branded invoice/open/download workflow and routes the victim to a host that is not controlled by the impersonated brand. This keeps the finding focused on the social-engineering behavior, while campaign names and report references should be represented as tags or linked metadata.
Branded invoice PDF links to public cloud object storage with a recipient email parameter.
The PDF presents invoice or service-fee wording for a known brand, but the clickable action points to generic cloud object storage and includes a recipient email parameter. This is a phishing/redirection pattern: legitimate invoices normally route users to the vendor's own portal rather than a personalized object-storage URL.
A corporate presentation or investment lure points to redirect-named object storage.
Requires corporate identity wording, presentation/investment context, an open/view action, and a redirect-labelled cloud tenant; ordinary cloud shares do not match.
PDF shows a corrupted-file/update lure and links to an external URL.
Malicious PDFs often avoid exploiting the reader directly and instead present a fake broken-file or update prompt that sends the victim to a staged payload or credential collection page. The detector requires the specific corrupted-file/update lure text plus an external HTTP(S) target so ordinary linked documents are not convicted.
PDF visible text advertises cracked software, serials, or archive downloads and links to a shortlink/download gateway.
The PDF contains a cracked-software or serial-key lure in visible text and one or a few links to a shortlink or download gateway. Piracy terms part of the URI. It requires both an explicit crack/serial/archive download lure and a shortlink or known encoded download gateway, so ordinary documents that mention downloading software are not affected. The PDF is a social-engineering carrier, not a parser exploit.
PDF carries many game-hack/free-generator PDF links spread across distinct hosts.
The PDF combines a free-generator or game-hack lure with many external PDF links whose filenames advertise hacks, cheats, jailbreaks, generators, or free game currency. The detector requires multiple matching links distributed across several hosts; a game document with an isolated external link does not match.
Piracy/download lure text is paired with links across several unrelated hosts.
The multi-domain gate identifies SEO and redirect carriers while avoiding ordinary manuals or product documents that contain one legitimate vendor download link.
PDF contains DocuSign-themed download/signing lure text and links to a non-DocuSign host.
Credential-phishing PDFs often imitate DocuSign with a fake document/download/signing prompt. The high-signal part is not the brand word alone; it is DocuSign lure text plus a clickable HTTP(S) action whose destination is outside DocuSign-owned domains. Legitimate DocuSign workflows keep the action on DocuSign infrastructure.
Document-action lure links to risky external infrastructure
critical
PDF_DOCUMENT_ACTION_HOST_MISMATCH_LURE
A document review/open/sign/install CTA links to a risky delivery or redirect destination.
The rule requires both actionable document-lure language and corroborating infrastructure: a raw IP, shortener, compromised CMS path, generated host, remote Office payload, or a distributed redirector set.
A PDF sends many title-shaped document links through one dynamic-DNS host.
The detector requires at least fifteen outbound links concentrated on one supported dynamic-DNS provider and at least eight paths resembling unrelated titled PDF downloads. That correlated link-farm shape identifies disposable SEO/scam redirector carriers without treating an ordinary dynamic-DNS link as malicious.
Embedded SWF combines native-memory discovery, protection changes, and process execution.
The rule requires independent ActionScript surfaces for locating memory, changing page protections, and invoking a platform payload. It is narrower than matching ByteArray or RichMedia alone and does not guess a CVE.
PDF stream bytes contain an embedded MZ/PE executable payload.
Exploit chains sometimes hide droppers inside ordinary PDF stream bytes rather than as declared /EmbeddedFile attachments. A verified PE header inside a PDF stream is strong staged-payload evidence.
Embedded export-and-launch chain — CVE-2010-1240 likely
critical
CVE_2010_1240_EMBEDDED_EXPORT_LAUNCH
PDF combines /Launch, EmbeddedFiles/EF, and exportDataObject with nLaunch:0.
CVE-2010-1240-style documents match when the attached payload is not a clean PE executable but the Adobe Reader drop-and-launch mechanism is explicit. The rule requires /Launch plus an embedded-file name tree and exportDataObject(... nLaunch:0), which is not a benign attachment workflow.
File starts as a GIF, contains a secondary PDF body, and the carved PDF has JBIG2 stream anomalies consistent with FORCEDENTRY-style CoreGraphics exploitation.
Project Zero's FORCEDENTRY analysis describes CVE-2021-30860 as a fake GIF that routes into the CoreGraphics PDF parser and then exercises a malicious JBIG2 stream. Analyzer only emits this CVE when the wrapper and malicious JBIG2 child indicators are both present, keeping plain scanned-PDF JBIG2 usage out of the CVE bucket.
ML-flagged PDF that also carries a download/call-to-action lure and an off-domain downloadN.php?file=document gateway link.
The mass-generated 'free PDF download' / fake-document family ranks in search results for a lure query, then funnels the victim through an off-domain server-side download gateway (e.g. /download3.php?q=<name>.pdf) to malware, scareware, or ad-fraud redirects. The pages pad themselves with benign decoy links to dilute classifier scores, so the ML hit alone lands only in the suspicious band. The detector reports only on the conjunction of the ML hit, a visual download lure, and the gateway link — a combination benign PDFs essentially never carry — and promotes the verdict to malicious.
PDF links to an Adobe Reader-themed path on a non-Adobe host.
The document contains a clickable web action whose path presents itself as an Adobe Reader download or update endpoint, but the destination host is not Adobe-owned. That pattern is a strong payload-delivery lure: the PDF itself may be simple, while the user is pushed to install or open content from attacker-controlled infrastructure.
Embedded SWF's ActionScript-3 bytecode loads and executes an inner SWF from raw bytes (allowLoadBytesCodeExecution) and/or Vector heap-spray groomers.
The embedded Flash object's ActionScript-3 constant pool (recovered by the SWF/ABC parser) references exploit-loader primitives: LoaderContext.allowLoadBytesCodeExecution (to execute a second-stage SWF decompressed into a ByteArray) and/or Vector.<uint>/Vector.<Number> heap/JIT spray groomers with raw byte writes. Benign Flash content (sound players, scrollable text, Flex widgets) never loads and runs code from raw bytes; this is a staged Flash exploit delivered through the document. The specific Flash CVE lives in the inner second-stage SWF, so attribution stays family-level.
RichMedia PDF pairs obfuscated exploit JavaScript with a ByteArray/loadBytes SWF loader.
The PDF contains exploit-oriented JavaScript and a SWF ABC stage that loads bytes dynamically. This establishes Flash exploit delivery, but no CVE is assigned until a vulnerability-specific ActionScript trigger is recovered.
An oversized PDF Launch FileSpec triggers the Foxit Reader 3.0 stack overflow after JavaScript heap-sprays native shellcode.
CORE-2009-0218 documents Foxit Reader copying an Open/Execute filename into a fixed-size stack buffer without a length check. This rule requires the vulnerable Launch/FileSpec shape together with a substitution-decoded heap spray and statically recovered native shellcode, and consolidates the generic component findings into one exact CVE attribution.
An HR, salary, payroll, or signing lure hides its action in a QR code.
The decoded QR URL and any cleartext or Base64 recipient identifier are surfaced with the finding.
PDF stream contains a hidden ZIP archive with executable entries.
PDFs can legitimately carry attachments, but normal attachments are declared through /EmbeddedFile, /EmbeddedFiles, or /EF metadata so the viewer and user can treat them as attachments. The detector looks for the different pattern of raw ZIP local-file headers hidden inside ordinary PDF stream bytes, then only fires when ZIP entry names end in executable payload extensions such as .dll, .exe, .scr, .ps1, .hta, or .lnk. Legitimate reasons for DLLs inside a PDF are very rare; a software manual or PDF portfolio should use explicit attachment metadata, not a concealed stream archive.
The recovered icon-channel JavaScript contains a heap spray and percent-encoded shellcode.
This establishes a memory-corruption exploit independently of its concealment layer, while avoiding an unsupported exact CVE attribution.
A localized image-based open/view button links to a long opaque path on a notification/update-themed host.
Detects sparse image-button doorway PDFs while requiring a suspicious destination shape, rather than treating ordinary image links as malicious.
Image-heavy PDF carries a clickable URL with the recipient email address in a query parameter.
Credential-phishing PDFs often render the visible lure as pixels so text scanners cannot read it, then place one clickable area over the screenshot. When that URL also includes the recipient's email address, the landing page can pre-fill the login form and track the victim. The finding requires both the image-overlay presentation and recipient-specific data in the target URL.
An image-based PDF lure links to a syntactically invalid or unregistered hostname.
The finding correlates a clickable image lure with a destination whose hostname is invalid or whose TLD is absent from the local ICANN suffix data. Unknown reputation alone does not trigger it.
An image-only PDF routes actions through multiple unrelated low-context hosts.
Detects play-button and adult doorway PDFs without attempting unsafe or unreliable semantic image classification.
Sparse image/QR PDF links to generated infrastructure while embedding the recipient email address.
Credential-phishing PDFs often render the lure as pixels or a QR-code workflow, then personalize the landing URL with the victim's email address. The email may be cleartext in the path/query or base64-encoded in an email parameter. The detector requires an image-heavy sparse-text PDF, generated or disposable-looking web infrastructure, and a recipient email embedded in the destination URL.
A /JavaScript action references a stream whose terminal filter is JBIG2Decode.
JBIG2 is legitimate for page images, but routing JBIG2-decoded bytes into a JavaScript action is an exploit-family delivery shape. It is related to legacy Reader JBIG2 exploitation; exact CVE attribution requires a proven malformed JBIG2 segment or arithmetic trigger.
PDF combines JBIG2Decode image streams with JavaScript heap-spray or decoder scaffolding.
The exact CVE-2009-0658 rule requires stronger Reader-version or decoded-shellcode fingerprints. This likely rule requires JBIG2Decode plus exploit-preparation JavaScript such as unescape heap-spray builders, large arrays, fromCharCode decoders, or eval dispatch, which is the static shape of the older Adobe Reader JBIG2 exploit family.
A JavaScript stream abuses a mixed compression/image filter chain with extreme dimensions.
CCITTFaxDecode belongs on monochrome image data, not JavaScript. Requiring a JavaScript action, multiple filters, CCITT, and extreme columns makes this a narrow parser-evasion detector.
A deflated /JS stream inflates into a large blob that is almost entirely whitespace wrapped around a small code core.
Classic JavaScript heap-spray shape: a tiny deflated /JS object expands to megabytes of tabs/spaces/newlines — the spray buffer that positions shellcode at a predictable address before a PDF parser CVE is triggered. Benign PDF JavaScript is never megabytes of whitespace, so this is treated as malicious on its own, even when the inner exploit stage cannot be decoded to an exact CVE.
Acrobat JavaScript decodes biased pixel-channel bits and evaluates the recovered stage.
The detector statically replays the bounded bit packing used with iconStreamFromIcon and carves every recovered JavaScript layer without rendering or executing it.
PDF links to redirector infrastructure used by a known malicious PDF campaign.
The detector matches clickable PDF URIs pointing to known redirector infrastructure from the SEO/adware PDF campaign that used ttraff and related domains. The PDF itself is normally a redirect carrier: user interaction sends the browser through the redirector chain, which can end in unwanted software or malware delivery. This is not evidence of a PDF parser CVE.
Launch VBS dropper command chain — CVE-2010-1240 likely
critical
CVE likely
CVE_2010_1240_LAUNCH_VBS_DROPPER
PDF /Launch invokes cmd.exe to build a VBS ADODB.Stream/XMLHTTP/FileSystemObject dropper.
CVE-2010-1240 covers Adobe Reader/Acrobat Launch File dialog abuse. This variant does not rely on PDF EmbeddedFiles; instead the Launch command constructs VBS that either reopens the PDF itself and extracts an appended byte range, or downloads a payload with XMLHTTP, saves it via ADODB.Stream/FileSystemObject, and runs it. The rule requires cmd.exe from /Launch plus VBS dropper APIs to avoid tagging ordinary Launch actions.
PDF contains a /Launch action to start an external application.
A Launch action can start an external application when the action is activated, or on open if it is wired to an open trigger. This is a high-risk PDF feature and is useful evidence when reviewing a document.
Launch/export embedded executable chain — CVE-2010-1240 likely
critical
CVE_2010_1240_EMBEDDED_PE_EXPORT
PDF combines /Launch, EmbeddedFiles/EF, exportDataObject, and embedded executable bytes.
This conservative variant of the CVE-2010-1240 detector covers samples where the Launch dictionary does not expose the strict cmd.exe /Win shape. Requiring all four surfaces keeps benign attachments out while attributing the same drop-and-launch abuse chain.
A PDF wrapper contains a verified Base64 PE and explicitly instructs the user to run it.
The instruction is correlated with a validated executable and must occur in raw content after %%EOF. It identifies manual social-engineering execution without claiming that the PDF viewer automatically launches the payload or renders the instruction.
Document JavaScript matches the CVE-2016-3198 generator-constructor CSP bypass pattern.
The script nulls the generator-function prototype constructor and then invokes the generator constructor to inject script or iframe markup from a crafted document context. The paired operations distinguish the exploit PoC from ordinary generator-function use.
Trailing HTML reconstructs a remote script URL from transformed RGB values.
Executable HTML was appended outside the normal PDF object graph and hides a remote script source behind a constant byte transform. This is polyglot-style malicious delivery rather than ordinary PDF content.
Array-indexed JavaScript properties resolve to exportDataObject with nLaunch enabled.
The PDF extracts an embedded attachment and automatically opens it in its registered handler; the child is the next-stage payload.
Obfuscated multi-stage PDF JavaScript heap-spray exploit
critical
PDF_JS_OBFUSCATED_MULTISTAGE_HEAPSPRAY
PDF JS behind nested filters / a custom rolling-XOR decoder de-obfuscates to a heap-spray / ROP chain.
The PDF JavaScript is hidden behind nested stream filter chains (e.g. ASCIIHexDecode/FlateDecode/ASCIIHexDecode) and/or a custom in-JS decoder (a rolling-XOR 'ffts' stager that XORs each byte with a feedback key and evals the result). After the analyzer unwinds those layers, the recovered stage contains a heap-spray / ROP chain (repeated 0c0c/9090/4141 landing words plus shellcode). A spray that only appears after de-obfuscation is never benign — this is an obfuscated multi-stage Adobe Reader JavaScript exploit. ClamAV often labels these by the dropped Windows payload (Win.Trojan.Agent), which is the second stage, not the delivery; the family is attributed at related confidence because the exact Reader CVE trigger may sit in an even deeper layer.
PDF uses document-review CTA wording but links to an unrelated hosted portal.
The PDF asks the reader to review a shared file, proposal, investment document, or corporate documentation, but the click target is an unrelated hosted application, cloud path, or authentication-looking portal. This is a common phishing delivery shape: the PDF is only a lure, and the external portal performs credential collection or redirection.
An official or prize-themed document directs contact to consumer webmail.
Government, court, bank, and lottery operators do not normally redirect sensitive claims to unrelated free-mail accounts.
PDF automatically launches an encoded PowerShell download-and-execute command.
The PDF combines an open-time /Launch action with cmd.exe or PowerShell, a statically decoded UTF-16LE -EncodedCommand, a network download primitive, and a process-execution sink. The rule extracts the decoded script, URL, temporary output path, hidden-window and execution-policy flags, and correlates a chained app.launchURL action when it targets the same payload. This is explicit malware delivery through viewer features, not a PDF parser CVE.
PDF structural or payload evidence: PDF AcroForm Marker Unescape JavaScript Stager.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF JavaScript contains a cluster of exploit-like primitives.
Multiple suspicious JavaScript primitives appear together, such as heap-spray construction, obfuscation, vulnerable API use, or staged decoding. The cluster requires more than one primitive before reporting the cluster.
PDF JavaScript behavior: PDF JavaScript Shellcode Behavior.
The PDF contains JavaScript evidence for obfuscation, network activity, payload staging, form submission, or exploit-style heap manipulation.
PDF structural or payload evidence: PDF Launch Plus Dropper JavaScript.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF stream length metadata is malformed in an exploit-like way.
The PDF contains stream length inconsistencies or malformed stream boundaries that resemble parser-confusion techniques used by exploit documents.
PDF structural or payload evidence: PDF VBS Hex PE Dropper.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF XFA behavior: PDF XFA Heap Spray.
The PDF contains XFA form content associated with script execution, heap spray behavior, or staged payload recovery.
Acrobat JavaScript prompts for credential-like input and places it in a network request.
This is malicious credential harvesting through supported scripting features rather than memory-corruption exploitation.
PDF JavaScript reconstructs and evals a hidden stage from every Nth byte of an embedded file.
The JavaScript reads a declared PDF EmbeddedFile with getDataObjectContents(), converts it with util.stringFromStream(), takes characters at a fixed stride, and evaluates the reconstructed stage. Evaluation of attachment bytes is executable staging behavior, not normal attachment handling. The decoded stage is carved for review.
PDF exploit shellcode decodes to download-and-execute payload
critical
PDF_JS_FIXED_XOR_DOWNLOAD_EXEC_SHELLCODE
Recovered PDF shellcode statically XOR-decodes to a native URLMON downloader and executable launcher.
Requires a bounded x86 call/pop XOR loop plus decoded PEB walking, URLMON and a hardcoded URL. Both stages are carved and no CVE is inferred.
PDF carries >=4 links to .php gateways with a multi-word search-phrase document slug (pharma / binary-options / SEO spam).
Legitimate PHP-served documents use a filename or numeric id, not a multi-word search-query phrase. Four or more links of the shape 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf' — whether spread across hosts or clustered — are a generated SEO link farm that ranks for queries and routes users into payload/redirect chains. The PDF is an inert link carrier; the risk lives in the linked destinations.
Single PDF JavaScript body branches on viewerVersion and invokes multiple Reader CVE sinks.
The 2009-2010 Pidief.J template carries three Reader exploits in one PDF: CVE-2007-5659 (Collab.collectEmailInfo), CVE-2008-2992 (util.printf with a field-width %f format string), and CVE-2009-0927 (Collab.getIcon). A small dispatcher reads app.viewerVersion and fires the matching sink. The rule requires both a viewerVersion switch and two or more distinct CVE sinks in the same JavaScript body, so it doesn't fire on benign code that mentions one of them.
PDF action body contains a PowerShell download-and-execute cradle.
Patterns matched include `Invoke-Expression(Invoke-RestMethod ...)`, `IEX(IRM ...)`, `(New-Object Net.WebClient).DownloadString`, `[Net.WebClient]`, `[Net.ServicePointManager]::SecurityProtocol`, and `powershell -ep Bypass -enc <base64>`. These strings are rare in benign PDFs. Their presence records PowerShell execution and remote retrieval staging (MITRE T1059.001 and T1105).
A PDF Launch action retrieves remote content and pipes it to an IEX-equivalent sink.
The command is decoded from the Launch dictionary, including schemeless hosts and simple string-obfuscated Invoke-Expression forms, and its network target is surfaced as an IOC.
A protected receipt, invoice, or document lure opens an unrelated collaborative-workspace tenant.
Correlates the rendered protected-document prompt with its LarkSuite, Notion, Airtable, Fobizz, or Coda action target.
PDF contains a QR-like image and business-process scan instructions hidden with invisible text characters.
Some QR phishing kits insert zero-width or bidi control characters into words such as contract, QR code, appraisal, compensation, or review. The text renders normally to the recipient but breaks byte-oriented matching. The detector normalizes invisible characters and requires both a QR-like image and business-process scan wording, so ordinary QR codes are not matched on image shape alone.
A sparse recipient-address PDF links to arbitrary hosted infrastructure.
Correlates visible recipient personalization with a user-controlled hosting tenant.
PDF uses invisible/repeated links to deliver a direct payload file.
Repeated invisible link annotations pointing to an archive or executable match malware-delivery PDFs where the visible page is just a lure and the actual payload is downloaded from the linked URL. Lure-like filenames such as document/unlock/verify archives further increase confidence.
A repeated obfuscated link overlay embeds a Base64 recipient address.
Requires at least ten identical search-redirect annotations plus a decodable email recipient, distinguishing targeted overlay phishing from ordinary links.
RichMedia AES demo paired with PDF-side shellcode stage
critical
PDF_RICHMEDIA_AESPHP_SHELLCODE_STAGE
PDF embeds an AESFlashToPHPDemo RichMedia SWF while OpenAction JavaScript builds shellcode.
The embedded SWF can look like ordinary Flash demo content in isolation. The detector requires that RichMedia AES/Flash demo shape plus a PDF-side Lookup/String.fromCharCode heap-spray shellcode builder with downloader evidence such as urlmon.dll, update.exe, or an Adobe-2010-1297 URL. This separates exploit delivery PDFs from benign RichMedia demos.
PDF combines RichMedia Flash activation, an AS3 ByteArray/loadBytes SWF, and shellcode staging.
CVE-2011-0611 affects Adobe Flash Player and Adobe Reader's Authplay Flash handling. The detector requires a RichMedia Flash annotation, an embedded SWF with AS3 ByteArray/loadBytes loader logic, and either PDF-side or SWF-internal shellcode/heap-spray staging. Those gates separate exploit-delivery PDFs from ordinary RichMedia content.
Small PDF contains many clickable external PDF links clustered on one host.
Generated malicious PDF campaigns often use scraped text and many clickable PDF URLs to make documents appear in search results and route users through attacker-controlled or compromised link farms. The rule is gated on a small file with many external .pdf URI actions clustered on one host to avoid treating ordinary references as malware. This is social-engineering and redirect-chain evidence, not a PDF parser CVE fingerprint.
Search-themed obfuscated getURL redirector campaign
critical
PDF_JS_SEARCH_REDIRECTOR_GETURL_CAMPAIGN
PDF document JavaScript opens a known search-themed redirector campaign URL.
The detector is constrained to document-level JavaScript that percent-obfuscates a getURL() target under known search-themed redirector infrastructure and a numeric /in.cgi query. The samples are malicious redirect carriers, but the evidence is delivery infrastructure rather than a PDF parser CVE fingerprint.
PDF document JavaScript opens the known SearchGlobalSite redirector campaign URL.
The detector is constrained to document-level JavaScript that percent-obfuscates a getURL() target of searchglobalsite.com/in.cgi?11. The samples are malicious redirect carriers, but the evidence is delivery infrastructure rather than a PDF parser CVE fingerprint.
PDF (or its embedded JavaScript stub) instantiates Shell.Application and calls ShellExecute.
Some PDF readers prompt the user before honouring a /Launch action. Attackers sidestep that prompt by having a JScript stub (typically loaded via mshta as a `javascript:` URL) instantiate the Shell.Application COM object and call ShellExecute to spawn the next-stage process — the reader's /Launch warning may not fire because the spawn happens inside the mshta host, not inside the PDF reader.
A free/full-movie lure links to an unrelated non-media host.
Detects multilingual one-link streaming carriers, including those parked on compromised organization websites.
Substitution-obfuscated heap spray with oversized Launch trigger
critical
PDF_JS_SUBSTITUTION_HEAPSPRAY_OVERSIZED_LAUNCH_EXPLOIT
A constant-alphabet JavaScript decoder reconstructs native shellcode beside an oversized PDF Launch FileSpec.
Requires independent evasion, native-payload, and trigger evidence: a bijective substitution table, recovered shellcode, and a Launch target of at least 4096 bytes. It establishes an exploit chain without guessing a CVE.
Tatsumaki/Arashi Flash exploit family — CVE-2011-0611 related
critical
PDF_TATSUMAKI_CVE_2011_0611_RELATED
Tatsumaki.swf is present and parsed ABC surfaces expose its ByteArray/loadBytes groomer.
The Tatsumaki component is associated with the Arashi Adobe Reader X CVE-2011-0611 exploit chain. Detection requires both the family asset name and parsed ActionScript loader/write primitives; it remains related until instruction-level AVM2 type-confusion behavior is proven.
PDF JS embeds a SHA-1 routine keyed on the victim's wall-clock minute to XOR-decrypt and eval a payload.
The PDF JavaScript embeds a full inline SHA-1 implementation and derives an XOR key from the victim's wall-clock minute (getHours()+''+getMinutes()); the digest decrypts a small ciphertext array that is then eval'd, with a catch{} block retrying the previous minute for clock-rollover tolerance. The wall-clock keying is a deliberate anti-static / anti-sandbox measure — the decryption key only exists at the victim's open time, so the encrypted stage cannot be recovered by static analysis (~1440 possible minute keys, no validation oracle). The loader construction is nonetheless conclusive: no legitimate PDF hashes the clock to eval code. This is a known pre-2011 PDF exploit-kit loader whose encrypted second stage is an Adobe Reader JavaScript exploit; attributed at related confidence as an exploit-kit family because the exact CVE trigger is time-locked out of view.
U3D parser exploit with JavaScript heap spray — CVE-2011-2462 likely
critical
CVE likely
CVE_2011_2462_U3D_HEAPSPRAY
PDF combines U3D/3D annotation content with JavaScript heap-spray shellcode.
Public CVE-2011-2462 exploit chains use a crafted U3D stream and JavaScript heap spray to control memory during Adobe Reader's U3D parser memory corruption. The rule requires both U3D/3D content and a heap-spray JavaScript shape, avoiding attribution for ordinary 3D PDFs.
PDF combines U3D stream markers with RichMedia and JavaScript/XFA activation surfaces.
U3D exploit documents match when the U3D marker is present in stream data but not exposed through the canonical /Subtype /U3D dictionary. The detector also requires RichMedia and an active JavaScript or XFA surface. A standalone 3D asset does not match.
PDF comment text contains a decimal byte array that decodes to a verified MZ/PE executable payload.
Some malicious PDFs hide a Windows executable in commented VB/VBScript-style source lines such as Array(c(077),c(090),...). The detector only fires when that concealed decimal array decodes to a valid MZ/PE header. A numeric array that does not decode to a PE does not match.
PDF JavaScript hides exploit tokens by inserting whitespace between source characters.
A bounded normalization pass recovered executable JavaScript with shellcode or heap-spray markers from an overwhelmingly single-character token stream. This is a deliberate scanner-evasion form, not ordinary JavaScript formatting.
PDF document JavaScript opens the known WwwSearchSites redirector campaign URL.
The detector is constrained to document-level JavaScript that percent-obfuscates a getURL() target of wwwsearchsites.com/in.cgi?10. The samples are malicious redirect carriers, but the evidence is delivery infrastructure rather than a PDF parser CVE fingerprint.
A non-image XFA image payload decodes to command and network shellcode strings.
The hex payload lacks its declared image signature and a single-byte XOR decode reveals process-launch and HTTP indicators, strongly identifying embedded payload code.
PDF JavaScript calls exportDataObject() with nLaunch set, extracting and launching the document's embedded file on open.
exportDataObject({cName:..., nLaunch:2}) writes the PDF's embedded file to a temp folder and opens it in its default handler — a launch-on-open dropper. The embedded file is the real payload (commonly a VelvetSweatshop-encrypted Office document wrapping an Equation Editor exploit, or a script/executable). Automatic launch of an extracted attachment constitutes executable payload delivery.
PDF defines an /OpenAction whose target object cannot be reached by walking indirect references from the document /Root catalog tree.
When a PDF is opened, the /OpenAction fires regardless of whether the target object is reachable from the catalog. Many static analysers and indexers enumerate the document via the /Root tree and never see hidden objects — yet the action still runs. This shape is associated with evasive samples that hide JavaScript or launch actions outside the normal catalog descent.
Adobe Reader APSB08-13 patch-range version gate (CVE-2007-5659)
high
PDF_JS_ADOBE_APSB08_13_PATCH_GATE
PDF JavaScript gates the payload on the Reader 7.0.x / 8.0–8.1.1 window.
A version gate of (>= 8 && < 8.11) OR (< 7.1) is the exact Reader release window patched by Adobe APSB08-13 for CVE-2007-5659 (Collab.collectEmailInfo buffer overflow). Pidief-family PDFs use this gate to fire the collectEmailInfo trigger only on vulnerable Readers and stay quiet on patched ones.
Adobe Reader APSB09-15 patch-range version gate (CVE-2009-3459)
high
PDF_JS_ADOBE_APSB09_15_PATCH_GATE
PDF JavaScript gates the payload on the exact Adobe APSB09-15 patch boundary.
A single JS body that simultaneously checks Reader version against 9.2, 8.17 (=8.1.7), and 7.14 (=7.1.4) is fingerprinting the APSB09-15 patch range, which covered CVE-2009-2990 (U3D CLODProgressiveMeshDeclaration heap overflow) and CVE-2009-3459 (FlateDecode predictor integer overflow). No benign script tests all three of those Reader version points together; this is exploit-kit dispatcher logic.
PDF uses Adobe secure-document/viewer lure wording and links to a non-Adobe host.
This catches fake 'View on Adobe', 'OnlineAdobe', or secured-PDF viewer carriers. The rule requires a clickable HTTP(S) destination outside Adobe-owned domains, so ordinary documents that merely mention Adobe do not match. Image-heavy or sparse-text PDFs using this wording are common credential-phishing carriers.
An adult or viral-video lure uses a URL shortener or smart link.
Combines explicit lure wording with an actionable redirector rather than judging either signal alone.
PDF JavaScript decodes an annotation /Subject payload with marker replacement and a callee.toString-derived key.
Agent-359xx/361xx style PDFs use syncAnnotScan()/getAnnots() only as a staging primitive: JavaScript reads an indirect annotation /Subject stream, rewrites marker bytes such as F/A/E or z to percent signs, or splits short delimiter-prefixed hex bytes such as mz/xyz. The recovered second-stage decoder then derives a small key from arguments.callee.toString() or an embedded numeric table to decode the final exploit JavaScript. The rule is emitted only after static decoding recovers exploit-like JavaScript; the exact CVE is then assigned by scanning the recovered stage for the real vulnerable API.
PDF JavaScript rebuilds hidden exploit code from annotation /Subject fields.
This family uses syncAnnotScan()/getAnnots() only as a staging primitive. The visible OpenAction reads an annotation /Subject value, splits marker-prefixed hex bytes into a second-stage decoder, and that decoder reads another annotation subject and decrypts two-character pairs with a digit key before evaling the recovered JavaScript. The rule is emitted only after static decoding recovers exploit-like Acrobat JavaScript; CVE attribution comes from the vulnerable API in the recovered stage.
PDF JavaScript shows the annotation use-after-free exploitation shape (addAnnot spray + destroy free + getAnnot re-entry + getter/leak).
Modern Adobe Reader exploits corrupt memory by spraying annotation objects with addAnnot(), freeing one with .destroy(), then re-entering through a getAnnot()/getAnnots() callback installed via Object.defineProperties (often with an annotation named 'uaf' and an Int32Array/ArrayBuffer info-leak). This is the reusable use-after-free shape behind several Reader annotation CVEs, so it is surfaced as a memory-corruption pattern rather than pinned to one CVE; the exact CVE depends on the targeted Reader build.
PDF JavaScript rebuilds an exploit stage from base-N character pairs.
Some PDF exploit kits store the real payload as a long string of two-character tokens, decode each pair with parseInt(radix), turn the bytes into JavaScript with String.fromCharCode, and eval the result. The rule is bounded to long pair tables in JavaScript streams and only fires when the recovered stage contains concrete exploit markers.
PDF links to a Microsoft-login impersonation domain.
The URI host imitates Microsoft login or Microsoft Online branding but is not a Microsoft-owned domain. This is a credential-phishing signal and does not require active PDF code to be dangerous.
PDF uses CCITTFaxDecode alongside active-content indicators.
CVE-2010-0188 was widely exploited as a LibTIFF integer overflow primitive delivered via PDF. The rule matches /CCITTFaxDecode plus JavaScript, XFA, or RichMedia evidence; it does not validate malformed TIFF/CCITT data.
CFF CharStrings contain an unusually high number of subroutine calls.
Dense callsubr/callgsubr usage stresses call-stack, bias, and bounds logic in CFF interpreters.
Type 2 CharString bytecode invokes an operator without enough operands.
Underflow forces different font interpreters to reject, pad, or continue from corrupted state, which is the kind of parser divergence used by font-engine exploits.
CFF INDEX or header declares an offSize outside the spec-allowed 1..4 range.
Implementations that accept the invalid value as a hint for offset-array stride read or write off-by-N-byte misaligned data — a shape associated with multiple Acrobat font-engine CVEs.
CFF INDEX's offset array contains entries that decrease, so successive elements appear in unexpected order.
Renderers that compute element sizes via subtraction (offset[i+1] - offset[i]) read negative or implausibly large values when offsets are non-monotonic — a known bug class in CFF parsers.
CFF INDEX offset array or data section is declared to extend beyond the available font bytes.
Renderers that follow the declared offsets read attacker-influenced bytes from adjacent memory. This is the structural shape behind several Acrobat CFF-parser CVEs.
CFF Top DICT points the Private DICT outside the embedded font stream.
The Private DICT controls subroutine and hint metadata. Out-of-range Private offsets create parser divergence and are a useful font-engine exploit primitive.
CFF2 blend bytecode grows the operand stack beyond expected bounds.
Large operand-stack growth in CFF2 CharStrings is a font-engine parser exploit surface, especially when BLEND operators are present.
CFF2 blend/stack bytecode consumes operands that are not available.
Operand-stack desynchronisation around BLEND and arithmetic operators is the key static shape from Project Zero's Adobe CoolType BLEND analysis.
Embedded CFF2 font bytecode contains repeated BLEND operators.
CFF2 blend operators drive variable-font CharString stack handling. Repeated BLEND usage in embedded PDF fonts is a strong parser-stress signal related to the Adobe CoolType BLEND bug class described by Project Zero.
PDF JavaScript rebuilds an exploit stage through character-table indexes and eval.
Older PDF exploit kits hide the real Adobe Reader exploit APIs by keeping a small alphabet string and appending hundreds of single-character substr/charAt lookups into an array before join()+eval. The finding is emitted only after the bounded static decoder reconstructs an exploit-like stage, making it a low-cost fallback when exact CVE signatures are unavailable or were hidden from the first scan pass.
PDF clickable URI hides its real host as an obfuscated IP literal or behind a brand-looking user@ userinfo.
Legitimate links never encode their host as hex/octal/dword integer octets, and never hide a real IP destination behind a brand-shaped 'name@' user-info prefix that the browser discards. Both forms exist only to make the rendered link read like a trusted site while routing to disposable IP infrastructure — a hallmark of phishing and malware redirectors.
A clickable link carries the recipient email base64/URL-encoded in a query parameter or #fragment on generated/wrapper infrastructure.
Phishing kits stamp the target's email into the landing URL so the page pre-fills and tracks the credential form per recipient. When the address is base64- or URL-encoded (in a query parameter or the #fragment, which never reaches origin-side logs) it is deliberately hidden from plain-text inspection. Unlike PDF_QR_RECIPIENT_PERSONALIZED_LINK this does not require an image-heavy lure, so it catches links delivered behind URL-security rewrites (secure-web) or open-redirect wrappers with ordinary text. The decoded token must be a valid email and the host generated/disposable or lure-keyworded, so ordinary tracking parameters do not match.
A PDF /ObjStm stream contains active-content keys such as /JavaScript or /OpenAction.
Object streams are valid PDF, but hiding executable objects inside compressed object streams is a common way to bypass simple static scanners that do not expand /ObjStm content.
PDF's embedded link hides a pirated-software title as a base64 blob in the URL (and/or carries the download| doorway marker).
TCPDF-generated SEO doorway PDFs that rank for software-piracy searches and funnel users to fake crack/keygen download pages. Unlike the plaintext link-farm lure, the pirated-software title is base64-encoded inside a single URL's path/query (never in visible text), which evades the visible-text and multi-link plaintext rules. The rule fires on the exact 'download|' doorway-template marker or on a base64 URL segment that decodes to piracy vocabulary (crack, keygen, serial key, torrent, patch), both of which a legitimate document effectively never produces. The PDF carries no parser exploit — the risk is the linked crack-download destination, so it is capped at suspicious on its own.
PDF cracked-software lure links are paired with encoded download-gateway redirectors.
This is a stronger form of the cracked-software lure family: the PDF contains several crack/keygen/serial-key links and also carries long encoded download-gateway URLs or known crack-download redirector hosts. That combination indicates an SEO lure whose purpose is to funnel users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers. The PDF itself is still a link carrier, not a parser exploit.
PDF clickable URI points directly to an executable, script, shortcut, disk image, or archive.
A document that links straight to a runnable payload or archive is a delivery risk. Legitimate manuals can link to installers, so the detector is strongest when combined with invisible link annotations, repeated links, or social-engineering wording.
An image-centric open/view overlay routes to multiple unrelated destinations.
Detects the common blurred-document and central file-icon phishing presentation through structural correlation.
PDF links to a non-reputable host using a document-phishing landing path.
Some secure-document phishing PDFs rasterize the visible DocuSign/Adobe lure text or encode it through custom fonts, so in-process text extraction cannot always recover the brand wording. The detector therefore examines small linked PDFs whose clickable URL uses document-phishing landing shapes such as wp-admin/wp-admin-like staging, project/folder/rfq index.php routes, repeated slm2 paths, or heavily percent-encoded symbol slugs on non-reputable hosts.
PDF links to a serverless free-hosting subdomain named like a document-signing workflow.
Serverless platforms hand out arbitrary subdomains (workers.dev, pages.dev, web.app) that phishing kits name after document-signing workflows (document-review-sign-pending...). Three distinct workflow words are required in the host label, so ordinary project names with a single incidental word never fire.
PDF references a /JS stream with inline JavaScript code.
An inline JavaScript stream can contain obfuscated exploit code that triggers when the PDF is opened. It is a red flag unless the PDF is a known interactive form.
PDF stream bytes contain Windows or HTML script execution markers.
ActiveXObject/CreateObject, WScript.Shell, PowerShell, ADODB.Stream, and HTML <script> markers inside ordinary PDF streams indicate a hidden second-stage script payload rather than normal PDF JavaScript.
PDF declares /Encrypt and also contains /JavaScript, /Launch, or an OpenAction resolved to an executable action dictionary — payload is hidden from static analysis. Navigation-only OpenAction destinations are excluded.
Document encryption hides the JavaScript body and stream contents from static scanners. When executable triggers are also present, the encrypted content may conceal payload code from static inspection. droppers may use empty user passwords so the reader decrypts and runs the payload without prompting for a password.
PDF image lure hides its clickable HTTP(S) URI with PDF octal string escapes.
PDF literal strings may legally encode characters as octal escapes, but phishing carriers often encode URL punctuation this way so simple URL extractors miss the destination. Combined with an image-heavy, low-text document, this is a strong screenshot-lure signal.
PDF's clickable action targets a /app/<id>/<slug>-game-hack redirector.
Landing-page PDFs for a large SEO 'free spins / generator / game hack' lure family (coin master, robux, roblox, tiktok, etc.). The single clickable action is a redirector of the shape https://<rotating-host>/app/<numeric-id>/<slug>-game-hack that funnels victims through disposable hosts to a malware or scam payload. The host rotates, so the rule anchors on the highly specific URL path; the multi-link variants also trip ML/link-farm rules, while this catches the single-link variants that otherwise score clean.
PDF links to a document/account-themed hostname on free static hosting.
The clickable URL is hosted on a free static app platform and the hostname itself combines document/account lure terms such as drive, account, file, document, or login. This is a common credential-phishing landing-page pattern and is not normal for ordinary document references.
A free gift-code, reward, points, or generator lure links to an unrelated host.
Requires both material reward language and an actionable destination mismatch, avoiding classification from incidental gift-card discussion alone.
A government or judicial notice links to user-controlled hosting.
Official summons and court documents should not deliver their action through unrelated wildcard-hosting tenants.
PDF bytes contain a zero-size external HTML iframe.
A hidden iframe pointing to an external URL is a browser exploit-kit or redirect/dropper pattern. It is not normal PDF structure, so the detector is high-signal while remaining cheap to evaluate.
ICC tag entry points at byte ranges outside the embedded profile (or inside the tag-table region).
Colour-management stacks that follow the offset blindly read attacker-influenced bytes from adjacent memory. This shape has driven multiple ICC-parser CVEs and remains a regular finding in font/colour fuzzing campaigns.
PDF image lure with a clickable multi-word utm_term / FeedBurner-proxied SEO redirector link — the 'free ebook/manual download' phishing family.
The 'free ebook / solution-manual / document download' SEO-phishing family ships a tiny image-only (or image + filler-text) PDF whose single clickable /URI is a search-keyword gateway — a multi-word utm_term/keyword redirector (the natural-language phrase the page ranks for) or a FeedBurner-proxied feedproxy.google.com/~r/.../uplcv hop abusing a trusted Google host. The PDF carries no exploit; the payload lives on the linked destination. The broader PDF_SEO_DISPOSABLE_LINK_FARM detector requires many links and does not cover single-link variants. ClamAV and the ML model may also miss variants padded with a few text pages. Pairing the redirector with an image lure produces a HIGH finding regardless of text-page count or ClamAV/ML results. The redirector alone (no image lure) is surfaced at LOW as an IOC only.
Image-only PDF contains both remote HTTP(S) links and a local file:/// builder path.
A scanned or photo PDF may legitimately be image-only, and a normal document may contain external links. The suspicious combination here is narrower: a click-action image lure exposes a local file:/// path such as a user desktop, appdata, temp, or generator work directory while also linking to remote web infrastructure. That points to generated clickbait/phishing carriers rather than a normal document workflow.
An image-centric PDF links to a watch/video/play path outside recognized video services.
This is the structural fake-player and traffic-redirect pattern; it is host-independent and requires an actionable destination.
PDF uses invisible link annotations over image-heavy content to send users to a suspicious URI.
The finding requires several conditions: a small image-heavy PDF, invisible link annotations (border [0 0 0]), and a URI on a high-risk TLD with account/login/verify/security/support-style wording or a staged path such as /step1. That combination is stronger than a generic external link because it matches credential-phishing PDFs where the visible document is a screenshot-like prompt and the actual collection flow is hosted on the linked site.
Image-only PDF's clickable action targets a host impersonating a service/brand word with a leetspeak digit substitution (serv1ce, upd4te, …).
Screenshot-like phishing/fake-update PDFs render an image and a single clickable action whose destination host impersonates a security, service, or brand word using a leetspeak digit in place of a letter (e.g. 'serv1ce', 'l0gin', 'm1crosoft', 'payp4l'). The rule fires only when the document is image-only with little real text AND the destination is not a known-good (Tranco/allowlisted) domain, so a legitimate flyer linking to its real site is unaffected. The digit-for-letter substitution is the deception tell.
Image-only PDF's clickable action targets a host beginning with a literal 'http.'/'https.' label.
Screenshot-like phishing PDFs render a brand image plus an open/download button whose destination host starts with a literal 'http' or 'https' DNS label. The hostname imitates a URL inside a throwaway domain. The image-only presentation and disguised destination identify a credential-phishing carrier.
PDF screenshot/button lure links to a public file-hosting download endpoint.
The finding requires several conditions: the PDF is image-only or nearly image-only, contains a clickable PDF action/button, and the target URL points to a public file-hosting download endpoint such as Pixeldrain, Gofile, Filemail, file.io, transfer.sh, Catbox, MediaFire, or Workupload. That combination is much stronger than a generic URI or image-only PDF because it matches malware-delivery lures where the visible page is just a fake document/download prompt and the actual payload is retrieved from external hosting.
PDF uses invisible links to a CAPTCHA/capcha-themed web path.
CAPTCHA-themed landing pages are commonly used in phishing and ClickFix chains to move the user out of the document and into a fake verification flow. Invisible PDF link annotations make this stronger than an ordinary visible web reference.
PDF uses invisible link annotations that point to an OAuth authorization URL with a redirector chain.
OAuth authorization URLs with client_id, response_type=code, and redirect_uri parameters are legitimate in web apps, but are unusual as repeated invisible PDF link targets. When the redirect_uri leads through safelink/photo-link redirect infrastructure, the shape matches credential-phishing PDFs that hide the actual collection site behind trusted-looking redirects.
JBIG2 segment refers to one or more later segments by number.
Spec-conformant JBIG2 streams only refer backwards. Forward references are the structural shape that drove the FORCEDENTRY family of JBIG2 0-days (CVE-2021-30860 and relatives) — they confuse refcount tracking when the renderer dereferences a segment that has not been parsed yet.
JBIG2 segment refers to a segment number that has not been declared earlier in the stream.
This is the JBIG2 equivalent of a dangling pointer. Renderers that treat the missing segment as null follow a different code path than renderers that abort or read uninitialised state — a known parser-confusion primitive.
JBIG2 segment lists its own segment number in its referred-to list.
The JBIG2 spec does not define what happens when a segment refers to itself, and renderers that follow refcount paths through self-references are a textbook exploit shape (recursive resolution, double-free, use-after-free).
JBIG2 segment uses the 0xFFFFFFFF 'unknown length' form on a segment type other than generic region.
The spec restricts the unknown-length form to generic-region segments (types 36, 38, 39). Using it on other segment types lets the parser continue past the intended segment boundary and read attacker-controlled bytes from later segments.
COD marker declares more than the spec-maximum 32 wavelet decomposition levels.
Buffers and lookup tables sized from the decomposition-level count overflow on real implementations once the count exceeds 32.
PCLR (palette) sub-box declares more than the spec-maximum 1024 entries.
Palette allocators sized from this 16-bit field overflow when the declared entry count exceeds 1024 — a known-vulnerable shape across multiple JPEG2000 implementations.
JPEG2000 SIZ marker declares image dimensions, image offsets, or component counts outside plausible ranges.
SIZ overflows have triggered several past JPEG2000 parser bugs because downstream allocators multiply width × height × components × bit-depth. Zero dimensions, image offsets at or past dimensions, and absurd component counts are all known-bad shapes.
JP2 box header declares a total length less than 8 bytes (the minimum for the size+type header alone).
Spec-conformant boxes are at least 8 bytes; smaller declarations cause the box walker to either loop or read box headers from the middle of the previous box's body, a known evasion shape.
JP2 box declares a length that runs past the available stream bytes.
Different readers handle the broken box differently — some clamp to stream end and continue, some abort, some resync to the next plausible box header — leading to divergent interpretation of image geometry.
jp2c codestream box does not begin with the required Start Of Codestream (FF 4F) marker.
Renderers that tolerate the missing marker and those that abort see different content. Some implementations search forward for the next FF xx marker, which lets attacker-supplied bytes between the box header and the SOC be treated as codestream content.
jp2h header box does not begin with the mandatory ihdr (image header) sub-box.
Strict readers reject the file; lenient readers parse downstream sub-boxes anyway and infer image dimensions from defaults or from later codestream markers — leading to differing interpretations of image geometry between scanner and viewer.
Two top-level JP2 boxes claim overlapping byte ranges.
The spec requires non-overlapping box concatenation. Overlap lets a reader interpret the same bytes as two different boxes — a deliberate way to hide content from one parser while presenting it to another.
PDF uses JPXDecode/JPEG2000 alongside active/exploit-delivery indicators.
CVE-2018-4990 is an out-of-bounds write in Adobe Reader's JPEG2000 parser. The rule matches /JPXDecode plus JavaScript, XFA, or RichMedia evidence; it does not validate malformed JPEG2000 codestream data.
PDF contains a /JavaScript action.
JavaScript embedded in a PDF can interact with the viewer, exploit vulnerabilities, or download external content. Most legitimate PDFs do not need JavaScript. This is the most common PDF exploit vector.
PDF JS schedules a callback with a multi-kilobyte string (heap-spray primitive).
app.setTimeOut / app.setInterval with a multi-kilobyte string argument is the common PDF heap-spray primitive: it fills the renderer's heap with attacker-controlled bytes so a corrupted pointer lands in the spray.
PDF JavaScript uses a large numeric index table and indirect eval to rebuild a hidden stage.
Older PDF exploit kits sometimes keep the first recovered stage encrypted or otherwise encoded, so a static decoder cannot always validate a final CVE API. The launcher is identified by a large ar[] numeric table, a short cc character table, anti-analysis exception scaffolding such as loadXML({}), and an indirect eval sink.
File has a PDF header but no indirect objects, xref table/stream, or startxref pointer.
Normal PDFs need an object graph and cross-reference structure. A large PDF-header blob with no objects is not renderable content; it is more consistent with parser fuzzing, evasion, corruption, or an exploit test case than a benign document.
A Facebook or Meta violation/deactivation warning sends its appeal to a non-Meta domain.
Correlates account-pressure wording with the actual link host; legitimate Meta notices linking to Meta infrastructure are excluded.
PDF document JavaScript opens an obfuscated redirector URL with getURL().
The rule is constrained to document-level JavaScript that calls getURL() with a percent-escaped HTTP(S) URL and a redirector-style endpoint such as /in.cgi or /go.php. This catches redirect-carrier PDFs where the outbound URL is hidden in JavaScript instead of a normal /URI action, while avoiding broad matches on benign visible getURL links. This is malicious routing behavior, not a PDF parser CVE fingerprint.
Obfuscated Pidief-style JavaScript loader (stage not decoded)
high
PDF_PIDIEF_OBFUSCATED_VERSION_GATED_LOADER
PDF JavaScript carries a large opaque encoded stage built to be eval'd, but the encoding resisted full static decoding so no exact CVE could be attributed.
Structural fallback for the Pidief / multi-CVE exploit-kit loader family. The document has JavaScript plus a large opaque encoded stage (a z<hex> custom alphabet, or a numeric character-code array the loader sums/XORs and evals) that no exact-CVE, multi-CVE-kit or heap-spray rule could attribute because the scheme could not be fully decoded. A version-gated obfuscated JavaScript stage has no benign use; flagged suspicious on its own and pushed to malicious by an ML/AV signal or a recovered heap-spray.
Composite signal of pre-2011 Adobe Reader exploit-kit dropper shape.
Fires when the PDF JavaScript shows three or more independent signals of exploit-kit-style multi-stage obfuscation: annotation-subject payload staging (reading pr[N].subject after getAnnots), String.fromCharCode hex decoder loops, long -hh-hh-hh hex-dashed payloads, incremental construction of a method name starting from 'ev' (to hide an eval call), and three or more app.plugIns.length anti-analysis gates. The actual CVE is hidden in the final decoded layer and is not visible via static analysis, but the template is strongly consistent with exploit-kit style payload staging.
Same indirect object (N G) is defined more than once in the file, and the definitions declare different /Filter chains.
Readers that take the first definition decode different bytes than readers that take the last definition (PDF spec is ambiguous on which wins; Acrobat takes last). Divergent filter chains across the duplicates is a deliberate parser-divergence pattern: benign content is shown to scanners while malicious content is shown to the actual reader.
PDF has an /OpenAction that performs an action when the file is opened.
OpenAction specifies an action or destination to perform when the document is opened. It can execute JavaScript when paired with a JavaScript action, but OpenAction is not always code by itself.
Malformed EBSC max-range record appears alongside EBLC/EBDT bitmap tables.
EBSC is used for embedded bitmap scaling metadata. A max-range EBSC record paired with bitmap glyph tables is an Adobe libCoolType-specific parser differential related to CVE-2023-26369.
sfnt EBSC table record declares offset=0xffffffff and length=0xffffffff.
Project Zero noted the CVE-2023-26369 proof-of-concept font used this malformed EBSC table record to prevent the font from loading in many font parsing libraries while Adobe libCoolType still processed the bitmap tables.
Embedded OpenType variable font declares an implausibly large itemVariationDataCount.
Adobe Acrobat Reader has had memory-safety bugs in VariationStore itemVariationData allocation and indexing paths. Huge counts are malformed structural inputs to that parser path.
VariationStore or itemVariationData offsets point outside the containing table.
VariationStore offset arrays are pointer-like fields in OpenType variable font tables. Out-of-range entries are the structural class described in Talos' Acrobat Reader VariationStore analysis.
A cmap encoding record points outside the cmap table.
Out-of-range cmap offsets are a common structural parser bug shape.
OpenType embedded-bitmap component placement exceeds bitmap buffer
high
PDF_OPENTYPE_SBIT_COMPONENT_OOB
EBLC/EBDT compound bitmap glyph metadata positions a component beyond the computed bitmap buffer.
CVE-2023-26369 exploited missing bounds checks in Adobe libCoolType's sfac_GetSbitBitmap when merging embedded bitmap glyph components. The scanner computes the bitmap buffer size from glyph metrics and flags component offsets whose merge index exceeds that buffer.
A loca entry points beyond the glyf table.
Out-of-range glyph offsets are a direct font parser memory-safety primitive.
The head table is too short to carry indexToLocFormat.
Without a valid indexToLocFormat, loca offsets can be interpreted with the wrong width.
head.indexToLocFormat is outside the valid 0/1 range.
Invalid loca format values create parser divergence in glyph offset decoding.
itemVariationData subtable has impossible item or region counts.
Malformed itemVariationData metadata can desynchronise Adobe's variable-font VariationStore parser and is worth surfacing as font exploit-surface evidence.
loca glyph offsets are not monotonically increasing.
Decreasing glyph offsets imply overlapping or negative-size glyf records.
loca cannot hold numGlyphs+1 offsets.
A too-short loca table can make glyph lookup read past the embedded table.
The maxp table is too short to declare numGlyphs.
Glyph table validation depends on maxp.numGlyphs. A truncated maxp table can make readers disagree over glyph bounds.
sfnt table-record entry's offset+length lies beyond the embedded font bytes.
Renderers that follow the offset blindly read attacker-influenced bytes from adjacent memory. The OpenType table directory is the first structure parsed in any sfnt font, so this affects every font-engine code path.
PDF structural or payload evidence: PDF Affiliate Scam Review Lure.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Arithmetic Percent JavaScript Stager.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Binary Xor JavaScript Stager.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Disposable Redirector Campaign.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF fans out to many disposable random-subdomain redirector links.
The document links to many distinct random-word subdomains of one or more throwaway registrable domains, each link using a short high-entropy path code. This per-recipient fan-out is the delivery structure of mass phishing / redirector campaigns: the PDF is only a lure and each link routes to attacker-controlled credential-harvest or payload infrastructure.
PDF structural or payload evidence: PDF Embedded Child Static Triage.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Exfiltration Sink URL.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Fake Acrobat Update Lure.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF image-lure link pattern: PDF Image Lure Brand Host Link.
The PDF uses image-based lure content with outbound links that resemble credential-harvest, redirector, or brand-impersonation delivery.
PDF image-lure link pattern: PDF Image Lure Brand Path Link.
The PDF uses image-based lure content with outbound links that resemble credential-harvest, redirector, or brand-impersonation delivery.
PDF image-lure link pattern: PDF Image Lure Shortener Link.
The PDF uses image-based lure content with outbound links that resemble credential-harvest, redirector, or brand-impersonation delivery.
PDF structural or payload evidence: PDF Info Producer Char Range JavaScript Stager.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
Decoded PDF JavaScript downloads, writes, and executes a Windows payload through ActiveX.
The detector requires co-occurring ActiveXObject, XMLHTTP/WinHTTP, ADODB.Stream or ResponseBody file-write behavior, and WScript/rundll32-style execution in a recovered PDF JavaScript stage. This is a precise commodity downloader signature, not a specific Acrobat parser CVE.
PDF JavaScript behavior: PDF JavaScript Exfiltration Sink URL.
The PDF contains JavaScript evidence for obfuscation, network activity, payload staging, form submission, or exploit-style heap manipulation.
PDF JavaScript behavior: PDF JavaScript Network Beacon.
The PDF contains JavaScript evidence for obfuscation, network activity, payload staging, form submission, or exploit-style heap manipulation.
PDF JavaScript behavior: PDF JavaScript Obfuscated Unicode Heap Spray.
The PDF contains JavaScript evidence for obfuscation, network activity, payload staging, form submission, or exploit-style heap manipulation.
PDF JavaScript behavior: PDF JavaScript Page Word Heapspray Stager.
The PDF contains JavaScript evidence for obfuscation, network activity, payload staging, form submission, or exploit-style heap manipulation.
PDF JavaScript behavior: PDF JavaScript Replace Obfuscated Charcode Builder.
The PDF contains JavaScript evidence for obfuscation, network activity, payload staging, form submission, or exploit-style heap manipulation.
PDF JavaScript behavior: PDF JavaScript Submitform URL.
The PDF contains JavaScript evidence for obfuscation, network activity, payload staging, form submission, or exploit-style heap manipulation.
Decoded PDF JavaScript reconstructs a Windows Script Host downloader.
The detector requires WScript.CreateObject/WScript.Shell together with XMLHTTP or WinHTTP download behavior, ADODB.Stream/SaveToFile style file writing, and Run/cmd execution markers in a recovered PDF JavaScript stage. This is a precise commodity downloader signature, not a specific Acrobat parser CVE.
PDF JavaScript contains Windows Script Host/JScript payload behavior.
The detector is broader than the WScript downloader signature: it requires WScript.CreateObject plus WScript.Shell and multiple payload-behavior indicators such as environment access, run/exec, sleep, registry access, XMLHTTP, ADODB.Stream, PowerShell, or cmd.exe. It surfaces embedded Windows-script payloads without assigning an Acrobat CVE when the actual vulnerability trigger is not present.
PDF JavaScript acquires, releases, delays, and then reuses a viewer-managed object.
Several Adobe Reader exploit chains abuse stale JavaScript wrappers for viewer-managed objects such as dataObjects, form fields, annotations, or media players. The detector looks for the behavioral sequence instead of one exact CVE: acquire an object, delete/remove/null it, use a timer or GC/heap pressure step, then access the same object family again.
PDF JavaScript reaches eval (or unescape/Function) through a computed member access assembled from single-character pieces.
PDF_EVAL matches the literal token eval(, so exploit kits stop writing it: they build the name at run time out of one-character strings and array elements, e.g. g[a[0]+'v'+a[1]+'l'], and the identifier never appears in the file. This rule keys on the RECONSTRUCTED name rather than on how much the code concatenates — benign minified JavaScript concatenates a great deal more, so density would separate nothing, while no legitimate code has a reason to spell a built-in this way. Rated HIGH: decisive in context alongside the JavaScript and model signals, but not a conviction on its own.
A URL was recovered from a %uXXXX shellcode run inside decoded PDF JavaScript.
Reader exploit shellcode stores its second-stage fetch URL as a run of little-endian %uXXXX Unicode escapes and downloads-and-executes it with a urlmon/URLDownloadToFile-style call. Recovering an http(s) URL from that byte stream is a concrete download/C2 indicator on its own, independent of which version-gated Acrobat CVE the surrounding script triggers. This is commodity downloader behaviour, so no specific CVE is asserted.
PDF structural or payload evidence: PDF Obfuscated Name Object.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Obfuscated Uri Scheme.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Openaction JavaScript Submitform.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Piracy Streaming Lure.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Quoted Hex Fragment JavaScript Stager.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Random URL Link.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Shuffled Var Join JavaScript Stager.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF /URI action references a command interpreter or script host path.
Normal PDF URI actions point to web, mail, or document links. A URI using path traversal and command interpreter names such as cmd.exe is a legacy dropper/execution lure pattern and should not appear in benign documents.
PDF URL anomaly: PDF URL Mailmerge Placeholder.
The PDF contains URL text or link targets with recipient placeholders, mail-merge remnants, or other delivery artifacts uncommon in benign PDFs.
PDF URL anomaly: PDF URL Recipient Email Param.
The PDF contains URL text or link targets with recipient placeholders, mail-merge remnants, or other delivery artifacts uncommon in benign PDFs.
PDF XFA behavior: PDF XFA Title Base26 Eval Stager.
The PDF contains XFA form content associated with script execution, heap spray behavior, or staged payload recovery.
A /URI link action encodes most of its URL as PDF octal escapes, hiding the destination from URL extraction.
PDF literal strings may write any character as a \\ddd octal escape. No producer does this for ordinary URL characters — nothing emits \\055 for a hyphen — so a URI written this way is deliberately evading naive URL extraction while Acrobat resolves it normally. The rule requires at least four escapes and that they account for half the decoded URL, then reports the recovered destination. High severity when that destination is not a known-good host, medium otherwise.
PDF contains a clickable action to a document hosted on public blob/object storage.
Attackers often use public object-storage platforms as durable, trusted-looking staging locations for second-stage documents. The finding is suspicious rather than conclusive: public storage can be used legitimately, but a PDF whose clickable action points to another document on shared blob storage deserves analyst review, especially when combined with quotation, invoice, signing, or secure-document lure text.
PDF JavaScript decodes document metadata fields and evals the recovered stage.
Some PDF exploit kits hide JavaScript or shellcode in metadata fields such as Title, Subject, Producer, or Keywords, then use parseInt/String.fromCharCode-style decoding and eval. The rule requires metadata field access, a decoder, and an eval sink, plus either multiple metadata fields or a large encoded base-N payload.
PDF Info metadata rebuilds an exploit stage through arithmetic char-code tokens.
Some PDF exploit kits hide the real JavaScript in Info metadata fields as comma-separated arithmetic tokens such as t9.5*w or n*7.375. A small launcher reads metadata like this.producer or this.title, rebuilds the JavaScript with String.fromCharCode, and evals it. The rule fires only after a bounded decoder recovers exploit-like JavaScript from that metadata/launcher shape.
Bytes were appended after the signed/certified byte range.
An incremental update was appended AFTER a signature's ByteRange. Bare appends are normal (re-signing, form-fill), so this is only raised when the appended region introduces active content (/OpenAction, /JavaScript, /Launch, a new /Catalog, …) — the documented PDF 'shadow attack', where the viewer still shows the original signature as valid while rendering/executing content the signer never approved — or when a DocMDP no-changes certification is violated.
Two independent PDF parsers produced significantly different counts of streams or pages on the same bytes.
Exploitation samples routinely rely on parser confusion: one reader processes the file one way, a vulnerable target reads it another. When the in-process byte-level scanner and a second parser (pdfminer.six) disagree on basic structural counts, the file is almost always either corrupt or deliberately crafted to be ambiguous — both are higher-risk than a clean parse.
PRC stream does not begin with the ASCII bytes 'PRC' at offset 0.
Adobe's Product Representation Compact format begins with the 'PRC' magic. A missing or wrong magic on a closed-format parser surface that is rarely exercised is an interesting unknown-exploit signal — fewer eyes have looked at PRC parsing than at any of the open 3D formats.
PDF JavaScript rebuilds and evals a hidden stage from rendered page words.
Older PDF exploit kits hide byte values in visible page text, then use getPageNumWords()/getPageNthWord() to enumerate words, take byte-like fragments, XOR-decode them, and eval the recovered JavaScript. The rule requires the page-word APIs, char-code decoding, an eval sink, and XOR logic, keeping it narrower than a generic JavaScript/OpenAction match.
A pending or confidential document prompt links to a generic hosting tenant.
Covers sparse review-document doorways while requiring an actionable cloud or website-builder destination.
PDF JavaScript mutates prototypes and references privileged PDF APIs.
Prototype pollution is a modern JavaScript exploitation technique. The detector matches __proto__, constructor.prototype, or Object.prototype mutation alongside privileged APIs such as trustedFunction, launchURL, submitForm, getField, or readFileIntoStream. It deliberately tracks the technique without assigning an unverified CVE number.
PDF link embeds a gov.xx-style host prefix inside an unrelated domain.
The URL hostname is shaped so its left side looks like a government or public-sector domain, such as example.gov.xx, while the real registered domain is something else. This tricks readers who skim the beginning of a long host and is common in government-themed phishing PDFs.
PDF links to a non-reputable government/update themed hostname.
The PDF's clickable URL uses a hostname that combines government or public-sector wording, a country code, and update/service/portal language, but it is not an official public-sector domain. That shape is typical of government-themed phishing lures.
PDF combines a QR-like image with scan/verification/business-process lure text.
QR-code phishing can hide the target URL inside image pixels so static URL rules never see a destination. The detector does not need to decode the QR payload: it requires a QR-like square image plus visible text instructing the recipient to scan or use the QR code for verification, HR, payroll, policy, email, signature, or similar business-process activity. The co-occurrence keeps normal QR codes in brochures or invoices from being flagged on image shape alone.
PDF contains a QR-like image but no extracted PDF URI and little or no machine-readable text.
QR-code phishing can hide the target URL inside image pixels so static URL rules and reputation checks never see the destination. The detector is scoped to image-only or near-image-only PDFs that contain a QR-like image but no decoded PDF URI action, which is the off-band QR delivery pattern rather than an ordinary clickable PDF link.
PDF contains quotation/RFQ/specification lure text and links to a document payload on public blob/file hosting.
Procurement-themed phishing commonly uses a simple PDF as the visible lure, then sends the victim to a quotation, RFQ, or specification document hosted on unrelated public blob/file storage. The rule requires both the procurement lure wording and a clickable document URL on public hosting so ordinary documents that merely mention quotations or specifications do not match.
PDF contains /RichMedia (Adobe Flash content).
Flash has a long history of critical vulnerabilities. Embedded Flash in PDFs was a major exploit vector. Flash is now end-of-life, making any Flash content in a PDF highly suspicious.
PDF link launders its destination through a search-engine redirect whose unwrapped target carries phishing obfuscation.
The clickable link wraps its real destination in a google.<tld>/url?q= search redirect, borrowing Google's domain trust, while the unwrapped target hides behind a fake dotted cgi.bin path segment or runs of percent-encoded non-ASCII filler. Requiring both the wrapper and the target obfuscation keeps links merely copy-pasted from search results out of scope.
A secure file-sharing lure links to unrelated hosted infrastructure.
Correlates multilingual SharePoint, OneDrive, and secure-document wording with the actual actionable destination.
A tax-refund notice requests personal or bank confirmation through an unrelated host.
Combines tax-authority branding, a material refund, sensitive-data confirmation, and destination mismatch.
PDF contains a validated malformed TrueType bitmap-font primitive plus active content.
Normal EBDT/EBLC bitmap tables are legitimate and are a negative signal, not CVE evidence. This related rule now requires the bounded sfnt parser to validate malformed bitmap component placement or an EBSC range trap; the stricter CVE_2023_26369 rule requires the complete exploit structure.
A linearized PDF declares a substantially larger file than was received.
The declared linearized length exceeds the available bytes by a material amount. Objects and exploit evidence may therefore be missing, so the scan must not be presented as a complete clean analysis.
A branded SharePoint, Google, Adobe, or government document lure links outside that service.
Correlates rendered trusted-service branding with the actual action host rather than treating branding or a URL independently.
Decrypted Type 1 CharString contains repeated get/callOtherSubr bytecode sequences.
Adobe Type 1 CharStrings are stack-machine bytecode. Repeated get/callOtherSubr sequences are unusual in normal glyph programs and match the primitive used by CVE-2021-21086-style CoolType operand-stack manipulation.
Decrypted Type 1 CharString bytecode pushes more operands than expected.
Type 1 CharStrings are stack bytecode. Operand-stack overflow is a font-engine exploit primitive.
Decrypted Type 1 CharString bytecode consumes operands that are unavailable.
Stack underflow in Type 1 bytecode can lead to interpreter state corruption or parser divergence.
U3D block declares a data or metadata section size beyond any plausible legitimate value.
Allocators sized from these 32-bit fields are a recurring exploit primitive in 3D engines. Real-world U3D blocks rarely exceed a few megabytes; tens of megabytes is consistent with adversarial construction.
U3D block declares a total size that runs past the available stream bytes.
Renderers that resync to the next plausible block header read attacker-controlled bytes from the gap between the truncated block and the next header. Real-world U3D files produced by 3D tooling are byte-aligned and never declare a size larger than the file.
An embedded U3D (3D-model) stream does not start with the required File Header block — a malformed/parser-divergence shape on a rarely-inspected attack surface.
ECMA-363 requires the first U3D block to be the File Header. A different first block is a parser-divergence shape on a low-traffic attack surface that few static analysers cover deeply. Truncated streams that fail to contain even the 30-byte minimum header are reported under this same rule.
PDF embeds an XFA dataset with a <script> or <xfa:script> block.
XFA scripting has been the exploit primitive for several Adobe Reader RCEs (CVE-2010-0188 family, CVE-2018-4901). Plain XFA without scripts is far less risky.
PDF XFA script rebuilds hidden JavaScript from numeric field data or a character table.
Some XFA exploit kits store the real JavaScript as numeric values in form fields or as indexes into a short character table, then rebuild and eval it during an initialize event. The rule is bounded to XFA script packets and only fires after static decoding recovers exploit-like JavaScript or shellcode markers.
XFA initialize script maps numeric rawValue data through a character table and evals it.
This is a bounded fallback for XFA exploit-kit launchers whose final recovered stage remains encoded. It requires an XFA script, rawValue numeric staging, a short cc character table, a long reconstruction loop, and an eval-like sink.
PDF JavaScript launches a URL with a file://, cmd:, or UNC scheme.
Foxit and Adobe handle these schemes inconsistently — they have been used for code execution and NTLM credential theft (the latter via UNC paths).
JavaScript eval() function found in PDF.
eval() executes a string as code. In malicious PDFs it is often used for dynamically constructed or decoded exploit code, making static analysis harder.
PDF JavaScript pairs getAnnots with heap-spray shellcode and an embedded payload.
The document calls getAnnots() in a context containing classic Adobe Reader heap-spray markers and an embedded payload. This is CVE-2009-1492-related evidence, but is not exact CVE attribution unless the getAnnots argument has the distinctive overflow/long-string trigger shape.
JavaScript unescape() function found in PDF.
unescape() decodes percent-encoded strings. In PDF exploits, it is commonly used to convert encoded shellcode back to raw bytes before triggering a vulnerability.
PDF cross-reference table claims object N is at byte offset O, but the bytes at O do not begin with the expected 'N G obj' header.
Readers that trust the xref will resolve the indirect reference to one set of bytes; readers that scan the file linearly will resolve it to another. This parser-divergence shape is a recurring evasion technique in targeted PDF exploits.
PDF uses ASCII85Decode stream filter alongside active scripting content.
ASCII85 is a relatively uncommon encoding. Like ASCIIHexDecode, it has legitimate uses, so we only flag it when it co-occurs with active scripting content (/JavaScript, /JS, /XFA, or /RichMedia).
PDF uses ASCIIHexDecode stream filter alongside active scripting content.
ASCIIHexDecode is legitimately used by some scanned-document and PostScript-derived PDFs, so on its own it's noise. The detector only fires when the filter co-occurs with active scripting content (/JavaScript, /JS, /XFA, or /RichMedia) — the shape associated with payload obfuscation.
Small PDF routes a clickable link through an ad/tracking redirector.
Tiny PDFs that contain little content beyond a redirector URL are common in malvertising and phishing delivery. The embedded destination can change or be selectively served, so this is stronger than a generic external URI.
PDF defines /AA (Additional Actions) triggers.
Additional Actions can fire on events like page open, print, or close. They are often used to trigger script or external actions during viewing.
A single CFF Type 2 glyph program is far larger than expected.
Normal glyph programs are small. Very large CharStrings often indicate bytecode-as-payload, malformed subroutine graphs, or exploit grooming.
CFF INDEX (Name / Top DICT / String / Subrs / CharStrings) declares thousands of entries.
Real fonts have at most hundreds of entries in any single INDEX. Allocators sized from this 16-bit field have been a recurring exploit primitive in font rasterisers.
CFF INDEX's first offset entry is not 1 (the spec-mandated value).
Some implementations validate; others trust the value and read from the wrong byte. Real-world fonts produced by standard tooling always have first offset = 1.
CFF font header is structurally invalid: header size out of range, or header runs past the stream length.
Different font rasterisers handle truncated CFF headers differently — some abort, some pad with zeros and continue — leading to divergent glyph rasterisation between scanner and viewer.
PDF links advertise cracked/pirated software (crack, keygen, serial key, warez).
These PDFs are SEO-spam carriers: they pack many clickable links whose targets use software-piracy vocabulary so the document ranks for '<app> crack download' searches, then routes users to fake crack pages serving potentially-unwanted programs, adware, or droppers. The rule fires on several distinct links carrying piracy-specific tokens in the URL itself, so ordinary documents that merely mention the word are not affected. The PDF carries no exploit of its own — the risk is the linked destinations, so it is capped at suspicious.
Credential / secure-document lure with single non-reputable link
medium
PDF_CREDENTIAL_LURE_NONREPUTABLE_LINK
Thin PDF whose rendered text is a credential / secure-document / identity-verification lure and whose only clickable action links to a non-reputable host.
The text-layer variant of the malspam carrier. The image-only lure rule requires an image-heavy, near-textless page (n_text < 3), so it misses Google-Docs-rendered phishing PDFs that carry a CID/ToUnicode text layer — SSA/IRS 'identity verification', 'secured Adobe PDF document' gates, French 'fichier sécurisé — voir le document'. The detector inspects the rendered text for a strong credential/secure-document lure phrase and fires when the page is thin and its sole external link (1–2 distinct) is not known-good. Suspicious rather than malicious: the lure text plus a lone non-reputable link is the corroboration; ML/AV signals push it higher.
PDF hides a clickable URL-shortener destination with PDF string escapes.
PDF literal strings can legally encode punctuation with octal escapes, but pairing that obfuscation with a URL shortener is a stronger phishing signal than a normal visible link. Attackers use this to defeat simple URL extractors while hiding the final landing page behind a redirector.
A technical-manual download lure links to a query-driven PHP document gateway.
Kept contextual because the local PDF does not prove the remote payload; the compound signal is sufficient for SUSPICIOUS.
PDF advertises a free Robux/V-Bucks generator and links to a scam doorway or Looker Studio redirector.
Free game-currency "generators" are survey and credential scams aimed at younger players. The rule requires both the visible generator lure text and a matching doorway link (or a Looker Studio report used as a redirector), so game journalism or safety guides without scam links do not fire.
PDF contains 500+ stream objects.
An abnormally high stream count may indicate heap spraying (filling memory with repeated data) or heavy obfuscation of the PDF structure. Threshold is 500 to avoid flagging legitimate technical / textbook PDFs.
Same ICC tag signature appears more than once in the tag table.
Per spec each signature must be unique. Implementations that take the first vs. the last copy produce different colour transforms — a shape used to hide an attacker-chosen mAB./mBA. pipeline behind a benign-looking earlier entry.
ICC profile declares more than ~256 tag entries; real-world profiles have at most a few dozen.
Implausibly large tag counts are consistent with hand-crafted profiles designed to exhaust allocator state or trigger integer overflows in the tag-table indexing arithmetic.
ICC profile header field 'profile size' does not match the actual length of the embedded profile bytes (or the tag table extends past the bytes available).
Colour-management stacks that trust the header field and those that trust the container length read different bytes. The CVE-2018-4990 family of ICC-parser bugs lived in exactly this disagreement.
ICC tag declares zero data length but a non-zero offset.
Implementations that prefetch the offset before checking size read out-of-bounds bytes. Real-world profiles either use zero/zero or non-zero/non-zero — the mismatched form is consistent with adversarial construction.
A raster-only PDF overlays an actionable link to a non-official external host.
The structural pairing is a common way to hide phishing language from text extraction while preserving a clickable action.
Image-heavy PDF whose sole clickable action links to a non-reputable host carrying a random throwaway subdomain.
The canonical malspam-carrier shape: a screenshot-like 'click to view document' page whose only purpose is to funnel the victim to one redirect/landing URL on a compromised or throwaway domain. Flagged suspicious rather than malicious because the image lure plus a single non-reputable link with a random subdomain is the only corroborator; ML/AV signals push it to malicious.
A JBIG2 image segment header could not be parsed cleanly (e.g. a length field points past the end of the data) — a renderer-divergence shape.
A JBIG2 segment header could not be parsed cleanly: a length field claimed more bytes than the stream contains, a referred-to-segment count was truncated, or a reserved code was used. Renderers that fail open on broken headers parse different segment data than renderers that abort.
JBIG2 stream declares thousands of segments where real-world scanned-document JBIG2 typically contains tens to a few hundred.
Hand-crafted JBIG2 streams designed to stress the segment-graph allocator or refcounter are a recurring exploit primitive. On its own this is a weak signal but it contributes when paired with other JBIG2 anomaly rules.
PDF uses JBIG2Decode image compression.
JBIG2 is a complex image codec. Vulnerabilities in JBIG2 decoders have been exploited in high-profile zero-click attacks (e.g. NSO Group's FORCEDENTRY, CVE-2021-30860).
A loan or instant-approval solicitation conceals its destination behind a URL shortener.
The combination is characteristic of financial lead fraud and credential collection while avoiding a verdict based on either loan wording or a shortener alone.
A nearly empty view/open-PDF carrier links to a user-created external form.
The provider can be legitimate, so the rule remains contextual, but the sparse carrier plus form action should not remain CLEAN.
sfnt offset table declares more than ~64 tables, well beyond any realistic font.
Allocators sized from the numTables field are an exploit primitive. Real OpenType / TrueType fonts contain on the order of 10–25 tables.
cmap declares an implausibly large number of subtables.
Very large subtable counts stress parser loops and allocations.
cmap header or encoding records extend past the table.
Malformed character-map tables can make different text/glyph paths disagree.
sfnt directory contains the same 4-byte table tag more than once.
Renderers that take the first record vs. the last record produce different glyph rasterisation. Duplicated table tags are not produced by any standard font tooling.
maxp.numGlyphs is far beyond typical embedded PDF fonts.
Huge glyph counts stress loca/glyf allocation and iteration paths.
A name record points outside name table string storage.
Out-of-range name strings are a low-level font table consistency violation.
The name table record count is implausibly large.
Huge name record counts stress table-walking logic.
name records or string storage point outside the name table.
Malformed name tables are useful parser-divergence evidence when paired with other font anomalies.
PDF structural or payload evidence: PDF Action Parser Evasion.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF JavaScript matches a multi-CVE Adobe Reader exploit-kit pattern.
The PDF contains JavaScript structures used by older Adobe Reader exploit kits that dispatch across multiple vulnerabilities or Reader versions. The finding indicates an exploit-kit family shape, not a single confirmed CVE.
PDF structural or payload evidence: PDF Aitm Tokenized Phish Link.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Auto Open Redirect.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF link farm points into compromised CMS upload paths.
The PDF contains many outbound links to upload directories or media paths on likely compromised CMS sites, a common SEO-spam and traffic-redirection pattern.
PDF structural or payload evidence: PDF Embedded FileSpec Content Mismatch.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Flate Image Nop Sled.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Form Capability Uncorroborated.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Game Hack Link Farm.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Generic Stage Recovery.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF JavaScript behavior: PDF JavaScript Extreme String Rewrite Obfuscation.
The PDF contains JavaScript evidence for obfuscation, network activity, payload staging, form submission, or exploit-style heap manipulation.
PDF JavaScript behavior: PDF JavaScript Known CVE Heapspray Family.
The PDF contains JavaScript evidence for obfuscation, network activity, payload staging, form submission, or exploit-style heap manipulation.
PDF JavaScript behavior: PDF JavaScript Large Comment Padded Eval.
The PDF contains JavaScript evidence for obfuscation, network activity, payload staging, form submission, or exploit-style heap manipulation.
PDF JavaScript behavior: PDF JavaScript Remote Doc Fetch.
The PDF contains JavaScript evidence for obfuscation, network activity, payload staging, form submission, or exploit-style heap manipulation.
PDF JavaScript behavior: PDF JavaScript Stream Truncated.
The PDF contains JavaScript evidence for obfuscation, network activity, payload staging, form submission, or exploit-style heap manipulation.
PDF JavaScript behavior: PDF JavaScript Template Placeholder.
The PDF contains JavaScript evidence for obfuscation, network activity, payload staging, form submission, or exploit-style heap manipulation.
PDF structural or payload evidence: PDF Myhome Coded Book Link Farm.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF contains a dense disposable-domain SEO link-farm pattern.
The PDF contains many outbound link annotations or URI actions whose destinations match disposable, SEO-spam, or low-reputation infrastructure. This indicates a document being used as a search-index or link-farm carrier.
PDF structural or payload evidence: PDF SEO Spam Template.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Script Encoder Blob.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
PDF structural or payload evidence: PDF Type1 Mm Font Overflow.
The PDF contains suspicious structure, embedded content, malformed parser state, launch behavior, staged payload data, or exploit-like document features.
A PDF signature's CMS failed verification.
Either the signer's signature over the signed attributes is invalid, or the signed content digest does not match the bytes the ByteRange covers. The signature was tampered with, forged, or the signed content was altered after signing.
A declared PDF /EmbeddedFile stream could not be decoded through its filter chain.
The detector only applies to standard attachment streams referenced by /EmbeddedFile or /EF. When their filter chain fails, the raw stream is carved so unsupported or malformed attachment encodings do not hide payload bytes from artifact triage.
An /EmbeddedFile attachment is named as a shell, PowerShell, batch, or scripting-host script.
Benign PDF attachments are documents, spreadsheets or images. A script attachment has no magic bytes for the content classifier to key off, so it previously surfaced only as a generic 'Embedded file' finding. The rule reads the /F and /UF filespec names and escalates to high severity when the document also contains a literal IPv4:port URL — a script payload alongside a hardcoded staging endpoint. Security-range and CTF artifacts do legitimately bundle scripts, which is why the bare case stays medium.
PDF has at least one image XObject and zero text-emitting operators in raw or decompressed content streams.
Phishing PDFs are often built by exporting a screenshot to PDF: a single page with one or more image XObjects and no text. The carrier evades text-based scanners (no keywords to match) and delivers its call-to-action purely through rendered pixels — a phone number to call, a QR code to scan, or a link the user is told to type. Distinct from PDF_IMAGE_LURE, which requires a small file and an in-PDF click-action; the detector has neither constraint and looks inside compressed content streams to avoid false positives on real text-bearing PDFs.
A signature's ByteRange starts past byte 0, leaving content uncovered.
A legitimate PDF signature covers from byte 0. A ByteRange that starts past the file head leaves real content outside the signed region while still presenting as 'signed' — the Universal Signature Forgery evasion.
PDF clickable URI points to a literal IPv4 address.
Legitimate PDFs normally link to named domains. Clickable HTTP(S) links to raw IP addresses are common in disposable phishing and malware-delivery infrastructure, especially when paired with link annotations or screenshot lures.
A /JS action refers to an object absent from the file.
The script payload is incomplete or truncated; the remaining launcher cannot safely establish a CVE attribution.
PDF references a remote or embedded document via GoToR/GoToE.
GoToR/GoToE can open another PDF or trigger loading of a remote resource, potentially bypassing security controls by chaining documents.
PDF carries /pdf/<domain> + /doc/<domain> SEO doc-farm redirector links.
The generated 'free document/template' SEO phishing family links through redirectors whose path ends in a bare website domain behind a /pdf/ or /doc/ segment (e.g. 'host/Document-Title-Slug/pdf/target-site.tld'). Firing requires the family's signature /pdf/ + /doc/ variant pair on the same host and slug, or one such redirector alongside multiple links into WordPress form-plugin upload storage. The PDF is an inert link carrier; the risk lives in the linked destinations.
PDF clickable link host starts with a literal 'http.'/'https.' DNS label.
A destination hostname whose first DNS label is literally 'http' or 'https' (e.g. 'https.file-transfers.example.com') makes the rendered link read 'https://https.…', disguising the real registered domain as a secure service. No legitimate operator names a host this way; it is a URL-deception tell used by phishing carriers.
A nearly textless open/view button leads to a user-controlled cloud share.
Kept contextual because legitimate cloud shares exist; branding, urgency, or personalization can corroborate it separately.
PDF stream object declares a /Length that does not match the actual bytes between 'stream' and 'endstream'.
Different PDF readers resolve stream length either from the declared /Length value or from the 'endstream' framing markers. When the two disagree, the same file renders as different content in different readers — a known evasion shape used to hide payload from static scanners that trust one source while the actual reader trusts the other.
PDF stream declares /Filter /FlateDecode but the raw stream bytes are rejected by zlib in both wrapped and raw modes.
A renderer that aborts on the broken stream and one that fails-open see different document content. Targeted samples sometimes deliberately break the filter chain so that lighter-weight scanners skip the stream while heavier renderers still extract a payload from the partial data.
String.fromCharCode found in PDF JavaScript.
fromCharCode constructs strings from numeric character codes. Exploit authors use it to build payloads character by character to evade string-based detection.
PDF has a /SubmitForm action that can POST data to an external URL.
SubmitForm actions send form field data to a URL when triggered — potentially exfiltrating credentials, file paths, or system information to an attacker-controlled server. Caveat: legitimate PDF forms (government applications, grant submissions, enterprise surveys) do use /SubmitForm to post data to known servers. Check the target URL context before escalating this finding.
A dense /JS reconstruction stage is cut off before its balanced closing delimiter.
This records incomplete scanner visibility rather than assigning a CVE. A partial exploit fragment may omit the vulnerable API call, so attribution requires a complete recovered sink and trigger argument.
U3D stream contains thousands of blocks where real-world files typically contain at most a few hundred.
Hand-crafted U3D streams designed to stress the modifier-chain allocator or refcounter are a recurring exploit primitive on the U3D parser surface. Weak signal alone, contributes when paired with other 3D-content anomaly rules.
PDF clickable URI points to a URL shortener.
Clickable URL-shortener links hide the final landing page from static review and are common in phishing redirect PDFs. This is stronger than a generic external URI because the visible destination is an intermediate redirect service rather than the actual site.
PDF carries many document links parked on website-builder CDNs or simple download gateways.
Generated SEO-spam PDF carriers often point to many PDFs hosted on free website-builder CDNs or throwaway download gateways, with visible ebook/manual/download lure text. The rule requires multiple such links plus lure text, and is capped at suspicious because the PDF is usually an inert redirect/link carrier rather than an exploit document.
PDF contains a /Btn form field paired with a SubmitForm/URI/Launch/JS trigger.
Large interactive form buttons are the common 'fake download button' in phishing PDFs. Attackers overlay a /Btn field on a screenshot of a legitimate document to create the illusion of a clickable download link. /Btn appears in essentially every fillable PDF form, so the rule only fires when paired with a remote-action trigger — the actual phishing-button shape.
PDF embeds a file attachment.
Embedded files can carry executables, scripts, or other malware. While some legitimate PDFs include attachments, this warrants inspection.
PDF contains many images but very few text blocks — possible screenshot lure.
A common phishing technique renders a screenshot of a legitimate document (e.g. a locked Word file, a DocuSign request) as a full-page image with no real text content, then overlays a form button or URI action on the image. Caveat: this heuristic has a high false-positive rate. Scanned documents (contracts, invoices, IDs), image-heavy brochures, and photo PDFs all trigger it legitimately. Use this finding only as supporting context alongside higher-severity indicators.
PDF body contains an indirect reference (N G R) to an object number that is never defined in the file.
Lenient readers silently skip dangling references; strict readers may treat the slot as null and follow a different code path. On its own this is often just a corruption artefact — older scanner output and damaged PDF/A files commonly trip it — but it contributes weakly when paired with stronger anomaly signals.
PDF uses Optional Content Groups (OCG) and contains an action trigger.
Optional Content Groups allow parts of a PDF to be shown or hidden. Attackers abuse this to show lure content on first open then hide it (defeating sandbox screenshots) while the action trigger still fires. OCGs alone are standard in CAD/technical, multilingual, and layered PDFs, so the detector only fires when an action trigger is also present.
PDF is encrypted with a non-empty user password — it cannot be opened, decrypted, or statically inspected without the password.
Unlike a permission/DRM-sealed PDF that opens with an empty user password (billing statements, signed invoices — the reader decrypts transparently and the analyzer can inspect the content via qpdf), this document requires a real user password to open, so every string and stream is cryptographically inaccessible to static analysis. This is a recognised malware-delivery evasion: the open-password is supplied in the phishing e-mail body so the recipient can open the file while automated AV/sandbox pipelines cannot. It is not malicious on its own (confidential documents are also password-protected), but it means the content was not inspected and should be treated as unknown, not clean.
PDF contains U3D/3D annotation content or U3D signatures.
U3D is a complex legacy 3D parser surface, but valid U3D models are legitimate content. This generic finding carries no CVE attribution; specific CVE rules require independently validated malformed U3D blocks.
PDF uses XML Forms Architecture (XFA).
XFA forms can contain JavaScript and complex logic. Vulnerabilities in XFA parsers have been exploited in the past.
PDF JavaScript calls syncAnnotScan() — an exploit-kit staging primitive used to force annotation enumeration before reading payload bytes from /Subject fields.
syncAnnotScan() is a legitimate no-argument Acrobat / Foxit JavaScript API that ensures all annotation objects are populated before getAnnots() is called. It is not a vulnerable sink and has no associated CVE. However, exploit-kit JavaScript routinely calls it as a staging step in the pattern 'z.syncAnnotScan(); var p = y.getAnnots({nPage:0}); var s = p[0].subject; ... eval(s)' — where the encoded payload was hidden in annotation /Subject fields. A bare call rarely appears in legitimate PDFs, so it is a low-severity exploit-kit-shape indicator on its own; combined with getAnnots() + subject reads + eval, the related rule PDF_JS_OBFUSCATED_DROPPER fires the high-severity composite finding.
Same indirect object (N G) is defined more than once with different body bytes.
Body-only duplicate objects are common in benign incremental updates and PDF editor save chains. The analyzer records the structure for explainability, but it is not treated as an unknown-exploit signal unless a duplicate body carries active content or divergent filters.
Type 2 CharString bytecode pushes more operands than the interpreter stack should hold.
CFF/Type 2 CharStrings are stack bytecode. Operand-stack overflow is a recurring font parser bug class and a strong structural exploit signal.
Semantically equivalent JavaScript views were deduplicated before counting and analysis.
Encrypted, normalized, referenced, and carved views can expose the same script multiple times. Collapsing them by semantic hash prevents provenance amplification from inflating exploit feature counts while retaining the authoritative first copy.
The standard EICAR test string is exported and launched by Acrobat JavaScript.
This known antivirus demonstration exercises a dangerous PDF delivery feature but is not a real payload or parser CVE.
PDF declares /Encrypt — strings and stream contents are encrypted.
PDF document encryption applies the standard security handler's cipher (RC4 or AES) to all strings and stream contents. The keys (/JavaScript, /Filter, etc.) remain visible but their values do not. Many legitimate documents are encrypted (signed contracts, billing statements, rights-managed material); on its own this is informational, but it limits what the static scanner can see.
PDF contains an external URL action.
The PDF links to an external website. While common in legitimate PDFs, malicious PDFs use URLs to redirect to phishing sites or malware downloads.
Large PDF contains many JBIG2 page images without executable actions.
This profile bounds expensive late analysis for ordinary scanned documents while retaining earlier structural findings.
Same indirect object (N G) is defined more than once with different body bytes.
Duplicate object bodies create first-wins versus last-wins parser divergence even when the /Filter chains look identical.
The document is digitally signed or certified.
A PDF can be signed with a detached PKCS#7/CMS signature whose ByteRange covers the whole file except the signature hole. The signer certificate, issuer, certification level (DocMDP) and the signature's cryptographic validity are shown for context. Unlike a VBA-project signature, PDF JavaScript is never signed on its own — only as part of the signed byte range — so presence of a signature is NOT a benign indicator and does not affect the risk score.
The cross-check parser (pdfminer.six) raised an error on this file.
The analyzer cross-checks its in-process byte-level PDF scan against an independent pdfminer.six pass to surface parser-divergence exploit shapes. A pdfminer error here is itself a signal — malformed PDFs (corrupted xref, divergent duplicate objects, broken object streams) often deliberately defeat one parser while remaining renderable in another, which is the basis of several real-world PDF exploitation primitives. The static byte-level heuristics still ran on the file and their findings above are valid; only the differential cross-check signal is missing.
The PDF signing certificate is self-signed (issuer == subject).
The document is signed with a self-signed certificate that no certificate authority vouches for. Unlike self-signed VBA macro signing (a real attacker trick), self-signed PDF sealing is a mainstream-legitimate pattern — invoicing and document services seal PDFs with self-signed certs for integrity, not CA-backed identity. So this is informational context (surfaced as the signature box's 'Self-signed' status) and does not affect the risk score; tampering surfaces as PDF_SIGNATURE_INVALID instead.
Document JavaScript matches a narrow barcode or attachment UI helper profile.
This profile requires multiple library-specific operations and rejects spray, eval, shellcode, payload, and vulnerable-argument evidence. It prevents ordinary interactive forms from entering unknown-exploit triage.
Source objects, stage index, and semantic hash are retained for reconstructed JavaScript.
Provenance makes cross-object reconstruction reproducible and prevents normalized copies from being counted as independent stages.
All embedded assets referenced by the RichMedia configuration are zero bytes.
The RichMedia structure remains visible, but an absent SWF cannot execute. Non-empty assets and any independent JavaScript or exploit evidence retain their normal severity.
Validly signed PDF form was downgraded after no harmful behavior was found.
A valid PDF signature is not a general trust signal, but it is useful context for low-risk fillable forms. This tier fires only when the signature verifies, there is no invalid or post-sign active-content change, no exploit/CVE/AV/ML hit, no launch action, no embedded payload, no suspicious external URL, and any JavaScript is limited to Acrobat form-helper calls such as date and number validation.
Office
278
Auto-exec VBA decodes an msiexec remote-install command and passes it to an execution sink.
The scanner evaluates constant Chr(x+N)/Chr(x-N) helper chains and requires remote MSI installation, auto-execution, and a Run/Exec sink.
An auto-running macro reconstructs an obfuscated command and passes it to Shell.
Requires automatic execution, a concrete Shell sink, and extensive string-fragment or character-extraction assembly.
Auto-run macro erases workbook data and shuts down Windows
critical
OLE_VBA_DESTRUCTIVE_WORKBOOK_SHUTDOWN
An Excel auto-open routine clears cells, saves the workbook, and shuts down or forcibly closes Windows.
The compound rule requires automatic execution, destructive ClearContents behavior, persistence of that change through Save, and a shutdown or forced-close sink.
An auto-running WordBasic macro copies automatic macros in both directions while saving the document.
Older WordBasic viruses sometimes address the resident macro set implicitly rather than spelling out Global or Normal. Multiple MacroCopy operations combined with AutoOpen/AutoClose and FileSaveAs form the same document-to-resident-to-document replication loop.
Receipt or account-action text impersonates a brand but targets an unrelated redirector or object store.
This correlates visible lure semantics with the actual OOXML relationship target, avoiding campaign attribution while detecting a strong phishing mismatch.
An Excel cell formula resolves to an advised external DDE item whose service launches an executable.
This detector follows the workbook external-reference relationship and correlates a cell formula such as [1]!Name with the named, advised ddeItem in an externalLinks part. It only attributes CVE-2016-7262 when the linked DDE service is an executable such as cmd, PowerShell, or calc; ordinary DDE market/data feeds and unreferenced external-link parts are not attributed to the CVE.
An OOXML ZIP appended to another document contains a decoded command relationship target.
The scanner walks local ZIP headers even when prefix-relative central-directory offsets prevent normal ZIP extraction, decodes XML entities and URL encoding, and requires multiple execution-chain indicators.
Compiled VBA/cache bytes expose an automatic event, project-code editing, and a foreign Office target.
When VBA source is stomped or cannot be decompressed, its compiled identifier streams can still reveal the complete replication chain: an automatic event, VBProject/VBComponents/CodeModule access, AddFromString/InsertLines/DeleteLines, and a NormalTemplate, active-document, workbook, or XLSTART target.
An auto-running macro exports a VBA component and imports it into another workbook.
Exporting executable VBA and importing it into another open workbook, template, or startup workbook propagates code between files. Legitimate local code generation that only rewrites the current project is excluded.
Excel 4.0 macro sheet uses formula APIs that call directly into Win32.
=CALL / =EXEC / =REGISTER / =FORMULA / =FOPEN — these are the primitives used by XLM-based droppers to download payloads, write files, and start processes without invoking VBA.
A transparently decrypted Office package contains a VBA download, write, and execution chain.
The analyzer decrypts the OOXML package, scans and carves its VBA project and source, and promotes only a complete payload-delivery chain.
Office document contains an embedded SWF (Flash) object.
Vulnerabilities such as CVE-2018-4878 and CVE-2018-15982 involved Flash objects embedded in Office files. Adobe Flash has been end-of-life since December 2020.
A carved embedded OLE Office document matched exploit or payload heuristics.
Some exploit samples are wrapped by a PE, binder, or other outer container while preserving a complete CFB/OLE Office document at a later offset. The engine carves that secondary Office body, runs the normal Office static rules on it, and promotes concrete CVE or high-risk child findings onto the parent sample.
An embedded OLE/OOXML object is itself an Office file that contains a VBA macro project or an Excel 4.0 (XLM) macro sheet.
Hiding a macro-bearing workbook or document inside another document — often under an obfuscated, non-standard part name — is a macro-smuggling technique that defeats scanners which only inspect the outer document's macro storage. No benign authoring workflow stages a hidden macro project this way, so an embedded Office file with its own macros is a strong delivery-vehicle indicator.
MZ/PE header found inside the document.
A Windows executable (PE file) is embedded inside the document. This is high-risk — the document is carrying an executable payload.
VBA carries a base64-encoded EXE split across many string variables and rebuilds it at run time (ADODB.Stream drop-and-run).
The VBA macro stores a base64-encoded Windows executable split across many string variables and reassembles it at run time — typically writing it to %TEMP% with ADODB.Stream (often via embedded JScript glue using MSXML2.DOMDocument.nodeTypedValue) and executing it. The payload is embedded in the document, not downloaded, and never appears as a contiguous executable on disk, so URL recovery and the raw embedded-EXE scan both miss it. The analyzer concatenates the macro's base64 runs, decodes at each base64 phase alignment, and confirms a valid PE (MZ + DOS stub + PE header, or process-injection imports). A benign macro does not carry an executable across its string literals, so the match is near-zero-FP; the reassembled PE is carved for full extracted-file (ClamAV + static triage) analysis.
Encrypted-package shape co-occurs with FAT-chain corruption — the canonical combined evasion form.
An OLE container that is both password-encrypted at the MS-OFFCRYPTO layer and structurally malformed at the FAT-chain level is the canonical evasion shape used to deliver exploit-carrier Office documents past email and gateway scanners. Each signal alone has some benign-occurrence rate; the combination has effectively no legitimate explanation — Excel opens the file because both its FAT walker and its encrypted-package loader are lenient, and that asymmetric tolerance against strict static scanners is the point.
Equation Editor command stager — CVE-2017-11882 family
critical
CVE_2017_11882_EQUATION_NATIVE_CMD_RELATED
Equation Native stream has invalid MTEF structure and embedded command-launch bytes.
The detector requires Equation Editor CLSID context, an invalid Equation Native/MTEF header, and process-launch command bytes inside the native stream. That combination is a weaponized Equation Editor exploitation pattern consistent with the CVE-2017-11882/CVE-2018-0802 family while avoiding individual attribution without a FONT/SIZE/MATRIX primitive.
Equation Editor exploit primitive or command-stager shape.
CVE-2017-11882 is the Equation Editor stack buffer overflow most directly identified by an overlong MTEF FONT typeface field copied into a fixed-size stack buffer in EQNEDT32.EXE. The analyzer also emits this CVE when an obfuscated or partially malformed Equation object exposes equivalent exploitation evidence, such as an activated Equation 3.0 object carrying command-launch bytes and a remote payload target. The rule still requires exploit structure beyond a bare Equation Editor CLSID.
Equation Editor object carries Ole10Native downloader shellcode
critical
OLE_EQUATION_OLE10NATIVE_DOWNLOADER
Equation Editor OLE object contains Ole10Native shellcode with download and process APIs.
An embedded OLE object declares the legacy Equation Editor CLSID and its Ole10Native stream contains URLDownloadToFile plus process-launch API strings and a remote URL. These strings identify payload download and execution. No Equation Editor CVE is assigned unless the malformed Equation Native/MTEF primitive also matches.
An oversized Equation Native stream begins with executable x86 control-transfer code.
The rule identifies exploit payload code but intentionally leaves CVE attribution unset unless the malformed MTEF FONT, SIZE, or MATRIX primitive is independently validated.
An Equation 3.0 object carries executable code in a large Ole10Native stream.
This combination is exploit-shaped even when the Ole10Native length fields are internally consistent. It intentionally does not select a CVE without the specific malformed Equation/MTEF primitive.
Workbook has an Auto_Open defined name and stores XLM download/exec logic inside parts declared as normal worksheets.
An XLM evasion that omits the xl/macrosheets/ part and any xlMacrosheet relationship, storing the Excel 4.0 macro formulas as cells in ordinary worksheet parts so macro-sheet-content-type detectors miss it. Download/exec formulas such as _xll.EXEC, PowerShell/curl, URLDownloadToFile, or ShellExecute sit directly in worksheet cells alongside an Auto_Open-class trigger. Used by 2021-era builders such as AsHkERE/EZHE.
Legacy Excel workbook contains Laroux/Larou-CV auto-open replication markers.
Laroux-family Excel 5/95 macro viruses infect workbooks by auto-running legacy VBA and copying macro modules into other workbooks. The detector requires a family marker such as laroux, Larou-CV.xls, or big_dork together with auto_open and workbook/module replication strings, so ordinary legacy Excel files and textual references are not enough to trigger it.
An auto-running macro saves a workbook into Excel's startup directory.
Workbooks saved under XLSTART or Application.StartupPath load automatically whenever Excel starts. Auto-run code that installs a startup workbook establishes persistence.
A Word field QUOTE expression contains a decimal-ASCII byte sequence. The decoded payload is emitted at field-update time and is typically used to assemble shell-command text that does not appear literally in the document bytes.
Word's QUOTE field accepts a list of decimal byte values and emits them as text when the field is evaluated. Threat actors use this to defeat content-based filters that look for literal 'cmd'/'powershell' strings in document bytes — the dangerous string only exists after Word evaluates the field. When a SET/REF field chain references the QUOTE output from a DDE field, the resulting command runs on document open (MITRE ATT&CK T1559.002). Severity escalates to CRITICAL when the decoded payload references a known-dangerous executable (cmd, powershell, mshta, etc.); MEDIUM otherwise (form has no legitimate use case but no immediately-visible dangerous target).
An auto-running macro copies code between a document and the Global/Normal template.
MacroCopy to or from Word's Global/Normal template installs resident code that can infect subsequently opened or saved documents. The replication operation is sufficient evidence of a macro virus; a downloader or family name is not required.
An auto-running macro hides macro controls and deletes the document body.
Hiding the macro interface while selecting and deleting the full document body combines anti-analysis with a destructive payload. The rule requires both behaviors in an automatic macro.
VBA macro references a Living-off-the-Land binary (certutil, bitsadmin, mshta).
LOLBins are legitimate Windows tools that attackers misuse for malicious purposes — downloading files, executing scripts, or decoding payloads — because they are trusted by security software.
Workbook contains self-identifying legacy Excel formula macro virus strings.
Older Excel malware sometimes used worksheet formulas and hidden workbook content rather than VBA projects or modern XLM macro-sheet structures. The finding is narrow: it requires explicit formula-macro-virus markers such as XF.Classic/Poppy text in the Workbook stream, so documents that merely contain ordinary formulas are not flagged.
A macro opens autoexec.bat, config.sys, or winstart.bat for writing.
Writing legacy Windows startup/configuration files can destroy system configuration or arrange execution at boot. It is direct harmful behavior and carries enough weight to produce a malicious verdict on its own.
Word's binary SttbfAssoc table points the attached template at a remote URL or UNC path.
Legacy DOC files store their template association in the Word table stream rather than OOXML relationships. Word resolves the remote association on open.
Workbook contains an XLM macro sheet plus legacy macro-virus family strings.
Legacy Excel macro viruses commonly infected workbooks by adding Excel 4.0 macro sheets and replication logic. The detector requires macro-sheet structure plus specific family strings or workbook replication phrases such as XL4Poppy, Normal_MacroVirus, HPDung, or 'Infect Workbook', keeping it narrower than a generic XLM-macro finding.
Auto-running VBA copies macros through Global/Normal, hooks FileSaveAs, and hides macro-management commands.
MacroCopy into or out of the global Normal template, combined with an AutoOpen trigger, a FileSaveAs infection hook, and ToolsMacro/FileTemplates/ViewVBCode interception, is the behavioral signature of a resident Word macro virus. The conjunction avoids relying on family strings or generic keywords.
OOXML external relationship targets HTML/CAB/MHTML/HTA-style content.
This is an Office MSHTML attack-surface indicator related to CVE-2021-40444-style delivery, including later script-file variants such as WSF, but it does not match the stricter external OLEObject mhtml/scriptlet/CAB gadget pattern used for the CVE_2021_40444 exact rule.
Malformed OLE bytes contain AutoOpen, embedded ZIP/theme content, VBA project metadata, and URL/CMD/Shell staging tokens.
Some exploit-builder Office documents keep a CFB/OLE header but corrupt the directory enough that ordinary OLE/VBA extraction fails, while an embedded ZIP/theme package and raw VBA project strings remain visible. AutoOpen plus URL/CMD/Shell staging tokens in that malformed container is not benign document automation.
Raw streams retain auto-run, object creation, Shell, and network evidence after VBA parsing fails.
Preserves high-confidence behavior and actionable URLs across malformed-project parser divergence.
A DDE field instruction launches a dangerous system executable (cmd.exe, PowerShell, mshta, etc.).
This document uses DDE to silently execute a system command. The DDE field references a known-dangerous executable such as cmd.exe, powershell.exe, mshta.exe, or a UNC path. When the user opens the document and agrees to 'update links' (or if DDEAUTO is used, without any prompt), the command runs immediately. This is a well-known attack technique (MITRE ATT&CK T1559.002) that bypasses macro security entirely — no macros need to be enabled.
PowerPoint OLE Pictures stream is malformed and carries a PE-like payload.
CVE-2006-0022 is a Microsoft PowerPoint remote-code-execution vulnerability triggered by a malformed PowerPoint record. Weaponized samples from this era commonly hide executable payload bytes in the Pictures stream while damaging the stream's compound-file chain so tolerant PowerPoint parsing reaches bytes that ordinary OLE stream readers do not expose. The detector requires a PowerPoint OLE container, a large malformed Pictures stream, image-record material, and an embedded PE-like payload to limit false positives.
PowerPoint OLE numbered Table stream is malformed and carries a PE-like payload.
CVE-2006-3877 is a Microsoft PowerPoint malformed-record memory corruption vulnerability. The detector requires a PowerPoint OLE container, a large numbered *Table stream whose CFB chain cannot be read normally, and an embedded PE-like payload with process injection or Office-resiliency cleanup strings. Those gates avoid tagging ordinary legacy decks that merely contain table streams.
PowerPoint Pictures stream contains malformed shape-container material and shellcode.
CVE-2006-3590 is the MS06-048 Microsoft PowerPoint mso.dll remote-code-execution vulnerability triggered by a malformed shape container in a PPT file. In observed PPDropper-style decks, the Pictures stream begins with malformed Escher/shape material and carries PEB/API-resolver shellcode or a PE-like payload. The rule requires PowerPoint stream context plus specific shellcode/payload evidence to avoid ordinary picture stream false positives.
Word OLE object pointers are malformed and unreferenced sectors contain decoded shellcode.
CVE-2006-2492 is the MS06-027 Microsoft Word malformed object pointer vulnerability. The detector requires a Word OLE container with malformed CFB directory/object-pointer evidence plus shellcode hidden in unreferenced sectors. One recognized subfamily has an impossible WordDocument declared size and rotate-decoded shellcode that manipulates Word Resiliency/StartupItems registry keys; broader samples require raw PEB/API-resolver shellcode and large OLE slack.
Word FIB points to a malformed DOP/string-table region with exploit payload evidence.
CVE-2007-3899 is the MS07-060 Microsoft Word malformed-string memory-corruption vulnerability. The rule validates Word OLE context, a Word 97-family FIB, an abnormal INT_MAX run in the DOP/string-table area, inflated text counters, and payload or Mdropper.Z campaign markers before assigning the CVE.
Word document contains a corrupted table border/colour formatting record — the CVE-2006-6456 memory-corruption shape.
CVE-2006-6456 is a Microsoft Word 2000/2002/2003 and Word Viewer remote-code-execution vulnerability caused by malformed Word data structures. Exploit documents corrupt a table-formatting SPRM cluster, for example replacing a normal sprmTBrc*Cv record with an invalid 0xFF high-byte SPRM immediately after valid table border/color SPRMs.
Word OLE document has malformed-record exploit structure with payload in OLE slack.
CVE-2008-2244 is the MS08-042 Microsoft Word record parsing remote-code-execution vulnerability. Targeted exploit documents from 2008 commonly keep normal-looking WordDocument/table streams and place shellcode or a PE payload in a large unallocated OLE slack region reached after malformed Word record parsing. The rule requires Word stream context, large OLE slack, and concrete payload bytes.
An Office remote template hides an IPv4 address as a legacy numeric hostname.
Single-component decimal, octal, and hexadecimal hosts are normalized to the IPv4 address that legacy URL resolvers dereference.
OLE Equation Editor payload evidence: OLE MTEF Shellcode Download URL.
The OLE document contains Equation Editor or MTEF object evidence linked to shellcode, downloader URLs, embedded payloads, or exploit-style object layout.
OLE VBA UserForm payload evidence: OLE UserForm Obfuscated Powershell.
The document stores command or script content in VBA UserForm data, a common technique for hiding payload strings from simple macro scanners.
OLE VBA macro behavior: OLE VBA Cell Dropper URL.
The OLE document contains VBA macro evidence for suspicious execution, payload staging, command construction, object abuse, or network retrieval.
OLE VBA macro behavior: OLE VBA Getobject CLSID Powershell Runner.
The OLE document contains VBA macro evidence for suspicious execution, payload staging, command construction, object abuse, or network retrieval.
OLE VBA macro behavior: OLE VBA Property Shellcode Loader.
The OLE document contains VBA macro evidence for suspicious execution, payload staging, command construction, object abuse, or network retrieval.
OLE VBA macro behavior: OLE VBA Shape Alttext Payload Loader.
The OLE document contains VBA macro evidence for suspicious execution, payload staging, command construction, object abuse, or network retrieval.
OLE VBA macro behavior: OLE VBA Shellcode Callback Loader.
The OLE document contains VBA macro evidence for suspicious execution, payload staging, command construction, object abuse, or network retrieval.
Auto-exec macro launches MSHTA from a shortened URL.
Bounded static constant propagation reconstructed a WScript.Shell.Exec command reachable from an Office auto-execution handler. The command launches MSHTA with a shortened network URL; the effective command and unresolved target are shown to the analyst.
Excel hidden-cell PowerShell downloader decoded from workbook data.
The workbook stores a reversed binary-string PowerShell stage in worksheet data and VBA routes hidden cells through a decoder/UserForm indirection. The decoded stage uses WebClient/DownloadFile and starts the downloaded script from the temp directory. The download and subsequent process launch constitute executable staging, not normal macro automation.
OOXML package anomaly: OOXML Encrypted Exploit Carrier Shape.
The Office package contains unusual relationships, embedded objects, custom parts, encryption, or lure structure associated with malicious OOXML documents.
Auto-exec VBA loads image/shape AlternativeText into MSXML and executes an embedded XSLT script installer.
The malicious script is split across the document: VBA uses MSXML loadXML on a shape or picture AlternativeText value and executes it with transformNodeToObject, while the OOXML drawing metadata carries msxsl:script with ActiveX installer/download behavior. Requiring both the macro execution bridge and the scripted alt-text payload avoids flagging ordinary image alternative text.
Spreadsheet declares an auto-loaded OLE object, but the referenced embedded OLE part is absent.
Excel is instructed to activate an embedded OLE object through an `oleObject` relationship and worksheet declaration, but the target part is missing from the ZIP. With autoLoad, VML shape context, or a random-looking ProgID, the package is a payload-stripped or malformed OLE activation carrier. This is not a specific CVE attribution unless the embedded OLE payload is present and contains a recoverable vulnerable-parser primitive.
VBA macro builds a Shell command through decoder/string functions and includes a URL.
The detector requires a Shell invocation, decoder or string-building functions such as RC4String, Chr, StrReverse, Replace, Split, or Base64-style decoding, and a URL in the same macro source. That compound pattern is typical of downloader macros: the macro hides the command line, then launches it to retrieve or execute a payload.
XLM macro sheet auto-executes an obfuscated formula/RUN chain.
Excel 4.0 macro malware commonly hides its command text in formula arithmetic, reconstructs strings with FORMULA(CHAR(...)), stores intermediate values through SET.VALUE / GET.CELL / GOTO, and transfers execution with RUN(). Behind Auto_Open, this sequence executes the reconstructed stage even when no VBA project exists.
Ole10Native package archive contains PowerShell downloader LNK
critical
OFFICE_PACKAGE_ARCHIVE_LNK_DOWNLOADER
OLE Package payload is an archive containing a Windows shortcut that launches PowerShell to download a remote payload.
This detects the common malware-delivery shape where an Office OLE Package displays a ZIP/attachment, but the archive contains an LNK whose command line starts PowerShell and retrieves a remote executable or script. It is user-activated shortcut execution, distinct from CVE-2017-8464's Windows Shell icon-parsing vulnerability.
OLE Package payload is an archive containing a shortcut, script, installer, or other executable-capable member.
Attackers can make the Object Packager UI show a benign-looking ZIP while placing the real execution primitive inside the archive, such as an LNK, JSE/JS/VBS script, HTA, MSI, or executable. The activation is user-driven through the embedded OLE Package object, but the document is still carrying a directly executable payload bundle.
OLE Package payload contains a script that hosts a shell, fetches a remote resource, and executes it.
An OLE Object Packager payload whose embedded script combines a shell host (PowerShell/WScript/mshta), a network-fetch verb (Invoke-WebRequest/Irm/certutil/http(s) URL), and an execute verb (Start-Process/ShellExecute/-outfile) is a download-and-run dropper. This is a direct user-execution delivery technique (MITRE T1204.002) and is detected on payload content, so it still fires when the package header fields are blanked or shuffled to evade extension-based checks.
VBA macro calls Shell() function.
The VBA Shell() function executes an external program. Macro malware often uses it to launch payloads such as cmd.exe or PowerShell scripts.
PowerPoint binary-format RCE payload — CVE-2011-1269 / MS11-036 family
critical
PPT_BINARY_MEMORY_CORRUPTION_PAYLOAD
Macro-free binary PowerPoint carries a native code payload (embedded PE / process-injection shellcode).
A binary PowerPoint 97-2003 (.ppt) document with no VBA macros that carries an embedded PE and/or process-injection shellcode (PEB+API-hash resolver, WriteProcessMemory/CreateRemoteThread), or an XOR-encoded payload alongside execution-API strings, staged in an oversized binary stream (Pictures, a numbered *Table). Legitimate presentations never embed executables or shellcode; this is the payload half of a PowerPoint memory-corruption exploit. Attributed to the CVE-2011-1269 / MS11-036 family (the same record-overflow delivery is shared with CVE-2010-2572 and CVE-2009-0556, so the exact CVE is not narrowed statically). The malformed-record trigger itself is not used as the signal because the PowerPoint persist-object directory makes naive record walks unreliable.
VBA macro references PowerShell.
PowerShell is one of the most common tools used in the second stage of macro-based attacks — downloading and executing payloads in memory.
VBA reconstructs URLs from OOXML properties, writes downloaded scripts, and schedules them.
Correlates property constant propagation with HTTP response text, script creation, schtasks /Create, and Shell execution.
Raw OLE streams contain AutoOpen, DNS API use, temp/AppData staging, and hidden Shell execution.
Some malformed or stomped VBA projects expose useful macro text in raw OLE streams even when normal source extraction fails. AutoOpen combined with DnsQuery/DnsRecordListFree, temp or AppData path construction, and Shell vbHide provides the hidden execution step. These operations form a DNS-based staging chain and are not document automation.
Raw OLE macro text shows self-replication or security tampering
critical
OLE_RAW_MACRO_SELF_REPLICATION
Raw OLE streams contain macro text with auto-run, automation, CodeModule modification, and Outlook or macro-security behavior.
Some OLE documents expose malicious macro text as raw strings even when oletools cannot recover a standard VBA project. Auto-run entry points paired with CreateObject, CodeModule AddFromString/InsertLines/DeleteLines, Outlook automation, or macro-security tampering establish macro-virus behavior.
VBA invokes scrobj.dll DllInstall with a remote .sct URL.
scrobj DllInstall loads and executes COM scriptlet content from the supplied remote .sct URL.
A secured/protected-document call to action targets unrelated infrastructure.
Correlates visible security and action language with the actual OOXML hyperlink host; an official destination for a named service is excluded.
An Excel externalLinks/ddeLink entry launches cmd, PowerShell, mshta, or another dangerous executable.
This workbook uses SpreadsheetML DDE command execution. The payload is stored in xl/externalLinks/externalLink*.xml as ddeService/ddeTopic attributes and may be triggered by a formula such as =[1]!Name. This is separate from Word DDE field abuse and does not require VBA macros.
Payload URL was reconstructed from numeric cell values across the worksheet, not present as a literal string.
XLM downloaders evade literal-bytes URL extraction by storing each character of the URL — or of an embedded HTA that contains the URL — as the numeric value of an individual cell. The macrosheet's formulas read the cells via CHAR()/&-concat and build the URL only at execution time, so the string is never contiguous in the workbook bytes. URLs surfaced here were recovered by walking the BIFF12 record stream of every worksheet and macrosheet part.
VBA macro references URLDownloadToFile API.
This API downloads a file from the internet to disk. It is one of the most common functions in macro droppers that fetch second-stage malware from a remote server.
A package part not referenced by any relationship carries executable shellcode.
An OOXML package part that no relationship references contains a shellcode prolog or API-hash resolver (e.g. a Metasploit stub hidden as xl/media/*.bin). Legitimate packages never ship an orphan binary part containing shellcode, so this is a smuggled payload read by another component at runtime.
VBA ActiveX/UserForm event decodes worksheet-cell strings and executes them through ExecuteExcel4Macro.
The macro bridges ActiveX/UserForm event activation into Excel 4.0 macro formula execution. The command text is reconstructed from worksheet cells with Mid/Asc/Chr shifting before being passed to ExecuteExcel4Macro, which implements a macro stager. It is executable macro behavior, not evidence of an Office parser CVE.
Auto-exec VBA reconstructs a command from worksheet cells and invokes Shell.
The detector requires cell iteration or character assembly, delimiter removal, and an execution sink, avoiding generic detections on ordinary cell-processing macros.
VBA macro drives Outlook to mass-mail itself — creates mail items, harvests recipients, and auto-attaches the carrier.
The macro automates Outlook.Application and programmatically creates mail items, then spreads by at least two independent worm behaviors: harvesting recipient addresses from the MAPI address book / inbox (GAL enumeration, default-folder walk, or scraping message bodies), auto-attaching a file (the carrier) to outgoing messages, and sending them programmatically. A benign “email this report” macro mails a single fixed recipient and never enumerates the address book, so the conjunction is the defining behavior of the Melissa / LoveLetter / W97M mass-mailer worm lineage, detected independently of any AV signature.
VBA macro rewrites VBA project code (self-replication) and/or disables Office macro-virus protection.
The macro programmatically edits VBA project code through the VBE object model — CodeModule/VBComponents/VBProject with InsertLines, DeleteLines, AddFromString, or OrganizerCopy — to copy itself into the global template (Normal.dot) and other open documents, and/or sets Options.VirusProtection = False to silence Word's macro-virus warning. Self-replicating macro code has no benign document use; this is the defining behavior of the W97M macro-virus family (Thus, Melissa, Class, Marker), detected independently of any AV signature. Writes that target only the running document are self-modification, not replication, and are reported as OLE_VBA_SELF_MODIFYING_PROJECT instead.
VBA p-code self-replication and hosts-file tampering
critical
OLE_VBA_PCODE_SELF_REPLICATING_HOSTS_TAMPER
Compiled VBA/cache streams show auto-run, VBA project self-modification, and hosts-file or startup add-in persistence.
Some malicious Excel macro viruses hide executable behavior in compiled p-code while the source stream is empty or misleading. The detector requires the combination of an auto-run entry point, CodeModule/VBComponents InsertLines/CountOfLines self-modification, and either Windows hosts-file tampering or Excel startup/add-in persistence. That combination is not normal workbook automation and is consistent with a self-replicating macro virus.
VBA reconstructs MSHTA network stager from UserForm data
critical
OLE_VBA_USERFORM_FRAGMENTED_MSHTA_STAGER
Auto-exec VBA combines Tag properties and hidden container strings into an MSHTA command.
The detector requires auto-execution, a Shell sink, repeated UserForm Tag access, the fragmented mshta name, and external network data stored outside macro source.
VBA reconstructs embedded bytes and executes them from ProgramData
critical
OLE_VBA_DOMDOCUMENT_EMBEDDED_DROP_EXEC
VBA auto-exec macro rebuilds embedded bytes with MSXML2.DOMDocument, writes them with ADODB.Stream, and launches them from ProgramData.
The macro does not need a network download: it reconstructs an embedded payload with MSXML2.DOMDocument, saves it through ADODB.Stream.SaveToFile under %PROGRAMDATA%, then executes the written file with Shell. The combination of auto-exec, binary reconstruction, file write, ProgramData drop path, and execution form a complete dropper chain.
Auto-exec VBA registers an executable action through the Task Scheduler COM service.
Schedule.Service, NewTask, Actions.Create and RegisterTaskDefinition form a complete task-based execution and persistence chain. Cell-derived arguments further indicate command obfuscation.
VBA writes a script-like file and launches it via Excel DDEInitiate with cmd.
The macro creates a .vbe/.vbs/.js/.hta/.bat/.cmd/.ps1 payload on disk and uses Excel DDEInitiate("cmd", ...) to execute it. The write-and-execute chain is malicious even when no Office parser CVE is present.
VBA creates a hidden Excel 4 macro sheet, writes formulas, and runs it.
Dynamically creating a hidden macro sheet and transferring execution into formulas is a complete XLM stager even without a traditional Office auto-execution procedure.
Auto-exec VBA reconstructs and runs a VBScript download/write/execute chain through ScriptControl.
Requires ScriptControl AddCode/Run plus XMLHTTP, ADODB.Stream, response-body saving, and WScript.Shell after bounded delimiter removal; the recovered stage and URLs are carved.
VBA macro uses WScript.Shell object.
WScript.Shell provides Run and Exec methods that launch commands. Malware creates this COM object to execute system commands or scripts.
xl/connections.xml defines a data connection that executes a command (xp_cmdshell / OLEDB exec).
A workbook data connection runs a command on refresh — SQL Server xp_cmdshell, or an OLEDB "Extended Properties=exec …" clause. Benign connections only read data; running shell/SQL commands from a data connection is a code-execution vector (MITRE T1059).
An Excel worksheet cell formula uses DDE syntax to launch a shell/LOLBIN command.
The cell formula uses Excel DDE syntax (=<app>|<topic>!<item>) with a shell or LOLBIN application such as cmd or PowerShell, so a command runs when the cell recalculates. Unlike OOXML_SPREADSHEET_DDE_LINK this payload is stored inline in the <f> cell formula, not in an externalLinks/ddeLink relationship, and needs no VBA (MITRE T1559.002).
XLM Auto_Open macro runs host-environment checks before showing a fake error and closing.
Malicious Excel 4.0 macros often abort when the workbook appears to be opened in a sandbox, non-Windows host, or reduced UI environment. The detector requires an XLM macro sheet with Auto_Open plus multiple GET.WORKSPACE/GET.WINDOW checks and an ALERT()/CLOSE(FALSE) decoy such as a fake corrupted workbook message. That combination is intentionally narrow and is not normal spreadsheet automation.
WinAPI names, LOLBin commands, or a payload URL were reassembled from per-character CHAR()/string-fragment concatenation inside the macrosheet formulas.
The most evasive Excel 4.0 downloaders never store their payload as a contiguous literal: each WinAPI name, shell command, drop path, or URL is built at runtime by concatenating CHAR(n) calls and one- or two-character string fragments inside the formula token stream (rgce). Literal-bytes and numeric cell-array scanners both miss this. The analyzer parses each formula's rgce, reconstructs the string it builds, and reports it when it resolves to a download/execute kill chain (e.g. URLDownloadToFile, regsvr32, mshta, wmic, a URL). This construct does not occur in benign workbooks.
Jet/Access database uses a document extension and contains macro/dropper strings.
The file is a Microsoft Jet/Access database while using a Word/Excel/PowerPoint-style extension, and contains strings associated with VBA execution or payload dropping. This is a masquerade/dropper vector, not a parser CVE.
Document contains ActiveX controls.
ActiveX controls are compiled components that can execute native code. They have a long history of exploitation and are a significant risk in Office documents.
An Excel record-continuation (CONTINUE) block appears with no preceding record to continue — a position abused by several Excel parser CVEs.
Readers that append CONTINUE bodies to the previous record's buffer regardless of compatibility have driven multiple Excel CVEs.
Single non-CONTINUE record body > 8224 bytes (BIFF8 spec maximum).
The legitimate way to ship a payload that big is a CONTINUE chain. An oversized single record is the shape behind several Excel size-parsing bugs.
Record's declared body size extends past the stream's last byte.
Excel's record reader can reject the file or — in older versions — copy as many bytes as remain, leaving uninitialised memory in the record buffer. Known shape behind several Excel parser CVEs.
A BOF substream reaches the end of the Workbook stream without a matching EOF.
A BOF substream reaching the end of the Workbook stream without a matching EOF means older or buggy readers may continue parsing with stale substream/parser state.
Workbook contains thousands of BIFF NAME records.
Defined names are formula-bearing BIFF parser inputs. Very large contiguous runs of NAME records are unusual in benign documents and can trigger Excel/BIFF parser stress or corruption bugs in Office and analysis tooling.
VBA macro uses CallByName for dynamic method invocation.
CallByName invokes methods dynamically by string name, allowing malware to obfuscate which functions it calls and evade static analysis.
An Excel cell formula points at a remote .exe/.scr/.hta/.js or macro-enabled workbook.
A =HYPERLINK() call or a remote-workbook reference in a cell formula targets a remote executable, script, or macro-enabled workbook. Formula-embedded links are not walked by the relationship-based hyperlink detector, so this download/exec pointer would otherwise be missed.
RTF OLE object contains Composite Moniker CLSID without nearby scriptlet payload evidence.
Composite Moniker is the vulnerable primitive associated with CVE-2017-8570, but the detector did not confirm the SCT/scriptlet payload shape. Treat it as related moniker attack-surface evidence rather than a CVE-specific match.
VBA macro calls CreateObject.
CreateObject instantiates COM objects (like WScript.Shell, XMLHTTP, ADODB.Stream) that provide system access. Malware uses these to download files, run commands, or interact with the file system.
A DDEAUTO field instruction was found — it attempts automatic execution or update when the document is opened.
Unlike regular DDE which asks the user to 'update links', DDEAUTO attempts to execute its command automatically when the document opens. Prompts or blocking can still occur depending on Office version, policy, and Protected View state. This technique is catalogued as MITRE ATT&CK T1559.002.
An OOXML review, signing, or open-document CTA has an actionable external hyperlink.
The rule follows actual External hyperlink relationships, including ordinary worksheet and shape links, and requires a strict document-review CTA. XML schema namespace URLs and internal package relationships are excluded.
EMF header's rclBounds rectangle has right < left or bottom < top.
Multiple EMF parser bugs (CVE-2017-0108 / CVE-2017-8553 family) have lived behind unchecked dimension arithmetic on rclBounds. A negative width or height drives into integer-overflow paths.
EMR record's size field runs past available bytes, is < 8, or is not 4-byte aligned.
EMF records are required to be 4-byte aligned with size >= 8 bytes. Readers that advance by `nSize` without checking misalign their record pointer or read attacker-controlled bytes from the gap.
EncryptedPackage cipher body is not a multiple of 16 bytes, violating the AES block-alignment requirement in [MS-OFFCRYPTO] §2.3.4.4.
The AES-CBC/ECB cipher used by Office Standard Encryption requires the cipher body (after the 8-byte declared-size header) to be a multiple of 16 bytes. Excel itself tolerates the misalignment by truncating to the last full block; most strict decryption tools (including antivirus/EDR scanners that introspect inner content) reject the file outright. This asymmetric tolerance is a deliberate evasion shape: the document opens normally in Office but defeats static inspection that depends on a successful decrypt-and-rescan.
IOC-less Equation payload contains position-independent process-manipulation shellcode.
The payload combines get-PC/PEB or sled evidence with multiple memory/process APIs. The bounded raw stream is carved for authenticated analysis; no URL is inferred when network configuration remains encrypted or absent.
Equation exploit payload exposes a command or local executable target without a recoverable URL.
This surfaces URL-less behavior such as calc.exe proof-of-concept payloads and command stagers that expect another component to place an executable or script on disk. It is emitted only after an Equation exploit finding has established the carrier context.
XLM macro sheet references two or more dangerous capability functions (CALL/EXEC/REGISTER/FWRITE/FOPEN).
The download (CALL into URLDownloadToFile), native-code, process-exec (EXEC) and file-write (FWRITE/FOPEN) primitives of an XLM dropper, recovered directly from the BIFF records. Because it does not depend on deobfuscating the full formula chain, it convicts built-in-name and olevba-blind XLM downloaders that otherwise score only as a bare macro sheet.
OLE workbook contains an Excel 4.0 macro sheet, optionally with Auto_Open/Close.
Excel 4.0 (XLM) macros were a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. An Auto_Open / Auto_Close defined name combined with a macro-sheet sub-stream is the common XLM auto-execution shape used by families such as Emotet and QakBot.
Spreadsheet contains an xl/macrosheets/sheet*.xml part.
A definitive structural indicator of Excel 4.0 macros. XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
XLM macro sheet references a payload module (.dll/.exe/.ocx/.scr) by a relative (..\) or environment-variable (%ENV%\) path.
Legitimate Excel 4.0 macros call REGISTER()/CALL() against bare system DLL names (Kernel32, shell32.dll) resolved from the system search path. A relative or %ENV%-path reference to a NON-system module is the drop-to-current-directory then load-and-execute pattern used by XLM DLL-loader droppers (the iroto.dll / hdrh.dll family). The module literal is recovered directly from the BIFF8 workbook stream, so it fires even when olevba cannot decompile the (often deliberately damaged) macro sheet and the workbook would otherwise be scored only at 'macro sheet present'.
OOXML oleObject relationship targets an external HTTP(S) URL.
An external oleObject relationship is stronger than a normal hyperlink: Office resolves it through object/OLE update paths and may fetch remote content when the document is opened or updated. This is the relationship shape used by multiple Office remote-object exploitation and delivery chains, so it should not be reduced to generic external-link evidence.
Document references an external target (URL) in its .rels file.
External relationships can be used for remote template injection — the document loads a macro-enabled template from a remote server when opened, bypassing email attachment filters that block macros.
A Flat OPC/XML Office document automatically retrieves a remote template.
External attachedTemplate relationships are active content-loading behavior, not ordinary embedded hyperlinks; the remote template can supply executable macros when Word opens the document.
VBA macro calls GetObject.
GetObject can reference running COM objects or create instances from monikers. It is sometimes used as an alternative to CreateObject to evade detection.
Office document embeds a ShockwaveFlash object with an old SWF version.
The document contains a ShockwaveFlash ActiveX object and an embedded SWF with a legacy version. This is Flash-in-Office exploit-family evidence, but exact Flash CVE attribution requires SWF tag-level validation.
Legacy WordBasic auto-execution markers co-occur with macro-virus family or macro-management strings.
Historical Word macro viruses often stored WordBasic macro content in legacy WordDocument structures, with strings such as ToolsMacro, MacroFile$, fileMacro$, globMacro$, Wazzu, RSN/SIRPA, WM.Colors, CAP/CAPut, AAAZ/PAYLOAD, or similar family markers. These are not modern VBA projects, so standard VBA extraction can miss them. The finding detail names observed sub-families/behaviors when possible, and the scanner carves a readable legacy WordBasic text excerpt for analyst review.
FONT record's NUL-terminated typeface name is longer than the 32-byte spec maximum.
The CVE-2017-11882 primitive overflows this exact field — readers prior to the patched build copied the entire NUL-terminated string into a 32-byte stack buffer. The detector validates the oversized field rather than relying on a fixed exploit byte sequence.
MATRIX record declares rows or columns > 64.
CVE-2018-0798 abuses the MATRIX rows/cols fields to drive an OOB write. Real equations contain at most a few dozen rows/cols; values above 64 are the structural shape of the exploit family.
SIZE record declares an explicit point size or delta far beyond normal equation text.
The published MTEF format uses record type 9 for SIZE. CVE-2018-0802 abuses Equation Editor's SIZE-record parser path; legitimate equations do not need 128pt+ explicit sizes or deltas. This structural rule runs only inside recovered Equation Native streams.
DIFAT extension chain loops, points beyond file end, or its declared length disagrees with the first-sector field.
A crafted DIFAT pointing past EOF is the classic shape behind the Word `cb*` family of CVEs. Real writers always emit a linear, in-range DIFAT.
OLE compound document is named with an .rtf extension and contains ObjectPool storage.
ObjectPool is where Word/OLE compound documents keep embedded-object storages. A file whose basename ends in .rtf but is actually an OLE compound container with ObjectPool is an extension/content mismatch that suggests a disguised Word/OLE container and embedded-object attack surface.
OLE VBA macro behavior: OLE VBA ActiveX XLM Cell Stager.
The OLE document contains VBA macro evidence for suspicious execution, payload staging, command construction, object abuse, or network retrieval.
OLE VBA macro behavior: OLE VBA Base64 Shell Command Stager.
The OLE document contains VBA macro evidence for suspicious execution, payload staging, command construction, object abuse, or network retrieval.
OLE VBA macro behavior: OLE VBA Obfuscated URL.
The OLE document contains VBA macro evidence for suspicious execution, payload staging, command construction, object abuse, or network retrieval.
OLE VBA macro behavior: OLE VBA URLDownload Reversed LOLBIN.
The OLE document contains VBA macro evidence for suspicious execution, payload staging, command construction, object abuse, or network retrieval.
OLE VBA macro behavior: OLE VBA UserForm Hidden Command Stager.
The OLE document contains VBA macro evidence for suspicious execution, payload staging, command construction, object abuse, or network retrieval.
OLE Excel 4.0 macro evidence: OLE XLM AutoOpen Payload Lure.
The OLE workbook contains Excel 4.0 macro structures or recovered cell content associated with auto-execution, downloader behavior, obfuscation, or exploit delivery.
OLE Excel 4.0 macro evidence: OLE XLM Cell Array URL.
The OLE workbook contains Excel 4.0 macro structures or recovered cell content associated with auto-execution, downloader behavior, obfuscation, or exploit delivery.
OLE Excel 4.0 macro evidence: OLE XLM Encrypted Macrosheet.
The OLE workbook contains Excel 4.0 macro structures or recovered cell content associated with auto-execution, downloader behavior, obfuscation, or exploit delivery.
OLE Excel 4.0 macro evidence: OLE XLM Obfuscated Defined Name Chain.
The OLE workbook contains Excel 4.0 macro structures or recovered cell content associated with auto-execution, downloader behavior, obfuscation, or exploit delivery.
OLE Excel 4.0 macro evidence: OLE XLM Obfuscated Setname Chain.
The OLE workbook contains Excel 4.0 macro structures or recovered cell content associated with auto-execution, downloader behavior, obfuscation, or exploit delivery.
Large high-entropy bytes beyond declared streams contain shellcode or loader markers.
The OLE file has a sizable high-entropy region after the declared major streams, and that appended region contains PE, shellcode, or loader API indicators. This is a payload-carrier heuristic rather than a CVE-specific attribution, and is gated on both entropy and concrete executable markers to limit false positives.
CFB directory red/black-tree walk visits the same DirID twice.
A spec-compliant compound file's directory tree is acyclic. Cycles are an encoder-impossible shape that hand-edited containers use to force parsers into infinite recursion or to hide named streams from one walk while still resolving them from another.
OLE/Word document bytes contain a hidden iframe that loads an external URL.
The document contains raw HTML iframe markup whose source is an external HTTP(S) URL and whose width/height are set to 0 or 1. Hidden iframes are a malicious web-staging pattern used to load next-stage exploit or redirect content. This confirms a web-staging path but does not identify a specific Office CVE. An Equation object without the remote stage is reported separately.
OLE workbook metadata lists many MacroN sheet titles with an Excel 4.0 macro-sheet marker.
Encrypted BIFF workbooks can hide XLM formula bodies from static extractors, but the clear DocumentSummaryInformation stream may still expose the workbook sheet inventory. Many MacroN sheet titles plus a BIFF Excel 4.0 macro-sheet marker is a strong XLM malware/evasion signal, especially when FILEPASS encryption is also present.
Malformed OLE bytes contain PEB/API-resolver shellcode evidence.
The file-level OLE bytes contain a PEB/API-resolver marker, loader-walk instruction context, and a nearby payload marker such as a NOP sled, MZ bytes, or hash-rotate loop. This is useful for malformed OLE exploit carriers where stream parsing fails, but it is intentionally not a CVE-specific attribution.
A stream's sector chain revisits a sector or follows a pointer outside the FAT.
Standard CFB writers never produce loops; readers that follow chains without cycle detection enter an infinite loop or read attacker-controlled bytes after the loop wraps. Encoder-impossible shape behind several pre-2017 Word/Excel container CVEs.
Two different streams' sector chains include the same sector.
Reader divergence shape — depending on which stream is read first, the same bytes are interpreted as different content. Encoder-impossible.
OOXML package anomaly: OOXML Clickable Image Form Lure.
The Office package contains unusual relationships, embedded objects, custom parts, encryption, or lure structure associated with malicious OOXML documents.
OOXML clickable image links to suspicious landing infrastructure.
The Office package uses an embedded image as a click-through lure and links it to suspicious landing infrastructure, such as throwaway TLDs, .ru.com subdomains, or document/share redirect paths. Requiring both the image-lure shape and the suspicious target keeps this narrower than a generic external hyperlink.
OOXML package anomaly: OOXML Embedded Object URL.
The Office package contains unusual relationships, embedded objects, custom parts, encryption, or lure structure associated with malicious OOXML documents.
OOXML package anomaly: OOXML External Rel userinfo Doc Lure.
The Office package contains unusual relationships, embedded objects, custom parts, encryption, or lure structure associated with malicious OOXML documents.
OOXML package anomaly: OOXML Link Aggregator Doc Lure.
The Office package contains unusual relationships, embedded objects, custom parts, encryption, or lure structure associated with malicious OOXML documents.
OOXML Excel 4.0 macro evidence: OOXML XLM Formula Concat URL.
The OOXML workbook contains Excel 4.0 macro structures or recovered cell content associated with auto-execution, downloader behavior, obfuscation, or exploit delivery.
OOXML Excel 4.0 macro evidence: OOXML XLM Payload URL.
The OOXML workbook contains Excel 4.0 macro structures or recovered cell content associated with auto-execution, downloader behavior, obfuscation, or exploit delivery.
Any XML part inside an OOXML package contains <!DOCTYPE.
Office never emits DOCTYPE in its XML parts. The presence of one is a structural indicator that the package was authored by hand or by tooling outside the Office writer family — frequently as the staging step for an XXE attempt.
An <!ENTITY ... SYSTEM ...> or PUBLIC declaration was found in an XML part.
Pure XML-external-entity (XXE) shape. Office's own parser configuration historically ignored these, but third-party consumers of the same XML (cloud indexing, preview generators) may resolve them and disclose data.
External `<Relationship>` of a non-hyperlink type uses an MSDT, search-ms, MHTML, scriptlet, or javascript: scheme.
Office's dispatch path resolves these schemes to non-browser handlers. Structural shape behind CVE-2022-30190 (Follina), CVE-2021-40444, CVE-2024-21413 and the RomCom external-RTF chain.
Internal-mode `<Relationship>` Target uses `..` segments that resolve above the package root.
ZIP path-traversal shape. Some Office configurations honour the literal path before normalisation, giving a drop-anywhere primitive.
Relationship typed as `oleObject` resolves to an HTML/CAB/MHT/scriptlet/HTA target.
The CVE-2021-40444 family abuses exactly this shape: the Type drives Office to load the target through the OLE/MHTML dispatch path, but the target bytes are interpreted as a different format. Generalised from named CVEs so future 0-days in the same family surface.
The OPC relationship graph is supposed to be a DAG; a cycle is encoder-impossible.
Containers using cycles try to force resolution loops or to make a part reachable only from inside its own subtree.
OOXML document is encrypted with a common default password.
The Office package uses a known default password pattern. This is often used to hide exploit or macro content while still allowing automated malware tooling to open the document.
ObjectPool EPRINT stream contains EMF data.
An OLE ObjectPool EPRINT stream with EMF data is rare in normal documents and is consistent with Office object-delivery exploit staging when paired with payload anomalies. The rule is related evidence only; it does not prove a malformed graphics record or exact CVE attribution.
OLE Package displayName is benign-looking while fullPath/defFile ends in an executable extension.
The user double-clicks what looks like a document and gets a binary executed. UI-spoofing shape used by package-as-dropper campaigns.
OLE Package displayName, fullPath, or defFile has an executable/script-capable extension.
Office Package objects are commonly used to embed arbitrary files. When the packaged file is directly runnable, such as EXE, JAR, HTA, script, shortcut, installer, or similar content, the document is carrying high-risk delivery payload even if the UI name is not spoofed.
OLE Package filename contains `..\` or `\\host\` traversal sequences.
Some Office versions write the dropped file to the path embedded in the Package, giving the attacker a drop-anywhere primitive.
VBA builds its stage-2 download URL char-by-char from string literals + Chr()/Asc()/StrReverse() (no numeric array); URLs recovered.
The macro assembles its stage-2 download URL character by character from string literals concatenated with Chr()/Asc()/StrReverse() results — often nested (Chr(Asc(Chr(Asc("h")))) = "h") and split across the + and & operators, sometimes emitted via Print #n, into a second-stage VBScript/PowerShell file. There is no numeric array to brute-force and the URL is never contiguous on disk, so the literal scan and the array recoverers all miss it (the "adobeacd-update" maldoc family). A bounded VBA value-expression evaluator resolves the expressions and harvests the URL. Self-validating: only a valid host URL that is not already present verbatim in the macro is reported, so a benign macro cannot false-positive.
VBA builds its stage-2 download URL from a numeric array decoded with Chr() and a linear offset (XMLHTTP/ADODB.Stream dropper); URLs recovered.
The macro stores its stage-2 download URL as a numeric array (Array(250, 262, …)) and decodes it one character at a time with Chr() and a linear offset (e.g. Chr(n - 146)), then drives Microsoft.XMLHTTP.Open "GET", url with ADODB.Stream.SaveToFile and Shell.Application to drop and execute the payload in %TEMP%. This is the VBA-native analogue of the PowerShell char-array loader (no PowerShell, so that path does not see it); the URL is assembled at run time and never contiguous on disk. The analyzer folds the VBA concatenation, treats every run of small numbers as an array, brute-forces the per-element transform, and accepts only a decode that yields a valid host URL — so a benign numeric table cannot false-positive.
VBA runs a PowerShell stage-2 loader whose download URL is hidden in a numeric char-code array (XOR/+/- decoded at runtime); URLs recovered.
The macro assembles (from string literals scattered across helper functions, padded with dead TypeName/arithmetic junk) a WScript.Shell command that runs a PowerShell stage-2 loader. The download URL is stored as a numeric char-code array decoded at runtime by [char]($_ -bxor k) (or +k / -k) after splitting on obfuscated, case-folded delimiters, so no literal URL scan sees it. The analyzer folds the VBA concatenation, treats every run of small numbers as an array, brute-forces the per-element transform, and accepts only a decode that yields a valid host URL — typically an @-separated fallback list dropped to %TEMP% and executed. Self-validating, so a benign numeric table cannot false-positive.
VBA assembles a PowerShell command from Mid(StrReverse(...)) fragments and AES-decrypts a key-encrypted ConvertTo-SecureString stage-2 WebClient downloader; download URLs recovered.
The Hancitor/Emotet-era maldoc builds a PowerShell command at runtime from dozens of reversed-substring fragments (a per-sample-named Mid(StrReverse(s),a,b) decoder), runs it hidden via WScript.Shell.Run (vbHide), and IEX-decrypts a key-encrypted ConvertTo-SecureString blob (fixed 76492d11… magic + base64 of version|IV|ciphertext, AES-CBC with the inline -Key bytes). The decrypted plaintext is a System.Net.WebClient DownloadFile + Invoke-Item dropper that drops an EXE to %PUBLIC% and runs it, with an @-separated fallback-host list. The download URLs exist only after the reverse-substring assembly AND the AES decrypt, so no literal scan sees them. The analyzer emulates the decoder, decrypts the SecureString, and accepts only valid host URLs — self-validating, so a benign macro cannot false-positive.
VBA reassembles a download command via a cmd.exe character-index loop and a multi-host PowerShell downloader; payload URLs recovered.
The macro hides its download command behind two reversible layers: the URL-bearing command is concatenated from string literals scattered across many helper functions (the visible code is padded with dead TypeName/arithmetic junk), then rebuilt by a cmd.exe character-index loop (set <var>=<charset> & for %p in (<indices>) do !<var>:~%p,1!) into a PowerShell downloader that tries an @-separated list of fallback hosts. The analyzer folds the VBA concatenation, decodes the character-index stage, and surfaces the recovered hosts as IOCs. Self-validating: only transforms yielding syntactically valid host URLs are reported.
Small embedded PowerPoint stream has sparse OffArray-style records and no normal text atoms.
The PowerPoint Document stream is a small, sparse record stub containing records associated with OffArray-style exploit documents and lacking normal slide text/placeholder atoms. This is reported as related to CVE-2009-0556 until the malformed OffArray field is directly validated.
PowerPoint Pictures stream and document shellcode match a CVE-2006-0022-adjacent shape.
Legacy PowerPoint samples match when they contain the large Pictures stream, embedded image-record material, MZ-like payload bytes, and compact PEB/API-resolver shellcode in the PowerPoint Document stream, but do not provide enough static evidence for the exact CVE-2006-0022 PE-in-malformed-CFB-chain rule. It is reported as related rather than exact to reduce false CVE attribution.
Document loads its template from a remote URL (attachedTemplate / template / frame).
Word can fetch and apply a remote template when the document is opened; macros in that template may execute depending on Office policy, trust state, and Protected View. This is a common remote-template-injection vector used by Hancitor, Emotet, and many phishing campaigns.
RTF OLE object contains URL Moniker evidence without a confirmed remote target.
URL Moniker is the OLE2Link primitive abused by CVE-2017-0199, but the RTF scanner could not decode a remote http/https/ftp target from the embedded object. This is related attack-surface evidence, not proof of CVE-2017-0199 exploitation.
VBA saves a copy of the workbook into Application.StartupPath (XLSTART) so it auto-loads on every Excel launch.
Anything in the Excel XLSTART startup folder loads automatically every time Excel starts. A macro that writes a copy of its own workbook into Application.StartupPath is establishing persistence — the hallmark of a resident Excel macro virus (Laroux/"StartUp" lineage) rather than a normal document. Detected by a SaveAs/SaveCopyAs whose target is Application.StartupPath.
VBA reroutes Alt+F11 (Visual Basic editor) and/or Alt+F8 (macro list) through Application.OnKey to intercept attempts to view the macro code.
Application.OnKey can rebind keyboard shortcuts. A macro that captures Alt+F11 (the Visual Basic editor) or Alt+F8 (the macro dialog) is intercepting the exact keystrokes an analyst or user would press to inspect the code — frequently to hide or remove the viral module while it is resident. This anti-analysis behaviour is characteristic of resident Excel macro viruses, not legitimate documents.
VBA infects other workbooks via an OnSheetActivate copy hook
high
OLE_VBA_WORKBOOK_INFECTION_SPREADER
VBA installs an Application.OnSheetActivate handler that copies a macro-bearing sheet into the active workbook, infecting every workbook the user opens.
Resident Excel macro viruses spread by hooking Application.OnSheetActivate (a global event that fires whenever any sheet is activated) and, from that handler, copying the viral sheet into the front of the active workbook. Every workbook the victim opens can then carry the macro onward. The OnSheetActivate hook initiates the copy into another workbook and therefore implements replication.
Compiled VBA/cache stream pairs an auto-run token WITH a shell/download/object-execution token (the combination, not either alone).
Some malicious Office documents keep executable VBA in compiled p-code or cache streams while source extraction fails or returns empty output. The detector reports on the combination of two tokens co-occurring in the same compiled stream: an auto-execution entry point (Auto_Open / Document_Open / Workbook_Open / Auto_Close) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token on its own is flagged — for example CreateObject is benign by itself; it is the pairing with an auto-run entry point that is the macro-malware indicator, even when decoded source is unavailable.
_VBA_PROJECT stream is substantive but every module-like sibling source stream is empty or absent.
The canonical 'VBA stomping' shape: the renderer executes the compiled P-code while scanners that read source see nothing. Used by post-2018 Office malware campaigns to evade source-based AV.
Legacy Word binary format carries executable payload markers.
The file starts with a Word 6/95 legacy binary magic and carries embedded executable payload markers. This is MS09-024/CVE-2009-1136-family attack surface evidence, but not an exact CVE attribution without validating the malformed converter record.
Word SET/REF field variables assemble a hidden DDE command from fragments, so the literal command never appears in the document's raw bytes — a known field-chaining obfuscation.
Word's SET <name> field defines a variable and REF <name> dereferences it. When ≥2 closed SET/REF pairs co-occur with a DDE field, the typical purpose is to assemble the DDE command string at field-update time so the literal cmd/powershell tokens never appear in the raw document bytes. This is the documented field-chain obfuscation chain (SensePost 2017, MITRE ATT&CK T1559.002) and has no documented benign use.
XLM auto-exec macro uses formula APIs that can run code or write files.
Excel 4.0 macro formulas such as RUN, CALL, EXEC, REGISTER, FOPEN, FWRITE, FORMULA, and HALT can execute programs, write payloads, or control macro flow without VBA. Paired with Auto_Open, this is a strong malware indicator.
Excel 4.0 macro sheet contains a URL-shortener target.
URL shorteners are legitimate services, but they are high-signal inside Excel 4.0 macro formulas because XLM malware commonly uses shortened links to obscure the payload host and rotate infrastructure after delivery.
A <w:altChunk> wires an aFChunk relationship to an RTF/HTML part that is absent from the package.
The altChunk RTF/HTML-injection wrapper inlines and executes an embedded RTF/HTML part when Word opens the document. When the wiring and content-type are present but the target part is missing, the sample is a payload-stripped builder stub (or had its weaponized chunk removed). The injection wiring to an RTF/HTML type is itself the indicator, independent of whether the payload is currently attached.
VBA macro references cmd.exe.
Invoking cmd.exe from a macro allows running arbitrary Windows commands, which is a core technique in macro-based malware.
An Excel sub-stream declares an unknown type (not workbook-globals, sheet, chart, macro, or VB-module), which older Excel may parse with the wrong record layout.
Older Excel falls through to a default handler that may parse the substream with the wrong record-table.
NAME record's character-count (cch) field exceeds the BIFF8 limit of 255.
Older Excel may copy `cch * sizeof(WCHAR)` bytes into a fixed-size buffer.
Workbook contains an unusually large number of BIFF records.
This is not a CVE-specific signature, but malformed or stress-test BIFF graphs have been used to trigger Excel parser bugs and third-party scanner failures. The scanner bounds its walk and reports excessive record graphs explicitly.
An Excel sub-stream's begin (BOF) and end (EOF) markers are unbalanced — readers that ignore the mismatch can reach attacker-controlled parser state.
Substreams must be properly nested; readers that pop their substream stack regardless of balance reach attacker-controlled state.
File has a valid OLE2/CFB header but olefile exposes zero directory streams.
A non-empty compound document whose directory cannot be read is anomalous. It occurs with truncated/corrupt files and, notably, with content shifted off byte boundaries (e.g. a whole-file nibble shift) to defeat olefile and byte-aligned signatures while the host Office application still recovers the embedded object — a known CVE-2017-11882 evasion.
First record isn't EMR_HEADER (type 1) with the documented dSignature value.
An EMF blob's first record must be EMR_HEADER with declared size >= 88 and the dSignature field 'EMF' at offset 40. Readers that fail-open on header anomalies have driven multiple EMF parser CVEs.
EMF header's nRecords field exceeds 100,000.
Real-world embedded EMF blobs contain at most a few thousand records. Hundreds of thousands is a hand-crafted shape used to stress the renderer's record dispatch table.
EMR record's type field is outside 1..123 standard or 0x4000+ vendor extension.
Renderers' dispatch tables typically fall through to a generic handler that may mis-parse the body when an unknown record type is reached.
Document contains an embedded OLE object.
OLE objects embedded in OOXML documents can contain executables, scripts, or exploit payloads. They warrant inspection.
Workbook references another workbook via an externalLinkPath relationship (cell / dropdown / chart-source data link).
Unlike a remote-template or external-object relationship, an external workbook data link does not load or execute code — Excel prompts before updating links and only pulls cell values. Legitimate macro-enabled business forms routinely reference a source/template workbook this way, so on its own it is a weak signal (and the macro-capability tiering treats it as such). It is still surfaced because a UNC / bare-IP target can leak NetNTLM credentials via forced authentication if the user updates links.
A legacy Word 6/95 WordBasic auto-execution marker such as AutoOpen was found.
Older Word documents can contain WordBasic macro execution surface that is not exposed as a modern VBA project. A bare AutoOpen marker is not enough to classify a downloader or CVE, but it tells analysts why old macro malware signatures may fire.
MTEF version byte at the start of the Equation Native stream is not 2..6.
Encoders never produce version values outside the documented set (2 = Equation Editor 2.x, 3 = Equation Editor 3.0, 4 = MathType 3.x, 5 = MathType 4.x, 6 = MathType 5.x). Other values force readers into default handlers that may parse the body with the wrong record table.
Inner payload of an OLE Package contains the OLE Package CLSID itself, or multiple Package CLSIDs in one container.
Russian-doll obfuscation has been used to bypass scanners that only inspect the outermost layer.
OLE Equation Editor payload evidence: OLE Equation OLE10Native Payload Anomaly.
The OLE document contains Equation Editor or MTEF object evidence linked to shellcode, downloader URLs, embedded payloads, or exploit-style object layout.
OLE VBA macro behavior: OLE VBA Asc Chr Shift Shell.
The OLE document contains VBA macro evidence for suspicious execution, payload staging, command construction, object abuse, or network retrieval.
OLE VBA macro behavior: OLE VBA Cell Constants WScript.Shell Exec.
The OLE document contains VBA macro evidence for suspicious execution, payload staging, command construction, object abuse, or network retrieval.
OLE VBA macro behavior: OLE VBA Getobject CLSID Dangerous.
The OLE document contains VBA macro evidence for suspicious execution, payload staging, command construction, object abuse, or network retrieval.
OLE VBA macro behavior: OLE VBA Getobject CLSID Evasion.
The OLE document contains VBA macro evidence for suspicious execution, payload staging, command construction, object abuse, or network retrieval.
OLE VBA macro behavior: OLE VBA Reversed DocProp Config.
The OLE document contains VBA macro evidence for suspicious execution, payload staging, command construction, object abuse, or network retrieval.
OLE VBA macro behavior: OLE VBA WMI Process Create.
The OLE document contains VBA macro evidence for suspicious execution, payload staging, command construction, object abuse, or network retrieval.
OLE Excel 4.0 macro evidence: OLE XLM AutoOpen DefinedName.
The OLE workbook contains Excel 4.0 macro structures or recovered cell content associated with auto-execution, downloader behavior, obfuscation, or exploit delivery.
OLE Excel 4.0 macro evidence: OLE XLM Environment Evasion Halt.
The OLE workbook contains Excel 4.0 macro structures or recovered cell content associated with auto-execution, downloader behavior, obfuscation, or exploit delivery.
Stream below the MiniStream cutoff is allocated in the regular FAT, or vice versa.
The CFB spec requires the MiniFAT path for sub-cutoff streams; Office writers always honour it. A mismatch is the kind of structural quirk that distinguishes hand-edited containers from real-world output.
Direntry size field claims more bytes than the FAT-walked sector chain can carry.
Readers that allocate from the size field and copy from the chain read out-of-bounds bytes. A simple structural shape that has appeared in several Office parser memory-corruption bugs.
OOXML package anomaly: OOXML Bogus Custom Part.
The Office package contains unusual relationships, embedded objects, custom parts, encryption, or lure structure associated with malicious OOXML documents.
OOXML package anomaly: OOXML External Rel Free Tld.
The Office package contains unusual relationships, embedded objects, custom parts, encryption, or lure structure associated with malicious OOXML documents.
OOXML VBA project anomaly: OOXML VBA Project Renamed.
The OOXML package contains a VBA project placement, relationship, or raw macro signal that is unusual for benign Office documents and may support payload staging or evasion.
OOXML VBA project anomaly: OOXML VBA XLM Bridge Raw.
The OOXML package contains a VBA project placement, relationship, or raw macro signal that is unusual for benign Office documents and may support payload staging or evasion.
OOXML Excel 4.0 macro evidence: OOXML XLM AutoOpen DefinedName.
The OOXML workbook contains Excel 4.0 macro structures or recovered cell content associated with auto-execution, downloader behavior, obfuscation, or exploit delivery.
OOXML Excel 4.0 macro evidence: OOXML XLM Binary WinAPI Strings.
The OOXML workbook contains Excel 4.0 macro structures or recovered cell content associated with auto-execution, downloader behavior, obfuscation, or exploit delivery.
OOXML Excel 4.0 macro evidence: OOXML XLM Disguised Relationship.
The OOXML workbook contains Excel 4.0 macro structures or recovered cell content associated with auto-execution, downloader behavior, obfuscation, or exploit delivery.
OOXML package anomaly: OOXML XLSB Intl Macrosheet In XLSX.
The Office package contains unusual relationships, embedded objects, custom parts, encryption, or lure structure associated with malicious OOXML documents.
Processing instruction with a target outside the Office allowlist (xml, mso-*).
Some readers dispatch on PI targets; an unexpected target can force a different parsing mode than the renderer.
A single CDATA section exceeds 1 MB.
Real Office output uses CDATA only for short embedded fragments; large CDATA sections are a smuggling shape — they let an attacker hide a binary payload in plain XML where most XML-aware scanners ignore the contents.
Element nesting depth exceeds 256 levels.
Real Office output caps in the dozens. Pathological depth is the structural shape behind several billion-laughs / stack-exhaustion DoS bugs.
Two different Content-Types declared for the same extension or PartName.
Reader divergence — first vs. last definition determines how every part of that extension is parsed.
OOXML altChunk content injection: OOXML altChunk HTML.
The OOXML package uses altChunk content insertion. This can cause Word to load embedded or remote HTML/RTF content and is suspicious when paired with opaque, executable, or auto-updating content.
OOXML altChunk content injection: OOXML altChunk Internal.
The OOXML package uses altChunk content insertion. This can cause Word to load embedded or remote HTML/RTF content and is suspicious when paired with opaque, executable, or auto-updating content.
OOXML altChunk content injection: OOXML altChunk Opaque.
The OOXML package uses altChunk content insertion. This can cause Word to load embedded or remote HTML/RTF content and is suspicious when paired with opaque, executable, or auto-updating content.
OOXML altChunk content injection: OOXML altChunk RTF.
The OOXML package uses altChunk content insertion. This can cause Word to load embedded or remote HTML/RTF content and is suspicious when paired with opaque, executable, or auto-updating content.
OOXML altChunk content injection: OOXML altChunk RTF Autoupdate PE.
The OOXML package uses altChunk content insertion. This can cause Word to load embedded or remote HTML/RTF content and is suspicious when paired with opaque, executable, or auto-updating content.
OOXML altChunk content injection: OOXML altChunk Remote.
The OOXML package uses altChunk content insertion. This can cause Word to load embedded or remote HTML/RTF content and is suspicious when paired with opaque, executable, or auto-updating content.
Document contains a clickable hyperlink to a URL-shortener service.
URL shorteners are legitimate services, but in Office documents they hide the final landing page from static review. A shortener-only call to action is a common spam and phishing pattern, especially when the document has no other active content.
Internal `<Relationship>` Target resolves to a ZIP entry that does not exist in the package.
Some Office paths fail open and fetch a remote alternative; the missing-target shape has been observed in droppers that race the renderer to deliver a payload to that path.
>5% of parts are not reachable by walking from the root .rels through internal relationships.
Hidden-content shape: scanners that only follow the rel graph never see them, but Office may still dispatch to them via name or content-type.
Two `<Relationship>` entries inside the same `.rels` part share an Id.
OPC requires Ids unique within a part. Readers diverge over which definition wins, letting an attacker bind one rel for static analysers and a different one for the live renderer.
OLE container holds an MS-OFFCRYPTO encrypted package (EncryptedPackage + EncryptionInfo streams).
Password-protected Office documents are stored as an OLE compound document containing an EncryptedPackage stream (AES-encrypted inner OOXML) and an EncryptionInfo stream (key-derivation metadata). Encryption defeats most content-based filtering at email gateways; threat actors use it to deliver macro/exploit-carrier spreadsheets and documents that would otherwise be detected by string-based scanners. Legitimate password-protected business documents do occur, but the bulk of phishing-delivered encrypted Office files are malicious — treat as a context-amplifier rather than a verdict on its own.
A whole-document signature's CMS failed verification.
The document's Authenticode/PKCS#7 signature is present but does not cryptographically verify: either the signer's signature over the signed attributes is invalid, or the signed content digest does not match the signature's encapsulated content. The signature was tampered with, forged, or corrupted — a strong tell when paired with payload signals.
Inner `payloadSize` field declares more bytes than remain in the Ole10Native stream.
Readers that allocate from this field and copy without checking are an out-of-bounds-read primitive.
The leading 4-byte length field of an `\x01Ole10Native` stream does not equal the stream byte count.
Parser-divergence shape: readers that trust the field read different bytes than those that walk to end-of-stream.
Binary PowerPoint uses PPT97 CryptoAPI encryption, hiding slide and embedded-object records.
Legacy .ppt/.pps encryption covers the PowerPoint Document, Pictures, and embedded OLE object content rather than placing an OOXML ZIP in the modern EncryptedPackage wrapper. Structural exploit detectors cannot inspect those ciphertext streams without the password. The Analyzer tries a small bounded set of common/default passwords in memory and rescans successfully decrypted Package objects; an unknown password remains an inspection limitation, not proof of a specific CVE.
Document contains an external image relationship targeting an http(s):// URL.
An image relationship with an external http:// or https:// target is fetched by Office when external content is allowed. This can reveal the victim's IP address and timestamp to the attacker's server (tracking beacon). In some Windows Integrated Authentication configurations, the request may also expose NTLM authentication material, but plain HTTP image fetches are not a guaranteed NTLM-leak path. Caveat: documents exported from web-based editors or CMS platforms may include externally-hosted images; verify whether the target URL is a known-legitimate host before escalating.
An Excel externalLinks/ddeLink entry was found.
Excel workbooks can store DDE links in xl/externalLinks/externalLink*.xml rather than in Word field instructions. Benign DDE data links exist, but attackers can set ddeService and ddeTopic to execute a shell command when the link is updated.
File is raw OOXML .rels relationship XML rather than a valid OOXML ZIP package.
OOXML relationship files define external content that Office may load from a package. A standalone .rels file with an Office extension is malformed, but a declared remote-template relationship remains evidence of remote-template-injection tooling or a stripped payload.
VBA project has an untrusted, invalid, or suspicious signature state.
The VBA project carries signature metadata, but the signature is not trusted or does not validate cleanly. This can indicate tampering or an unreliable publisher signal.
A VBA performance-cache (__SRP_*) stream exceeds 8 MB.
Real-world cached compiled modules are tiny; oversize caches are an allocator-stress shape and have been observed in some Office DoS campaigns.
The VBA project's Authenticode signature failed verification.
A signature blob is present but does not cryptographically verify: either the signer's signature over the signed attributes is invalid, or the signed content digest does not match the signature's encapsulated content. This indicates the signature was tampered with, forged, or corrupted — a strong tell when paired with macro payload signals.
Document contains VBA macro code.
VBA macros can automate tasks but are also the most common delivery mechanism for Office-based malware. Macros can download and execute arbitrary code when enabled by the user.
Document contains vbaProject.bin — VBA macros are present.
Same risk as OLE macros. The document can run VBA code when macros are enabled. Check the accompanying VBA keyword findings for details.
Windows Write document evidence: WRI Embedded Exe.
The legacy Windows Write document contains embedded OLE, executable, Equation Editor, wrapper, or header evidence that is unusual for benign documents.
Windows Write document evidence: WRI Embedded OLE.
The legacy Windows Write document contains embedded OLE, executable, Equation Editor, wrapper, or header evidence that is unusual for benign documents.
Windows Write document evidence: WRI Equation Object.
The legacy Windows Write document contains embedded OLE, executable, Equation Editor, wrapper, or header evidence that is unusual for benign documents.
Windows Write document evidence: WRI Header Invalid.
The legacy Windows Write document contains embedded OLE, executable, Equation Editor, wrapper, or header evidence that is unusual for benign documents.
Windows Write document evidence: WRI OLE Package.
The legacy Windows Write document contains embedded OLE, executable, Equation Editor, wrapper, or header evidence that is unusual for benign documents.
Windows Write document evidence: WRI OLE Wrapped.
The legacy Windows Write document contains embedded OLE, executable, Equation Editor, wrapper, or header evidence that is unusual for benign documents.
xl/connections.xml defines a data connection whose source is a remote http(s) URL or UNC path.
A workbook data connection reads its data source from a remote http(s) URL or UNC path. Remote data connections can stage a next-stage payload or exfiltrate data when the connection refreshes.
Macro with AutoExec trigger found.
AutoExec runs when Word itself starts, from the global template. It needs no document to be opened at all, so a macro that reaches Normal.dot with an AutoExec entry point executes on every launch. Rated LOW because it is a capability/context marker, not evidence of malice: it says the macro runs without the user pressing anything. Benign templates use these triggers legitimately, so a real dropper still convicts on its Shell/download/LOLBin signal — this trigger is never the sole malicious signal.
Macro with AutoNew trigger found.
AutoNew runs automatically when a NEW document is created from a Word template. Template-infecting macro viruses spread through it: the virus writes itself into Normal.dot, and every document created afterwards is infected on creation. Rated LOW because it is a capability/context marker, not evidence of malice: it says the macro runs without the user pressing anything. Benign templates use these triggers legitimately, so a real dropper still convicts on its Shell/download/LOLBin signal — this trigger is never the sole malicious signal.
Macro with AutoOpen trigger found.
AutoOpen runs automatically when a Word document is opened. This is a capability/context marker — it tells you the macro runs without further interaction — not evidence of malice on its own; legitimate macro documents use it routinely. Rated low: a malicious document still convicts via its actual payload signal (Shell/download/LOLBin), so the auto-exec trigger is a corroborating context cue, not a standalone flag.
Macro with Auto_Close trigger found.
Auto_Close runs automatically when an Office document closes. Close-time execution can delay activity past a sandbox, but the trigger itself is a capability/context marker, not standalone evidence of malice; the payload signal is what convicts.
Macro with Auto_Open trigger found.
Auto_Open is the legacy Excel auto-execute macro. Like AutoOpen in Word, it runs code automatically when the file is opened — a capability/context marker, not standalone evidence of malice.
Document drawing contains a call-to-action phrase in a shape or text box.
Shapes with phrases like 'Click Here to Enable Content', 'Download Now', or 'Open Document' are the Office equivalent of the PDF fake-button overlay, tricking users into enabling macros or following a malicious link. Caveat: these phrases appear legitimately in user manuals, training materials, onboarding documents, and any instructional content that guides users through a process. This finding is low-signal; elevate concern only when combined with macros, external relationships, or hidden sheets.
A DDE field instruction was found in the document XML. The command does not reference a known-dangerous executable.
DDE (Dynamic Data Exchange) fields link a document to an external data source or application. Benign uses include pulling live data from Excel spreadsheets or databases. However, DDE can be abused to execute arbitrary commands. This particular field does not appear to launch a dangerous program, but you should review the detail to confirm.
Macro with Document_Close trigger found.
Document_Close runs when the document is closed. Macro viruses use it to write themselves into the global template on the way out, after the user has finished reading and is least likely to notice. Rated LOW because it is a capability/context marker, not evidence of malice: it says the macro runs without the user pressing anything. Benign templates use these triggers legitimately, so a real dropper still convicts on its Shell/download/LOLBin signal — this trigger is never the sole malicious signal.
Macro with Document_New trigger found.
Document_New is the ThisDocument event that runs when a new document is created from a template. It is the modern equivalent of AutoNew and is used by the same template-infecting macro-virus families. Rated LOW because it is a capability/context marker, not evidence of malice: it says the macro runs without the user pressing anything. Benign templates use these triggers legitimately, so a real dropper still convicts on its Shell/download/LOLBin signal — this trigger is never the sole malicious signal.
Macro with Document_Open event handler found.
Document_Open is the modern equivalent of AutoOpen — it fires when the document opens. A capability/context marker, not standalone evidence of malice; the payload signal is what convicts.
VBA macro uses Environ() to access environment variables.
Environ() is used widely in legitimate macros for locale paths and user temp directories. It does appear in droppers (to find %TEMP% / %APPDATA% for staging payloads) but on its own is too noisy to be more than LOW.
Equation Editor OLE CLSID found in the document.
The Microsoft Equation Editor component had critical vulnerabilities, but ordinary documents can also contain benign equation objects. This broad CLSID finding is only a low-severity parser-surface indicator; CVE-level confidence comes from the separate malformed MTEF, native stream, or command-payload Equation Editor rules.
Document contains one or more external hyperlinks.
Word stores every clickable URL as an external relationship. The detector summarises the count and surfaces the first target so the analyst can review without each hyperlink being scored separately.
Excel workbook contains hidden or veryHidden worksheets.
Hidden and 'veryHidden' Excel sheets are commonly used to conceal macro scaffolding, staging data, or intermediate payload construction from the user. Caveat: hidden sheets are routine in legitimate professional Excel workbooks — financial models hide calculation sheets and lookup tables, enterprise templates hide configuration sheets, and many vendor-supplied spreadsheets protect their formulas this way. This finding is low-signal on its own; treat as significant only when combined with VBA macros or external relationships.
OOXML ZIP central directory is invalid, but local headers expose Office parts.
Office and tolerant ZIP readers may recover document parts from local file headers even when the central directory is malformed or missing. This is a parser-divergence shape; it is low-signal by itself, but important when the recoverable local parts include VBA projects, ActiveX controls, or XLM macro sheets.
Multiple direntries share a non-null, unrecognised CLSID (>= 4 occurrences).
Office host CLSIDs (Excel, Word, PowerPoint, Equation Editor, MathType, Visio) legitimately repeat. Heavy duplication of a less-common CLSID is the shape used by containers trying to hide extra invocation points of the same parser surface from scanners that only inspect the first match.
Package's tempPath references an `AppData\` or `Temp\` folder of the author's machine.
Weak signal on its own — legitimate drag-and-drop attachments produce this — but a useful axis contributor when paired with other anomalies.
Macro with Workbook_Open event handler found.
Workbook_Open runs automatically when an Excel workbook opens. It is near-universal in legitimate macro-enabled business spreadsheets, so it is a capability/context marker rather than evidence of malice. Rated low: a malicious workbook still convicts via its actual payload (Shell/download/LOLBin); the auto-exec trigger alone does not.
A reachable VBA project contains repeated AVP replacement comments and no substantive behavior.
Antivirus disinfection can leave module names and auto-exec procedure shells behind after replacing their bodies with 'Deleted by AVP' comments. This is forensic evidence of a historical infection, not proof that executable malware remains.
An Excel cell formula contains an embedded http(s)/ftp URL.
A cell formula (=HYPERLINK or a remote reference) carries an embedded URL. Surfaced for IOC visibility; benign workbooks also use HYPERLINK, so on its own this is informational.
The macro carries risky capabilities but nothing indicates they are used maliciously; the verdict is capped below malicious.
Capability findings (auto-execution, Shell/WScript, CreateObject) describe what a macro CAN do, not what it does. A legitimate macro-based desktop application — a tax-filing workbook, an engineering calculator, a business form — trips every one of them. When a document shows no URL or IOC, no encoded or obfuscated payload, no dropper or exploit evidence and no antivirus detection, capability alone cannot justify a malicious verdict, so the score is capped into the suspicious band. Any corroborating signal removes the cap.
OLE file bytes greatly exceed the sum of declared stream sizes.
Well-formed Office binary documents pack data into named streams with little slack. When the file is dramatically larger than its declared streams (>40% slack and >16 KB of unaccounted bytes), the extra bytes live in unallocated sectors. Pre-macro-era Word/Excel exploits (e.g. CVE-2010-3333, CVE-2014-1761, CVE-2015-2424) commonly hide XOR-encoded shellcode in this region, reached via a parser pointer-corruption bug in the document structure. The finding is a structural triage signal, not malicious evidence on its own, and carries no verdict score.
The document/package carries a whole-document digital signature.
Office can seal a whole document — distinct from a VBA-project signature — via an OOXML XML-DSig part (_xmlsignatures/sig*.xml) or a legacy-OLE \x05DigitalSignature PKCS#7 stream. The signer certificate, issuer and validity are shown for context. Presence of a signature is NOT by itself a benign indicator and does not affect the risk score. Legacy-OLE signatures are cryptographically self-consistency checked; OOXML XML-DSig is surfaced for identity but its signature value is not recomputed (no XML canonicalization in the sandbox), so it shows as 'unverified' rather than risking a false 'invalid'.
The document signing certificate is self-signed (issuer == subject).
The document is sealed with a self-signed certificate that no certificate authority vouches for. Unlike self-signed VBA macro signing (a real attacker trick to clear the macro trust bar), self-signed document sealing is a mainstream-legitimate integrity pattern, so this is informational context (the signature box's 'Self-signed' status) and does not affect the risk score; tampering surfaces as OFFICE_DOC_SIGNATURE_INVALID instead.
Unreachable OLE sectors contain repeated AVP-disinfection remnants from a deleted macro project.
The active OLE directory does not expose a Macros storage, but unlinked sectors retain 'Deleted by AVP' text. Word does not load orphaned streams, so this records historical infection without treating the current file as executable malware.
A workbook drawing object is bound to an Office Script sharing link.
Excel can associate a shape with an Office Script stored in OneDrive or SharePoint. The scanner decodes the embedded ms-officescript sharing identifier and surfaces both the original resource URI and its HTTPS destination without fetching or executing the remote script. This is useful provenance, but legitimate business automation commonly uses Office Scripts, so the finding has no verdict weight by itself.
An OOXML image contains a QR code resolving to an HTTP(S) URL.
A QR URL without a corroborating lure is surfaced for analysis but does not itself assert malicious intent.
olevba could not extract VBA macros from the document; VBA source extraction was skipped.
olevba (and its olefile dependency) ran into a parse failure on this specific file — common causes include legacy formats (Excel 4/5 BIFF), encrypted streams, hand-crafted/malformed OLE compound storage, or anti-analysis structures that trip the parser. Format-agnostic byte-level scans still ran, so the verdict is real and re-scanning the same bytes will yield the same outcome — unlike SCAN_INCOMPLETE, this finding does not flag the result as needing retry.
VBA project is signed by a trusted or valid certificate.
The VBA project has a valid or trusted signature signal. This is primarily a context signal used to reduce false positives when other macro evidence is weak.
VBA macro edits its own VBA project code, with no external template or workbook target.
The macro edits VBA project code through the VBE object model (CodeModule/VBComponents with InsertLines, DeleteLines or AddFromString), but every write targets the running document itself — no global template (Normal.dot), startup folder or other open workbook is referenced. That is self-modification rather than the self-replication of the W97M macro-virus family, and it is the shape of template-migration and code-generation tooling that round-trips sheet code through an external file. Shown for visibility only: it carries no score on its own, and it also requires 'Trust access to the VBA project object model', which is disabled by default.
The VBA macro project carries an Authenticode digital signature.
Office can digitally sign a VBA project so it runs under a 'signed macros only' trust setting. The signer certificate, issuer and the signature's cryptographic validity are shown for context. Presence of a signature is NOT by itself a benign indicator — VBA stomping and signature-stripping mean a signed project can still be hostile — so this finding is informational and does not affect the risk score. It distinguishes the VBA-project signature from a whole-document signature, which is a separate feature.
The VBA project signing certificate is self-signed (issuer == subject).
The macro project is signed, but with a self-signed certificate that no certificate authority vouches for. Self-signed VBA signing is the common trick to make a project appear signed/trusted without a real publisher identity. A context cue, not a conviction on its own.
Windows Write document evidence: WRI Legacy Format.
The legacy Windows Write document contains embedded OLE, executable, Equation Editor, wrapper, or header evidence that is unusual for benign documents.
RTF
23
Equation Editor OLE CLSID (0002CE02) found in RTF hex data.
This CLSID instantiates the vulnerable Equation Editor component. CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798 are among the most exploited Office vulnerabilities in history, and RTF is the most common delivery format.
Object class name references Equation Editor.
The explicit mention of the Equation Editor class confirms the document is attempting to instantiate the vulnerable component.
MZ header (hex '4D5A') found in RTF hex data.
The presence of a Windows PE executable header (MZ) inside hex-encoded RTF data means an executable is embedded in the document. This is consistent with an embedded dropper payload.
An RTF DDEAUTO field launches cmd and regsvr32 with scrobj.dll.
DDEAUTO launches cmd, which invokes regsvr32 with a remote URL and scrobj.dll. These elements form a complete remote scriptlet execution chain; a generic DDE link does not match.
Visible RTF text contains a base64/gzip shell loader executed with zsh.
The RTF body is not exploiting the RTF parser. Instead, it carries a visible shell command or embedded shell script that decodes a URL or gzip-compressed stage and executes it with zsh. The decoded stage is treated as malware when it retrieves and executes AppleScript via osascript, posts host/locale telemetry, or uses geofencing logic.
An RTF Package or Word OLE object is paired with objautlink/objupdate activation.
This is embedded-package delivery behavior, distinct from CVE-2017-0199 and Equation Editor CVEs unless their specific triggers are independently proven.
RTF contains \objautlink — an automatically linked OLE object marker.
The \objautlink control word marks an OLE object as an automatic link. In malicious RTFs this is a useful activation/update surface, especially when paired with \objdata and \objupdate. Legitimate use is uncommon in modern document exchange.
RTF document uses INCLUDETEXT or INCLUDEPICTURE with an http:// or https:// URL.
RTF \fldinst blocks with INCLUDETEXT or INCLUDEPICTURE and a remote (http:// or https://) target can cause Word to fetch the remote resource when the document is opened, depending on Office version and external-content settings. This is a remote template injection vector: the attacker controls what content is fetched, can steal NTLM credentials via a UNC redirect, or deliver a second-stage payload. Caveat: legitimate RTF documents very rarely include remote http:// field references; this construction has almost no benign use in consumer-produced documents, making the false-positive rate low.
RTF contains large blocks of hex-encoded data.
Legitimate RTF files rarely contain very large hex blocks. Excessive hex data usually hides an embedded payload (executable, shellcode, or exploit object) encoded in hexadecimal.
OLE Package CLSID pattern found alongside object data.
The Package CLSID combined with embedded OLE data suggests the document wraps an arbitrary file (potentially an executable) inside an OLE Package object.
Many RTF control words appear fragmented or obfuscated.
RTF parsers are tolerant of whitespace in control words. Malware authors insert spaces to break up keywords (like 'o b j d a t a') so that simple string scanners miss them.
RTF text contains PHP IRC bot source code.
The detector looks for a compound source-code pattern: PHP markers, socket connection calls, IRC protocol commands such as JOIN or PRIVMSG, and bot-control strings. The RTF is not necessarily an Office exploit, but it is carrying operational malware source code and should not be treated as a clean document.
OLE Package object found in RTF.
OLE Package objects can wrap arbitrary files (including executables) inside a document. The packaged file can be extracted and run when the user double-clicks the object.
The RTF's \*\template destination is a remote URL/UNC path that Word fetches and loads on open.
RTF template injection (MITRE T1221): the document attaches a remote template via {\*\template <url>}. On open, Word retrieves and loads it, which can deliver a macro/exploit template, a scriptlet/HTA (.html/.hta target), or leak NTLM credentials over a UNC path. Benign RTFs attach only a local template, so a remote target is the injection itself. Obfuscated targets (\uN/\'xx escapes), raw-IP or dynamic-DNS hosts, and active/script extensions escalate it to critical.
RTF contains public exploit-builder placeholders around a Flash ActiveX object.
Markers such as swf_random, b64_payload, platform_id and security-research vendor strings identify an uninstantiated lab or toolkit template. It is security-relevant but does not by itself prove exploitation of a specific CVE.
RTF declares an auto-activating OLE object (\objupdate) but stores its payload as a large loose hex region outside any \objdata destination.
The document combines \objupdate (which forces Word to instantiate the embedded OLE object on open, with no user interaction) and a bare \object declaration that carries NO \objdata destination. The object's payload is instead dumped as a multi-hundred-kilobyte hex-encoded region in the raw document body. This split placement hides the payload from parsers that only decode \objdata blobs, while Word still activates the object. The shape is structurally exclusive to weaponised documents; across the corpus this combination is ~99% malicious, and the detector specifically covers the variant whose payload is opaque/encrypted and therefore leaves no decodable OLE, Equation Editor, or PE fingerprint for the signature-attributed rules.
RTF contains \objupdate — forces automatic OLE object activation.
The \objupdate control word forces Word to immediately instantiate the embedded OLE object when the document is opened, without requiring the user to double-click or interact with the object. This is a near-universal indicator of Equation Editor exploit documents — it ensures the vulnerable EQNEDT32.EXE process is spawned automatically. Legitimate use of \objupdate is extremely rare.
RTF contains \pFragments without the oversized value needed for CVE-2010-3333.
The \pFragments control word is the parser surface abused by CVE-2010-3333, but this finding does not include the oversized numeric argument used by the public stack-overflow trigger.
RTF contains \objemb — an embedded OLE object marker.
The \objemb control word marks an embedded OLE object. Combined with \objdata, it indicates an object is fully embedded in the RTF.
RTF contains a hidden Word compatibility or frame relationship package.
DrsE2oDoc/downRevStg drawing compatibility parts and embedded frame relationships are useful exploit-surface context, but occur in documents that predate CVE-2026-21514 and are not its trust-bypass primitive. The scanner therefore reports the structure without assigning a CVE.
RTF contains \objdata sections with embedded OLE objects.
RTF documents can embed OLE objects via \objdata sections. These objects can carry executables, scripts, or trigger exploits in OLE-handling code.
RTF embedded OLE object contains an OlePres presentation stream marker.
OlePres is an OLE presentation stream name. It is relevant to the CVE-2025-21298 attack surface, but the stream name alone is common in embedded OLE objects and does not prove malformed OlePres internals.
RTF embedded object evidence: RTF OLE10Native Stream.
The RTF contains embedded OLE or native object content that may carry an executable payload, exploit object, or secondary document.
HWP
19
PE executable found inside HWP document.
A Windows executable hidden inside an HWP document is a clear indicator of malware. The document is carrying an executable payload.
The HWP's packaged PE invokes mshta with a remote URL.
The packaged executable invokes mshta with a remote URL. This command causes mshta to retrieve and execute the referenced HTA or script content.
An HWP BinData OLE Package carries a valid Windows executable under an executable filename.
OLE Package objects can extract and launch packaged files after user activation. Executable package types such as SCR or EXE are highly abnormal in HWP documents and are a common click-to-execute delivery mechanism.
The HWP body links a temporary-path executable to an embedded OLE Package carrying the same filename.
The correlation connects the visible embedded-object control to the executable that HWP extracts when activated, distinguishing weaponized package delivery from an unrelated binary string.
PostScript 'exec' operator found in embedded PostScript.
The PostScript 'exec' operator executes a string as PostScript code. In malicious PostScript it can run dynamically decoded payloads.
PostScript hex string converted to executable code and executed at runtime.
The pattern '<HEX...> cvx exec' decodes a PostScript token from a hex literal and executes it. APT-grade HWP exploits use this to stage payloads in pieces — every fragment is reconstructed at parse time so static scanners that only look for plain 'exec' tokens never see the dangerous operator string in the file. Repeated reconstruction of execution operators identifies the embedded EPS as exploit code rather than ordinary vector data.
PostScript 'system' operator found.
Some PostScript interpreters expose a 'system' operator or equivalent extension that can run operating-system commands. Its presence in embedded PostScript is high-risk and unusual in ordinary documents.
Reference to a shell command (cmd.exe, powershell, etc.) in HWP.
Direct references to system shells inside a document can indicate an attempt to execute commands on the recipient's system.
HWP document contains embedded PostScript or EPS content.
Embedded PostScript/EPS is a common exploit surface in targeted HWP campaigns. PostScript is a full programming language; file and command execution depends on the interpreter and sandbox configuration.
Many hex escape sequences found in PostScript content.
A high number of hex escape sequences (\xNN) in PostScript suggests the presence of encoded shellcode or binary payloads.
JavaScript references found in HWP document.
JavaScript in an HWP document is unusual and potentially dangerous. It may indicate an attempt to exploit the document viewer.
PostScript file operation (file/run/deletefile) found.
File operations in PostScript allow reading, writing, or deleting files on the system — capabilities that exploits use to drop payloads.
External URL(s) found in HWP document content.
URLs in HWP content may be used to download second-stage payloads or connect to command-and-control servers.
PostScript decode filter (SubFileDecode, ASCIIHexDecode, etc.) found.
Decode filters in PostScript can be used to hide encoded payloads that are decoded at runtime.
OLE-based HWP contains a Scripts storage section.
A Scripts section in an HWP OLE container may contain executable code that runs when the document is opened.
OLE-based HWP contains a BinData storage section.
BinData stores binary objects (images, OLE objects). While normal, it can also contain malicious embedded objects.
Zlib-compressed sections were found and decompressed for analysis.
HWP 5.0+ files store sections compressed with zlib. Decompressing them allows scanning for embedded threats. This is informational.
Stable digest of decompressed HWP logical stream names and content.
OLE sector allocation and slack can change the outer file hash without changing the document. This fingerprint clusters files whose logical HWP streams are identical.
A payload-bearing stream did not inflate as raw DEFLATE and was scanned in its original form.
HWP's document-level compressed flag does not guarantee every BinData stream is compressed; images may remain raw. This coverage note distinguishes a safe raw-byte fallback from a skipped stream.
CVE
105
Acrobat prototype-pollution PoC/exploit pattern — CVE-2026-34621 related
critical
CVE likely
CVE_2026_34621_RELATED
PDF JavaScript combines Acrobat prototype pollution targeting privileged state with an execution or sensitive file-read primitive.
This finding applies to CVE-2026-34621 PoC and exploit variants that do not carry the exact internal Adobe API markers used by the stricter CVE_2026_34621 rule. It requires a high-signal combination: prototype pollution of privileged state such as __trusted, constructor.prototype.bypass, or __proto__.privileged, plus concrete impact behavior such as app.launchURL(file/cmd/osascript), ActiveXObject('WScript.Shell'), or util.readFileIntoStream(cDIPath). That co-occurrence is not expected in benign PDF forms and keeps the match cheap by using bounded literal and regex checks over raw, decompressed, and bounded base64-decoded JavaScript.
Embedded TrueType font has malformed EBLC/EBDT bitmap-glyph placement plus the EBSC max-range table trap.
CVE-2023-26369 is an out-of-bounds write in Adobe Acrobat Reader's libCoolType sfac_GetSbitBitmap path. Project Zero documented a font whose EBLC/EBDT compound bitmap glyph metadata places a component beyond the bitmap buffer computed from the glyph metrics, and whose EBSC table record declares offset and length as 0xffffffff to avoid loading in many non-Adobe font parsers. The detector parses the embedded sfnt directory and bitmap tables and fires only when both structural conditions are present.
PDF JavaScript uses Acrobat internal share/login APIs, swConn prototype manipulation, and privileged RSS/file-read APIs.
CVE-2026-34621 is an Adobe Acrobat/Reader JavaScript exploit chain reported in actively exploited malicious PDFs. Public analyses describe abuse of internal APIs such as ANFancyAlertImpl, ANShareFile, and SilentDocCenterLogin, prototype/getter manipulation around swConn, and privileged APIs such as RSS.addFeed/removeFeed or util.readFileIntoStream to fingerprint the victim and retrieve staged JavaScript. The scanner matches that combined marker set, including when the JavaScript is hidden inside a long base64 AcroForm value.
Adobe Flash authplay SWF exploit in PDF — CVE-2010-1297
critical
CVE likely
CVE_2010_1297_FLASH_RICHMEDIA
PDF combines RichMedia Flash activation, a crafted SWF with authplay-era markers, and shellcode heap-spray staging.
CVE-2010-1297 is an Adobe Flash/authplay.dll memory-corruption vulnerability exploited in the wild through malicious PDFs containing crafted SWF content plus encoded heap-spray stages. The detector requires RichMedia Flash activation, an embedded or recovered inner SWF with ActionScript prototype/AVM-era markers or AES-PHP/authplay variant markers seen in the 2010 exploit family, and shellcode staging either in the PDF or inside a bounded AS3 ByteArray/loadBytes unpacker. Ordinary RichMedia Flash documents and SWFs without the heap-spray stage are not attributed to the CVE.
Recovered SWF matches the public SWF9 DoABC CVE-2010-1297 newfunction trigger.
The detector requires a SWF9 DoABC object of the reference size together with all five AESFlashToPHPDemo constants shared by the public in-the-wild and Exploit-DB exploit files. Ordinary AES or Loader content does not satisfy the full fingerprint.
Recovered SWF matches the canonical SWF10 AVM1 CVE-2011-0611 trigger.
The detector requires the canonical compact SWF10 tag topology and its complete obfuscated SharedObject/Date prototype and text/font API surface. Pointer and identifier patching are permitted; generic Flash loaders and heap sprays do not match.
Adobe Flash/authplay SWF exploit in PDF — CVE-2009-1862
critical
CVE likely
CVE_2009_1862_FLASH_RICHMEDIA
PDF combines RichMedia Flash activation with a crafted Run_Sploit/HeapSpray SWF or compact AS3 SWF plus PDF-side encoded shellcode.
CVE-2009-1862 is the July 2009 Adobe Flash Player and Adobe Reader/Acrobat authplay.dll vulnerability exploited through crafted SWF content, including SWFs embedded in PDFs. The detector requires RichMedia Flash activation plus an embedded SWF with Run_Sploit, HeapSpray, ByteArray, and spray-marker content, or the compact DoABC/SymbolClass AS3 shape paired with PDF-side encoded shellcode staging, associated with the 2009 authplay exploit shape.
PDF embeds a TrueType/OpenType SING font table together with JavaScript heap-spray shellcode.
CVE-2010-2883 is the Adobe Reader/Acrobat CoolType SING table stack overflow exploited in weaponised PDFs. The rule requires an actual SING table in a decoded sfnt font stream plus heap-spray JavaScript, which keeps it narrower than a plain string match for the word SING.
PDF has an overlong trailer /ID and JavaScript dereferences this.docID.
CVE-2018-4901 is an Adobe Acrobat Reader DC stack buffer overflow in Document ID handling. The Talos-described trigger requires an overly large trailer /ID value and JavaScript access to `this.docID`, which causes Reader to re-encode the ID through the vulnerable EScript path.
Adobe Reader FlateDecode predictor integer overflow — CVE-2009-3459
critical
CVE exact
CVE_2009_3459
PDF /DecodeParms predictor parameters force an integer overflow in the per-row buffer size.
CVE-2009-3459 is a heap-based buffer overflow in Adobe Reader / Acrobat before 9.2 / 8.1.7 / 7.1.4 (APSB09-15), exploited in the wild in October 2009. A /DecodeParms predictor (TIFF Predictor 2 or PNG predictors 10-15) makes the reader size a per-row buffer from /Columns * /Colors * /BitsPerComponent; an attacker sets an absurd scalar (e.g. /Colors 1073741838) so that product overflows a 32-bit allocation and the inflated stream overruns it. Legitimate predictor params are tiny (Colors is bounded by the colour model, BitsPerComponent is one of 1/2/4/8/16). The oversized scalar validates the integer-overflow primitive used by CVE-2009-3459 and matches the Metasploit adobe_flatedecode_predictor02 implementation.
Adobe Reader JPEG2000 JPX command payload exploit — CVE-2018-4990
critical
CVE likely
CVE_2018_4990_JPX_EMBEDDED_CMD
PDF embeds a malformed JPX/JPEG2000 image whose JP2 header area contains a command-execution/download payload.
CVE-2018-4990 is an Adobe Acrobat/Reader JPEG2000 parser memory-corruption vulnerability. The detector requires a /JPXDecode stream, malformed JP2 box structure, and a command/download payload embedded inside the JPEG2000 stream body. Plain JPEG2000 images, and malformed JPX images without an execution/download payload, remain covered only by related JPX anomaly rules.
Adobe Reader JPX cmap overflow trigger — CVE-2018-4990
critical
CVE exact
CVE_2018_4990_JPX_CMAP_TRIGGER
PDF embeds the in-the-wild malformed JPEG2000 cmap construction used to trigger CVE-2018-4990.
The detector validates the known exploit's JP2 signature, exact jp2h/cmap and ihdr geometry, malformed box extent, and long 0xff overflow tail. It does not label generic JPX images or generic malformed JPEG2000 as CVE-2018-4990.
PDF uses /Launch with shell parameters and an embedded/exported payload chain.
CVE-2010-1240 is the Adobe Reader/Acrobat Launch File warning dialog abuse used by malicious PDFs to drop or rename an embedded payload and then start it through a /Launch /Win action. The detector requires a Launch action with command-shell parameters plus embedded-file/export evidence such as exportDataObject/nLaunch:0 or an EmbeddedFiles/EF payload chain.
PDF contains XFA JavaScript that heap-sprays shellcode, builds a TIFF image payload, and assigns it to an XFA image rawValue.
CVE-2010-0188 was widely exploited through XFA JavaScript that generated a malformed TIFF image and assigned it to an image field, causing Adobe Reader/Acrobat to parse the crafted TIFF through the vulnerable LibTIFF path. The rule decodes the common long-hex XFA wrapper and requires the TIFF payload marker, rawValue trigger, and heap-spray/version-selection logic, including split-string character-table wrappers seen in older kits. The finding matches the exploit template and does not claim structural validation of the embedded TIFF.
PDF JavaScript reaches Android Java reflection through the Reader Mobile JavaScript bridge, obtains java.lang.Runtime, and loads an Android native/stage payload.
CVE-2014-0514 is an Adobe Reader Mobile for Android JavaScript API restriction bypass that allows crafted PDFs to execute arbitrary code. Exploit PDFs use Java reflection exposed through the Android JavaScript bridge to call java.lang.Runtime, write payload files under /data/data, chmod them, and load a native/Dalvik stage such as an Android Meterpreter payload.
PDF JavaScript removes an app.addToolButton object from its cEnable callback and carries heap-spray shellcode.
CVE-2013-3346 is an Adobe Reader/Acrobat ToolButton use-after-free. Exploitation re-enters button handling through cEnable, removes the ToolButton while Reader still uses it, and reclaims the freed allocation with heap-groomed shellcode or ROP data.
PDF contains the XFA choiceList/oneOfChild trigger shape associated with CVE-2013-0640.
CVE-2013-0640 is an Adobe Reader/Acrobat XFA memory-corruption vulnerability exploited in the wild in 2013. The rule requires the specific JavaScript/XFA sequence described in public technical analysis: resolve a choiceList, mutate a draw object's keep.previous property to contentArea, and reattach the choiceList through the UI node's oneOfChild property via a timer. Requiring all of these elements avoids flagging ordinary XFA forms that merely contain choice lists or resolveNode() form logic.
Adobe Reader authplay SWF exploit in PDF — CVE-2010-3654
critical
CVE likely
CVE_2010_3654_FLASH_RICHMEDIA
PDF combines RichMedia Flash activation, AS3 DoABC/SymbolClass SWF code, and PDF-side shellcode heap-spray staging.
CVE-2010-3654 affects Adobe Reader/Acrobat authplay Flash handling when crafted SWF content is embedded in a PDF. This detector requires all three parts of the submitted exploit shape: RichMedia Flash activation, an ActionScript 3 SWF with DoABC/SymbolClass and URLRequest or StagePlayer/ByteArray/loadBytes code, and PDF-side heap-spray or shellcode stage evidence. Those gates avoid labelling ordinary RichMedia Flash documents.
Adobe Reader mailto URI command execution — CVE-2007-5020
critical
CVE likely
CVE_2007_5020_MAILTO_MSHTA
PDF contains a crafted mailto URI that reaches mshta via path traversal and executes inline script.
CVE-2007-5020 is the Adobe Reader/Acrobat 8.1 mailto URI command-execution issue described by Adobe APSA07-04. The rule requires a mailto URI with traversal or the historical percent-slash shape, an mshta target, and inline JavaScript/WScript.Shell execution markers. Normal mailto links and generic suspicious command paths remain covered only by the lower-confidence URI rule.
PDF matches a CVE-2014-0496-specific Adobe Reader use-after-free primitive.
CVE-2014-0496 is a separate Adobe Reader/Acrobat use-after-free affecting later 10.x and 11.x builds. A generic ToolButton API conjunction is not sufficient for this attribution; a rule emitting this identifier must establish a CVE-2014-0496-specific primitive.
HTML or PDF-embedded HTML configures C6 Messenger DownloaderActiveX to download and run a file.
CVE-2008-2551 affects the Icona/C6 Messenger DownloaderActiveX control. The rule requires the vulnerable control identity (DownloaderActiveX or CLSID c1b7e532-3ecb-4e9e-bb3a-2951ffe67c61), propDownloadUrl, and propPostDownloadAction=run. This avoids flagging generic ActiveX content.
OOXML external OLEObject relationship targets HTML/CAB/MSHTML-style content.
The scanner parses .rels entries with TargetMode="External" and assigns this CVE only when the relationship has the stricter OLEObject gadget shape associated with CVE-2021-40444. Broader MSHTML/CAB/MHTML external targets are reported separately as OFFICE_MSHTML_EXTERNAL_OBJECT.
Static evidence associated with CVE-2006-4694.
The file contains structural or payload evidence associated with CVE-2006-4694. When this is marked as related rather than exact, the finding should be treated as CVE-family evidence rather than a fully confirmed exploit.
Static evidence associated with CVE-2008-0118.
The file contains structural or payload evidence associated with CVE-2008-0118. When this is marked as related rather than exact, the finding should be treated as CVE-family evidence rather than a fully confirmed exploit.
Static evidence associated with CVE-2009-0658.
The file contains structural or payload evidence associated with CVE-2009-0658. When this is marked as related rather than exact, the finding should be treated as CVE-family evidence rather than a fully confirmed exploit.
Static evidence associated with CVE-2009-3953.
The file contains structural or payload evidence associated with CVE-2009-3953. When this is marked as related rather than exact, the finding should be treated as CVE-family evidence rather than a fully confirmed exploit.
Static evidence associated with CVE-2010-1797.
The file contains structural or payload evidence associated with CVE-2010-1797. When this is marked as related rather than exact, the finding should be treated as CVE-family evidence rather than a fully confirmed exploit.
Static evidence associated with CVE-2010-2883-SHELLCODE-STAGE.
The file contains structural or payload evidence associated with CVE-2010-2883-SHELLCODE-STAGE. When this is marked as related rather than exact, the finding should be treated as CVE-family evidence rather than a fully confirmed exploit.
Static evidence associated with CVE-2011-2462.
The file contains structural or payload evidence associated with CVE-2011-2462. When this is marked as related rather than exact, the finding should be treated as CVE-family evidence rather than a fully confirmed exploit.
CVE-2010-1297 — Adobe Flash/Reader authplay heap-spray (Flash-in-PDF)
critical
CVE likely
CVE_2010_1297
PDF embeds a Flash SWF (RichMedia) and its de-obfuscated JavaScript heap-sprays to groom memory for the Flash exploit.
CVE-2010-1297 is an Adobe Flash / authplay.dll memory-corruption vulnerability exploited through PDFs that embed a crafted SWF and use JavaScript to heap-spray the process before the Flash object loads. The detector reports when an embedded Flash SWF co-occurs with a JavaScript heap-spray recovered after de-obfuscating the evasions these kits use — space-padded %u tokens, split unescape, and fromCharCode/\u spray builders inside a grooming loop — which defeat the raw %u0c0c/%u9090 heap-spray rules. Benign interactive Flash PDFs (sound players, text widgets) carry no spray and are not attributed.
Word DDE field downloads and executes the observed CVE-2017-0262 second-stage URL.
The finding is not an exact exploit-body detector. The local DOCX contains a DDE PowerShell chain that downloads the observed sendmevideo.org/dh2025e/eee.txt stage and executes it with powershell -enc, but it does not contain the EPS/object memory-corruption bytes locally. The CVE label is therefore reported as related campaign-stage evidence.
PDF JavaScript calls Collab.collectEmailInfo() with a long or heap-sprayed message argument.
CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument to the Collab.collectEmailInfo() JavaScript API. This was one of the earliest widely-exploited PDF JavaScript vulnerabilities. The rule requires either Collab.collectEmailInfo() with a quoted string at least 128 bytes long, or the decoded exploit-kit shape where JavaScript builds a %u0c0c heap spray and passes that sprayed string through the msg field of Collab.collectEmailInfo(). It also catches older variants that decode shellcode with unescape(), assemble a large version-dependent buffer, and pass that variable through msg, including annotation-/Subject staged payloads that are recovered before CVE matching. Plain short calls are not flagged. CISA KEV.
PDF JavaScript calls Collab.getIcon() with a long string argument.
CVE-2009-0927 (CVSS 9.3) is a stack-based buffer overflow in Adobe Reader triggered by the Collab.getIcon() JavaScript API with a crafted string argument. The overflow allows arbitrary code execution. The rule requires Collab.getIcon() with a quoted string at least 64 bytes long; plain short calls are not flagged. CISA KEV.
OLE data contains the Composite Moniker CLSID with nearby scriptlet payload evidence.
CVE-2017-8570 abuses Composite Moniker handling to load scriptlet content. The CVE rule now requires the Composite Moniker CLSID plus nearby SCT/scriptlet/scrobj-style payload evidence. Bare Composite Moniker evidence is reported as RTF_COMPOSITE_MONIKER_RELATED instead.
PDF JavaScript invokes Doc.printSeps() with exploit-shaped arguments.
CVE-2010-4091 is a memory corruption vulnerability triggered by a crafted argument to Doc.printSeps(). The rule matches long quoted strings, large hex constants such as 0xffff, or 10+ digit numeric arguments.
Document references EPSIMP32 or contains PostScript/EPS markers.
CVE-2017-0261 and CVE-2017-0262 exploit the Windows EPS (Encapsulated PostScript) image filter (EPSIMP32.FLT) used by Microsoft Office. A crafted EPS image inside an Office document triggers a use-after-free or out-of-bounds read that allows arbitrary code execution. These vulnerabilities were exploited in highly targeted APT campaigns in 2017. The rule matches EPSIMP32 or %!PS-Adobe markers; it does not validate the malformed EPS needed to identify a specific EPS CVE.
Embedded Flash authplay SWF exploit — CVE-2010-1297 likely
critical
CVE likely
CVE_2010_1297_FLASH_EMBEDDED
PDF embeds a crafted authplay-era SWF and pairs it with PDF-side shellcode heap-spray staging.
Some CVE-2010-1297 exploit PDFs carry the malicious SWF in a plain compressed stream rather than exposing a canonical /RichMedia dictionary. The detector requires the same high-signal SWF markers used by the RichMedia variant plus a PDF-side encoded heap-spray stage, avoiding attribution for ordinary embedded Flash content.
MTEF Matrix record exploit signature found in Equation Editor OLE data.
CVE-2018-0798 is a stack buffer overflow in the Matrix record (type 0x05) parser of EQNEDT32.EXE (Microsoft Equation Editor). Public writeups describe it as affecting Equation Editor broadly, including builds patched for CVE-2017-11882 and CVE-2018-0802. The public exploit shape uses 0x60 bytes followed by 0x61 padding and a return address (0x0BFB) to hijack execution. Widely used by APT groups including Conimes, KeyBoy, Emissary Panda, and Rancor.
RTF contains an activated OLE1 Equation.3 object with large payload-like native data.
The document reaches the legacy Equation Editor parser through an OLE1 Equation.3 object and supplies large high-entropy native data or an embedded PE-like payload. This is a weaponized Equation Editor RCE delivery shape associated with CVE-2017-11882 and CVE-2018-0802, but the scanner did not recover the malformed MTEF FONT/MATRIX record required for exact CVE attribution.
Equation Editor Ole10Native payload — CVE-2017-11882 family
critical
CVE_2017_11882_EQUATION_OLE10NATIVE_RELATED
RTF activates a Microsoft Equation 3.0 OLE storage carrying a high-entropy Ole10Native payload.
Normal Equation Editor OLE objects store Equation Native/MTEF data. The detector requires decoded RTF objdata containing a CFB whose Root Entry CLSID is Microsoft Equation 3.0, RTF activation controls such as \objemb and \objupdate, and a high-entropy Ole10Native payload stream. That combination is a weaponized Equation Editor RCE delivery shape related to CVE-2017-11882/CVE-2018-0802. Individual attribution still requires a FONT/SIZE/MATRIX MTEF primitive.
MTEF SIZE record contains an exploit-sized explicit point size or delta.
CVE-2018-0802 is an Equation Editor memory-corruption vulnerability in the SIZE-record parsing path. The detector requires a valid Equation Native stream and an implausibly large SIZE value, so it is stronger than Equation Editor activation or CLSID evidence alone.
Equation Editor command stager — CVE-2017-11882 family
critical
CVE_2017_11882_COMMAND_STAGER_RELATED
Activated Equation Editor object carries command-launch bytes without a recoverable individual-CVE MTEF primitive.
The activated Equation object and command stager establish a weaponized Equation Editor family document, but a FONT/SIZE/MATRIX primitive is required before assigning CVE-2017-11882, CVE-2018-0802, or CVE-2018-0798 individually.
Excel's shared-string index table (EXTSST) declares far more entries than the workbook's string count allows — the CVE-2011-0105 memory-corruption shape.
Microsoft Excel (MS11-021) rebuilds the shared-string index from an EXTSST record whose ISSTINF entry count must equal ceil(cstUnique / Dsst) taken from the preceding SST record. An EXTSST declaring far more entries drives a copy with an attacker-controlled length and source — the documented CVE-2011-0105 data-initialization memory-corruption primitive, where the over-declared array doubles as the heap-spray / pointer table — achieving code execution from a crafted .xls.
Excel FEATHEADER record declares an oversized/inconsistent internal length — the CVE-2009-3129 parser-overflow shape (legitimate records are only tens of bytes).
Microsoft Excel 2007/2003 SP1 FEATHEADER (Feature Header) parser uses an attacker-controlled cbHdrData length in a memcpy. A FEATHEADER record with an oversized record size or cbHdrData value is the documented exploit primitive — legitimate FEATHEADER records are tens of bytes. CVE-2009-3129 was actively exploited in targeted attacks to achieve code execution from crafted .xls files.
Excel HTML/XML workbook markup contains unexpected nested content in x:WorksheetOptions.
Cisco Talos describes CVE-2019-1448 as a Microsoft Office Excel HTML/XML parser use-after-free in mso.dll. The reported proof-of-concept uses an Office HTML workbook with ExcelWorkbook/ExcelWorksheets and a malformed x:WorksheetOptions block containing unexpected nested markup.
Legacy Excel BIFF8 workbook combines a narrow FORMAT-index cluster with large OLE slack payload staging.
CVE-2008-3005 is the Microsoft Excel Index Array vulnerability from MS08-043. The rule is deliberately narrow: it requires a BIFF8 Workbook/Book stream with the observed low FORMAT-index cluster and a normal XF table, plus a large unallocated OLE sector region where pre-macro-era Excel exploits stage shellcode. Low built-in FORMAT records by themselves occur in clean workbooks, so the OLE slack payload-hiding context is mandatory for CVE attribution.
Excel workbook has repeated malformed drawing-object (OBJ) records using an invalid target value, alongside shellcode/heap-spray context — the CVE-2009-0238 shape.
CVE-2009-0238 is an Excel remote-code-execution vulnerability triggered by a crafted workbook that causes invalid object access. The detector requires repeated malformed BIFF OBJ records whose ftMacro subrecord uses the invalid 0xFFFF target, plus shellcode or heap-spray context. Ordinary form-control OBJ records are not sufficient.
Excel workbook combines abnormal Forms.CommandButton OBJ record IDs with XLM/VBA auto-execution context.
CVE-2009-0557 is the Microsoft Excel Object Record Corruption vulnerability. This detector keys on a narrow workbook structure: multiple Forms.CommandButton OBJ records with abnormal object-id gaps, several XLM macro sheets, and a VBA project. The auto-exec context is required so normal spreadsheets with form controls do not receive CVE attribution.
Document contains an ms-msdt: URI consistent with Follina payload delivery.
CVE-2022-30190 (Follina) is a critical Microsoft Office zero-day that allows arbitrary code execution without macros. When a specially crafted document containing an ms-msdt: URI is opened, Word fetches a remote HTML file that triggers the Microsoft Support Diagnostic Tool (MSDT) to execute a PowerShell payload. The scanner matches the URI string in Office content or relationships; the URI is vulnerability-specific evidence, but it does not establish that the surrounding HTML or Office load path is reachable. The vulnerability has been exploited in the wild since May 2022.
PDF JavaScript matches the public Foxit Reader 9.0.1.1049 annotation-UAF exploitation chain.
CVE-2018-9958 is an annotation point-property use-after-free in Foxit Reader. The exact public exploit allocates and destroys Text annotations, reclaims the 0x60-byte allocation with ArrayBuffer, uses Int32Array to disclose stale pointers, and triggers re-entry through a JavaScript getter. Requiring this complete chain avoids pinning generic annotation automation to the CVE.
Embedded PostScript/EPS uses Ghostscript CVE-2017-8291 exploitation primitives.
CVE-2017-8291 is a Ghostscript -dSAFER bypass/type-confusion issue exploited through crafted EPS/PostScript content, including HWP documents that embed EPS in BinData streams. The rule covers both major static exploit shapes: the public .rsdparams plus /OutputFile(%pipe%) command execution path, and the .eqproc type-confusion path commonly hidden in '<HEX> cvx exec' staged HWP/EPS payloads.
Embedded HWP EPS/PostScript matches the CVE-2013-0808 exploit staging shape.
This detector covers the stripped-header HWP/EPS exploit form associated with CVE-2013-0808. It requires a revision-gated PostScript program, a large /D40 hex payload, D41/D42 array heap grooming, repeated recursive /B bind stubs, and both sentinel searches ending in 22222 and 11111. Those gates are deliberately conjunctive so ordinary EPS graphics with large hex image data do not receive CVE attribution.
HWPX BinData embeds a malformed prefixed OLE/CFB chart object with shellcode-style API markers.
CVE-2015-6585 affects Hancom Hangul handling of crafted embedded OLE/chart content. The detector is specific to HWPX packages that carry BinData/*.ole objects outside standard OOXML oleObject relationships and requires the exploit-shaped combination of a 4-byte-prefixed CFB body, VtChart/VtDataGrid object data, executable-memory API strings such as kernel32.dll and VirtualProtect, and shellcode sled bytes.
RTF embeds a Word.Document.12 package with repeated null-CLSID ActiveX controls and an oversized activeX1.bin CFB payload.
CVE-2017-11826 is a Microsoft Office memory-corruption vulnerability triggered when Office mishandles objects in memory. This detector covers the submitted exploit carrier shape: decoded RTF objdata containing a Word.Document.12 package, many ActiveX XML controls with the invalid {00000000-0000-0000-0000-000000000001} class ID, repeated relationships to one activeX1.bin, and an oversized/highly-compressed CFB payload. The gates distinguish it from ordinary embedded ActiveX controls.
Document contains a file:///\\ moniker-link target with an exclamation mark.
CVE-2024-21413 (Moniker Link) is a Microsoft Outlook/Office vulnerability where a specially crafted hyperlink using the file:///\\host\share\path!something format can bypass Protected View and trigger NTLM authentication in affected Office/Outlook handling paths. The rule matches the file:///\\host\share...! target shape; it does not prove which host application or preview path will process the link.
Document contains Shell.Explorer.1 CLSID evidence plus OLE activation context.
CVE-2026-21509 is a Microsoft Office security feature bypass (CVSS 7.8) that exploits reliance on untrusted inputs in OLE/COM security decisions. Attackers craft documents with manipulated metadata so the parser incorrectly marks dangerous objects as 'Safe for Initialization,' allowing code execution without security warnings. Actively exploited in the wild. The scanner matches the Shell.Explorer.1 CLSID or ProgID and, for text forms, requires embedding context such as Ole10Native, RTF objdata, or an embedded PE marker; bare text is not enough.
OLE2Link auto-activated remote loader — CVE-2017-0199 / CVE-2017-8759
critical
RTF_OLE2LINK_REMOTE_MONIKER_LOADER
RTF OLE2Link object is force-activated with \objupdate and fetches a remote second stage via an INCLUDE field.
Field-delivered OLE2Link auto-update attack path shared by CVE-2017-0199 and CVE-2017-8759: an OLE2Link object (Package/OLE2Link CLSID {00000300-0000-0000-C000-000000000046}) is auto-activated on open via \objupdate (no user interaction), and the remote loader URL is carried in an INCLUDETEXT/INCLUDEPICTURE field rather than an inline URL Moniker — so the moniker-based detector does not fire. The two CVEs share this exact RTF artifact and diverge only in the C2 response: CVE-2017-0199 returns an HTA/scriptlet (OLE URL-moniker / htafile handler), CVE-2017-8759 returns a SOAP WSDL the .NET SOAP-moniker parser compiles. With the C2 unreachable the specific CVE is reported as RELATED, narrowing to a single CVE (LIKELY) only when the moniker URL carries a tell (.txt/!soap/wsdl -> 8759; .hta/.sct/script: -> 0199).
Office document embeds EPS/PostScript with exploit-style dynamic execution or decode-filter markers.
CVE-2015-2545 is a KEV-listed Microsoft Office vulnerability triggered by crafted EPS images. The detector is stricter than a plain EPS-header match: it requires EPS/PostScript content in an Office document plus dynamic PostScript execution or decode-filter markers such as cvx exec, system, deletefile/run, or ASCIIHex/ASCII85/SubFileDecode usage.
Outlook .msg contains UNC reminder evidence: exact for ReminderFileParameter, related for raw UNC fallback.
CVE-2023-23397 is a critical Microsoft Outlook privilege escalation / credential theft vulnerability with CVSS 9.8. An attacker sends a specially crafted meeting request, task, or appointment where the PidLidReminderFileParameter property contains a UNC path pointing to an attacker-controlled server. When Outlook processes the item (even before the user opens it), Windows automatically authenticates to the remote server using NTLM, leaking the victim's Net-NTLMv2 hash. This hash can be cracked offline or used in relay attacks for lateral movement across the network. The sandboxed MSG parser matches the ReminderFileParameter property stream and marks this exact when it contains a UNC path; fallback raw-byte UNC evidence remains related.
Document XML/HTML contains an <img> tag with file://...!... moniker URL.
CVE-2024-38021 is a zero-click vulnerability in Microsoft Outlook where composite monikers in <img> tag URLs are processed without setting the BlockMkParseDisplayNameOnCurrentThread flag. This allows code execution through image tag URLs using the file://...!... moniker syntax. The rule matches <img> tags in Office document XML/HTML parts whose source uses that moniker shape; outside Outlook, treat this as related moniker-abuse evidence rather than proof of zero-click exploitation.
PDF font dictionary contains non-numeric FontMatrix values.
CVE-2024-4367 is a high-severity vulnerability in Mozilla PDF.js (used in Firefox and Thunderbird) where a missing type check in FontFaceObject.getPathGenerator allows arbitrary JavaScript execution. The exploit replaces numeric values in the /FontMatrix array with JavaScript code that gets compiled during glyph rendering. Affects Firefox < 126 and Thunderbird < 115.11.
PowerPoint 95 native file has inconsistent PP7 directory lengths, sound-data marker, and nearby native payload bytes.
CVE-2009-1129 is a PP7X32.DLL PowerPoint 95 importer vulnerability involving inconsistent sound-data record lengths. The detector is restricted to the legacy PowerPoint 95 storage/header layout and requires malformed early PP7 directory lengths, a sound-data record marker, and shellcode-like bytes near the malformed record area.
Binary PowerPoint stream contains an embedded .inf object reference with package data.
CVE-2014-6352 is a Windows OLE remote code execution vulnerability exploited in the wild through crafted PowerPoint documents. The detector scans the binary PowerPoint Document stream and requires an .inf package/object reference in System-object context plus embedded package local-header evidence. It avoids broad .inf matching in ordinary OLE metadata.
PowerPoint Document contains a malformed EscherClientTextbox with TextHeaderAtom, repeated-byte TextBytesAtom payload, and OutlineTextRefAtom.
CVE-2009-0556 is a Microsoft PowerPoint code execution vulnerability involving malformed textbox/outline text record handling. The detector recovers the exploit shape directly from the PowerPoint Document stream: an EscherClientTextbox containing TextHeaderAtom, a long repeated-byte TextBytesAtom buffer, and OutlineTextRefAtom in the same textbox. Direct recovery is used because weaponized PPT streams often desynchronize full record walking while PowerPoint still reaches the malformed textbox records.
RTF objdata embeds Word.Document.12 packages with many repeated ActiveX controls and oversized activeX1.bin.
CVE-2015-1641 is a Word RTF memory-corruption vulnerability. This detector is intentionally structural: it requires decoded RTF objdata containing a Word.Document.12 package, dozens of repeated ActiveX control XML parts, and a single oversized highly-compressed activeX1.bin payload. It is reported as related evidence for the 2015 Word memory-corruption family rather than exact vulnerability proof from public CVE metadata alone.
RTF objdata embeds Word.Document.12 packages with many repeated ActiveX controls and oversized activeX1.bin.
CVE-2015-1770 is an Office uninitialized-memory-use vulnerability. This detector covers the submitted exploit family's RTF-embedded Word.Document.12/ActiveX package shape and is reported as related evidence because the public CVE text does not expose a uniquely validating byte-level primitive.
OLE data contains the SOAP Moniker CLSID.
The scanner matches the SOAP Moniker CLSID bytes {ECABB0C7-7F19-11D2-978E-0000F8757E2A}. This is likely CVE evidence because the CLSID is the vulnerable moniker primitive, but the static rule does not validate a crafted WSDL body.
OLE Package CLSID found alongside executable file references.
CVE-2014-4114 is a Windows OLE remote code execution vulnerability exploited by the Russian Sandworm threat group in targeted attacks against NATO and Ukraine in 2014. The attack uses OLE Package objects embedded in PowerPoint (PPSX) files to silently drop and execute .inf and .exe files when the document is opened. The rule requires the OLE Package CLSID plus executable file references (.inf, .exe, .dll, .bat, .cmd, .scr, .vbs, .ps1, or .hta), so it is a strong package-dropper indicator but not a full reconstruction of the original Sandworm exploit chain.
OOXML .rels file contains an auto-load relationship Target pointing to a remote .rtf URL.
CVE-2023-36884 (Storm-0978/RomCom) was exploited through specially crafted Office documents that led to remote RTF/MSHTML processing and payload delivery. The scanner now requires a non-hyperlink relationship that Office can auto-load (template/subdocument/frame/OLE/altChunk-style relationship) whose Target is an http:// or https:// URL ending in .rtf. Plain clickable hyperlinks to RTF files are not enough for this CVE rule.
Decrypted Type 1 CharString matches the public callOtherSubr stack-pointer manipulation shape.
CVE-2021-21086 is an out-of-bounds write in Adobe Acrobat/Reader's CoolType Type 1 CharString interpreter. The Project Zero/Faraday analysis describes abusing predefined callOtherSubr handling, especially subroutine 18, to move the operand-stack pointer outside the operand stack and write toward the saved return address. The scanner decrypts Type 1 eexec and CharString data and flags repeated not/get/callOtherSubr bytecode sequences matching the public exploit generator.
URL Moniker OLE link points to an HTA/script/template-style remote loader.
This is the tighter CVE-2017-0199 static shape: URL Moniker / OLE2Link evidence plus a remote URL ending in an executable Office-loader extension such as .hta, .sct, .wsf, .xsl, .mht, or a macro-capable template. Generic remote URL Moniker evidence remains CVE_2017_0199 likely because the returned server content cannot be proven statically.
URL Moniker OLE link points to a remote loader.
CVE-2017-0199 abuses OLE2Link / URL Moniker handling so Office fetches remote content and processes it based on the response type. The scanner matches embedded URL Moniker structures or URL Moniker CLSID bytes near weaponised remote-loader targets; it does not prove the server-side content type or payload returned at scan time.
PDF catalog uses a UTF-16BE /URI /Base value and JavaScript resolves a relative URL.
CVE-2021-39863 is an Adobe Acrobat/Reader heap-based buffer overflow in document base-URL concatenation. Exodus Intelligence documented that earlier research had associated this primitive with CVE-2021-21017, but Adobe assigned CVE-2021-39863 for the still-vulnerable bug. The rule requires the malformed UTF-16BE Base URL primitive plus submitForm(), app.launchURL(), or app.media.createPlayer() JavaScript, avoiding broad matches on ordinary PDF JavaScript or normal /URI actions.
Decoded PDF shellcode invokes the NDProxy TAPI IOCTL 0x8fff23c8 with null-page kernel-stub setup.
CVE-2013-5065 is an out-of-bounds access in the Windows NDProxy kernel driver. In Adobe Reader attack chains it is a second, independent CVE: Reader shellcode opens NDProxy, places a privileged stub in the null page, and sends the crafted TAPI IOCTL to escape the sandbox and elevate privileges.
Word/OLE data contains the MS15-022 local-zone exploit chain.
The scanner requires the public CVE-2015-0097 chain shape: MSScriptControl/HTML script execution reaches ADODB.Recordset.Save and writes an HTA/VBS stage into the user's Startup folder. This is stronger than a bare ADODB.Recordset CLSID match.
Word 97-era document places shellcode immediately before a malformed converter-facing table-SPRM cluster.
CVE-2008-4841 affects the Windows WordPad Text Converter for Word 97 files, not the normal Microsoft Word parser. The rule detects the converter exploit carrier where native payload bytes sit immediately before a malformed Word table-SPRM cluster. Because that cluster can look like older Word table-SPRM corruption, the analyzer suppresses CVE-2006-6456 when this more specific converter shape is present.
RTF font table with excessive entries — Word heap buffer overflow.
CVE-2023-21716 is a critical heap buffer overflow in Microsoft Word's RTF parser triggered by an RTF file with an abnormally large number of font entries in the \fonttbl group. The rule requires a \fonttbl and counts at least 32768 \fN font entries, matching the public exploit-scale trigger rather than merely large but valid font tables.
RTF contains an oversized pFragments value.
CVE-2010-3333 is a stack-based buffer overflow in Microsoft Word 2002, 2003, and 2007 triggered by a crafted pFragments value in an RTF document. The scanner emits this CVE rule when the control-word numeric argument is at least 256 or when the canonical shape-property form {\sn pFragments}{\sv ...} carries an oversized value; bare pFragments without exploit-sized data is reported separately as related RTF evidence.
customUI ribbon part contains an external relationship target.
The scanner looks in customUI XML/.rels parts for TargetMode="External" relationships. This is related evidence because the customUI external-load surface is present, but public summaries provide limited technical detail and the rule does not prove the full exploit chain.
PDF embeds a file and JavaScript triggers the dataObjects ESObject use-after-free pattern.
CVE-2020-9715 is an Adobe Acrobat/Reader ESObject use-after-free. The PixiePoint/ZDI trigger creates a Data ESObject by accessing this.dataObjects[0].toString(), clears this.dataObjects[0], then uses app.setTimeOut() to run garbage collection before re-accessing the stale cached Data ESObject. The rule requires the embedded-file surface plus the dataObjects toString/null/setTimeOut lifecycle so ordinary attachment-bearing PDFs are not flagged as the CVE.
PDF JavaScript calls the media.newPlayer API.
CVE-2009-4324 (CVSS 9.3) is a use-after-free vulnerability in Adobe Reader's multimedia plugin triggered by the media.newPlayer() JavaScript API. It was actively exploited as a zero-day in December 2009 and became one of the most widely exploited PDF vulnerabilities. The newPlayer API is extremely rarely used in legitimate PDF documents — its presence is a useful indicator of an exploit attempt. CISA KEV.
PDF JavaScript invokes util.printf() with an oversized format/string argument.
CVE-2008-2992 is a widely-exploited stack buffer overflow in Adobe Reader's util.printf JavaScript implementation. The rule matches util.printf() only when the argument contains a very long format specifier (for example %0000x with 4+ digits) or a quoted string of at least 256 bytes.
OLE data contains the ADODB.RecordSet CLSID.
The scanner matches the ADODB.RecordSet CLSID bytes. Microsoft documented ADODB.Recordset as part of the CVE-2015-0097 mitigation surface, but a bare CLSID does not prove the Word local-zone exploit chain. Strong CVE-2015-0097 attribution requires accompanying ScriptControl, Recordset.Save, and Startup HTA/VBS evidence.
Anomalous Equation Editor native stream — CVE-2018-0798 likely
high
CVE likely
CVE_2018_0798_EQUATION_NATIVE_ANOMALY
Embedded Equation Editor OLE data contains malformed, payload-like native stream bytes.
CVE-2018-0798 is an Equation Editor memory-corruption vulnerability in the MTEF Matrix-record parser. Some weaponized Office samples carry malformed Equation native data that is high-entropy or otherwise payload-like but does not preserve the exact public 0x60/0x61 matrix signature. The detector requires an embedded Equation Editor CLSID and an anomalous native/Ole10Native stream, so it is treated as likely CVE-2018-0798-family evidence rather than an exact match.
A CVE-2012-0158 RTF carries a large high-entropy binary blob — the encrypted/packed second-stage payload the shellcode drops.
Inside a document already attributed to CVE-2012-0158, the scanner found a contiguous binary region of at least 8 KB whose Shannon entropy exceeds 7.0. Hex-encoded \objdata text cannot exceed entropy 4.0 (16 symbols), so a region this random is genuine binary, not encoded markup — the staged payload (typically embedded in the \datastore group) that the exploit shellcode decrypts and writes to disk. It is surfaced as an IOC (offset, size, SHA-256); the bytes are encrypted, so the analyzer reports the blob rather than a decoded PE.
PDF font data contains SING/CoolType markers inside font content.
Adobe Reader CoolType font parsing has been exploited by document CVEs such as CVE-2010-1297. The rule matches SING markers in font-related PDF data; it is related evidence for the CoolType attack surface, not proof of a specific malformed font CVE.
RTF decodes to Equation.3 object activation without a recovered malformed native stream.
The document embeds an Equation.3 object and requests automatic OLE activation with RTF object controls such as \objemb and \objupdate. This reaches the legacy Equation Editor attack surface associated with CVE-2017-11882 and CVE-2018-0802, but does not recover the malformed MTEF/native stream needed for exact or likely attribution.
Raw email From header contains multiple parsed/angle-bracket addresses.
CVE-2024-49040 exploits improper P2 FROM header parsing in Microsoft Exchange Server. By including multiple angle-bracket addresses in the From header (non-RFC-compliant syntax), attackers can make the displayed sender address differ from the actual routing address. The rule inspects the raw From line before parser normalization and fires when it contains multiple address markers or parses as multiple mailboxes; it cannot prove the recipient Exchange server was vulnerable.
PDF automatic/open action uses GoToE or GoToR with a UNC /F target.
This is the tighter Adobe Reader NTLM credential-leak shape: an /AA or /OpenAction-triggered GoToE/GoToR action whose /F file target is a UNC path. That matches the public CVE-2018-4993 proof-of-concept pattern more closely than the broader UNC-in-action rule.
PDF uses JBIG2Decode/JBIG2 data alongside active content.
JBIG2 plus active content is a high-value parser-exploit indicator for families including CVE-2021-30860 and CVE-2009-0658. The rule matches /JBIG2Decode or JBIG2 signatures plus active content such as JavaScript, XFA, or RichMedia; it does not uniquely identify either CVE.
OLE data contains the MSCOMCTL.ListView CLSID.
The scanner matches the ListView ActiveX CLSID bytes. This identifies the vulnerable control used by CVE-2012-0158 campaigns, but does not parse the crafted control property data needed to prove the overflow.
OLE data contains the MSCOMCTL.Toolbar CLSID.
The scanner matches the Toolbar ActiveX CLSID bytes. This identifies the vulnerable control used by CVE-2012-0158/1856 campaigns, but does not parse the crafted control property data needed to prove the overflow.
OLE data contains the MSScriptControl.ScriptControl CLSID.
The scanner matches the MSScriptControl.ScriptControl CLSID bytes. Treat this as related local-zone or scripting-surface evidence rather than a specific proof of CVE-2015-0097, because public Microsoft guidance ties ADODB.RecordSet more directly to that CVE's workaround.
Embedded JP2/JPEG2000 data has invalid, oversized, or truncated box sizes.
Malformed JP2 boxes demonstrate invalid JPEG2000 structure; a bare /JPXDecode filter only identifies use of the codec. The malformed boxes do not establish a specific CVE such as CVE-2018-4990. The rule matches JP2 box lengths statically and flags impossible or truncated structures.
OOXML OLE2Link object fetches a remote Office-looking document.
CVE-2017-8759 campaigns can use an OOXML OLE2Link object to activate a remote document/WSDL stage that contains the SOAP moniker payload. The detector matches the local staging document, not the fetched WSDL body; therefore it is related evidence unless the SOAP/WSDL target is present in the local file.
OOXML linked OLE object auto-loads a remote URL without enough local evidence for an exact CVE.
The document contains an o:OLEObject Type=Link with an external oleObject relationship to a remote URL. This is the OOXML OLE2Link activation shape associated with CVE-2017-0199 delivery, but the local bytes do not expose URL Moniker data or a weaponized remote content type. Treat this as related CVE attack-surface evidence rather than exact attribution.
Suspicious Equation Editor Matrix record — CVE-2018-0798 likely
high
CVE likely
CVE_2018_0798_MTEF_ANOMALY
Equation Editor MTEF Matrix record has an anomalous exploit-like shape.
The scanner found an abnormal MTEF Matrix record inside Equation Editor OLE data, but not the tighter public CVE-2018-0798 byte pattern. Treat this as likely Equation Editor exploit evidence rather than an exact CVE-2018-0798 signature.
Embedded JBIG2 data contains anomalous segment headers or sizes.
Malformed JBIG2 segment structure is a parser-exploit indicator. Use this as related evidence for JBIG2 decoder CVE families. The rule looks for JBIG2 signatures plus suspicious segment-header shapes, not a validated FORCEDENTRY-style logical circuit.
PDF action target contains a UNC path and the file has action triggers.
CVE-2018-4993 (Adobe Acrobat/Reader) and CVE-2019-7089 allow an attacker to steal NTLM authentication credentials by embedding a UNC path (\\server\share) in a PDF action (JavaScript, GoToR, URI, etc.). When the victim opens the PDF, a vulnerable viewer may resolve the UNC path and Windows can send the user's Net-NTLMv2 hash to the attacker's server. The hash can be cracked offline or used in relay attacks to authenticate as the victim. The rule requires the UNC path to be inside a PDF action target parameter (/F, /URI, /D, or /Target) plus an action keyword such as /JavaScript, /GoToR, /URI, /Launch, /OpenAction, or /AA.
Document contains CVE-2026-21514-style Word/OLE bypass indicators.
CVE-2026-21514 is a Microsoft Word security feature bypass (CVSS 7.8) — an OLE trust bypass. A crafted document disables Word's OLE object/link protection enforcement so an embedded OLE object activates without a Protected View / Enable Content prompt. For OOXML, the rule matches word/settings.xml disabling OLE protection enforcement (oleLinkProtection / objectEmbedProtection with enforcement off) while the document embeds an OLE object — the actual exploit primitive, not the generic Ole10Native+payload dropper shape (which is convicted by the OFFICE_PACKAGE_* / ClamAV rules instead). It also matches the observed RTF-embedded Word package shape where webSettings.xml.rels contains a frame relationship to a local Windows diagnostics XML target, and the altChunk/RTF shape where a hidden \svb hex package contains DrsE2oDoc, graphicFrameDoc, and downRevStg drawing compatibility parts.
RTF \listoverridecount with abnormally large value.
CVE-2014-1761 is a memory corruption vulnerability in Microsoft Word triggered by an excessively large \listoverridecount value in an RTF document. The vulnerability allows arbitrary code execution and was used in targeted attacks. The rule fires only when \listoverridecount has a numeric value at or above 2048, not on ordinary list metadata.
PDF JavaScript calls getAnnots() with an exploit-shaped argument.
CVE-2009-1492 affects Adobe Reader's annotation handling. Rule fires only when the call has an integer-overflow numeric (many-F hex or >int32 decimal) or a long stuffed-string argument; plain calls like getAnnots({nPage:0}) used as harmless staging boilerplate in exploit kits are not flagged.
PDF JavaScript invokes spell.customDictionaryOpen() with a long string argument.
CVE-2009-1493 is a stack buffer overflow in Adobe Reader's spell-check API. The rule requires spell.customDictionaryOpen() with a quoted string at least 128 bytes long; ordinary short dictionary names are not flagged.
PDF contains PRC 3D content markers.
3D parsers in PDF viewers are a recurring exploit surface. PRC content is rare in normal business documents and should be reviewed as related parser-exploit evidence. The rule matches /Subtype /PRC or /PRCStream markers; it does not validate malformed PRC records.
PDF font data has SING/CoolType markers without the stricter validated CVE exploit shape.
This preserves negative evidence for analyst review: generic font-parser surface was observed, but the scanner did not validate an actual SING font table paired with heap-spray shellcode, so no exact font CVE should be inferred from the marker alone.
Archive
21
Archive contains a child file that was independently classified as malicious.
A file extracted from the archive triggered malicious static-analysis evidence. The archive is therefore treated as a malicious carrier, even if the outer container has little suspicious structure on its own.
A native executable bundled in the archive was identified as malware by ClamAV.
The archive carries an executable payload that ClamAV flagged as malicious. Bundling an executable dropper with documents is a classic phishing / malware-delivery pattern, so the archive is convicted even when its document members are clean.
An archive places verified compiled AutoLISP under a reserved AutoCAD startup name beside DWG drawings.
The detector requires both real DWG members and a member named acad/acaddoc (optionally versioned) whose bytes carry a valid FAS2, FAS3, FAS4, or legacy FAS executable header. This avoids convicting CAD-only archives or harmless files renamed acad.fas. AutoCAD documents this co-location and automatic-loading pattern as a malware risk.
A Java class copies a bundled payload, marks it executable, and starts it with ProcessBuilder.
The rule requires a complete resource-to-disk-to-process chain and a payload-like native member name.
Archive is encrypted with a known malware-delivery password.
The archive uses a password commonly seen in malware distribution workflows. Encrypted delivery can prevent gateway inspection and is suspicious when the contents also require secondary analysis.
Archive uses encrypted delivery with suspicious carrier context.
The archive is password-protected or otherwise encrypted in a context that resembles malware delivery. This can hide embedded documents, scripts, or executables from normal inspection.
A damaged or truncated archive declares a native executable member that cannot necessarily be recovered completely.
The executable delivery intent remains relevant even when missing bytes prevent payload classification or extraction.
Executable disguised with a document double extension
high
ARCHIVE_DOCUMENT_DOUBLE_EXTENSION_EXECUTABLE
An archive member uses a document-looking name such as invoice.pdf.exe but is executable code.
Windows often hides the final known extension, so a file ending in .pdf.exe, .doc.scr, or a similar combination can appear to be an ordinary document. The executable is carved for authenticated inspection, scanned with ClamAV, and its embedded network URLs are propagated to the parent archive.
An Android package combines a packer wrapper, dynamic DEX installation, concealed data, native code, and sensitive permissions.
Packers can be legitimate, so this is suspicious rather than independently conclusive; the compound profile materially limits static visibility and exposes sensitive device capabilities.
Archive could not be fully unpacked or scanned.
The analyzer could not inspect every archive member. This is not proof of malice by itself, but it means the result has reduced visibility into nested content.
An archive member has a verified compiled FAS executable-code header.
Compiled AutoLISP is executable content in AutoCAD. It can be a legitimate extension, so this rule provides visibility and preserves the member as an analyst artifact without independently classifying the archive as malicious.
The file has a ZIP signature but could not be opened.
The archive appears to be a ZIP file based on its header bytes, but the internal structure is invalid. It may be corrupt, truncated, or deliberately malformed to exploit vulnerabilities in ZIP parsers.
The archive is password-protected with an unknown password.
The ZIP archive is encrypted and none of the common analysis passwords worked. The files inside could not be extracted or scanned. If you know the password, extract the files manually and upload them individually.
Network indicators were recovered from members that remain readable in a truncated archive.
Scanning complete leading members preserves actionable configuration even though the archive as a whole is structurally incomplete.
A valid Windows executable host contains a later validated ZIP archive.
Self-extractors can be legitimate, so the shape is contextual; both the PE host and archive members are preserved for review.
The total decompressed size exceeded the safety limit.
To protect against zip bombs (archives that decompress to enormous sizes), the analyzer caps total decompressed output. Some files in the archive may not have been scanned.
Archive members are partially recoverable but the container ends early or has damaged headers.
Recovered members are scanned, but missing trailing content prevents a confident complete assessment.
A native executable (PE/ELF/Mach-O or .exe/.dll/.scr/…) is bundled inside the archive alongside documents.
The document-analysis pipeline does not deep-inspect executable payloads, but a bundled executable in a document-delivery archive is a common dropper / phishing pattern, so it is surfaced for visibility. ClamAV is run on the executable; this finding means ClamAV did not flag it (legitimate software archives also carry executables), so it is informational and does not by itself convict the archive.
The APK contains resources and a manifest but no executable code.
Android App Bundles commonly install resource-only split APKs alongside a base APK. This inventory finding confirms that this component has no classes.dex, native shared libraries, or Windows executable members; it does not assert that the complete application is safe.
Only a limited number of files were scanned from the archive.
To prevent resource exhaustion, the analyzer limits the number of files it extracts and scans from a single archive.
An entry in the archive exceeds the per-file size limit.
Individual files inside the archive are capped at 50 MB. Files exceeding this limit are skipped to prevent memory exhaustion.
PSD
1
PE executable found inside Photoshop file.
A Windows executable inside a PSD file indicates the image is being used as a container for malware.
ClamAV
2
ClamAV antivirus identified this file as malware.
ClamAV is an open-source antivirus engine with a database of known malware signatures. A positive detection means this file matches a known malicious pattern catalogued in the ClamAV virus database.
ClamAV invocation failed (timeout, daemon unreachable, or DB missing).
The ClamAV signature pass on this run did not finish — typically because clamd was reloading its signature database (after freshclam) or briefly unreachable. The static heuristics still ran, but the AV signature signal is absent for this scan, so the score may be lower than it would be with a working clamd. Results carrying this marker are not cached, so a later lookup re-runs the analysis.
General
22
A ZIP appended after PDF EOF contains a member that matches a CVE rule.
The analyzer scanned the visible PDF and then scanned ZIP bytes appended after %%EOF. A member of that appended archive independently matched a CVE-specific exploit rule, so this finding ties the child CVE back to the parent PDF as a bundled multi-exploit delivery package.
Extracted child file matched a ClamAV malware signature.
A carved or unpacked child artifact matched ClamAV. This points to malicious content inside the parent file, even when the outer document is primarily a carrier.
File starts with GIF magic but contains a PDF body at a later offset.
Project Zero's FORCEDENTRY analysis documented a fake-GIF routing trick where image processing accepts a GIF-named/headered file while ImageIO/CoreGraphics identifies and parses embedded PDF/JBIG2 content. The detector flags that wrapper shape so the parent object is not treated as a benign GIF.
Three or more independent structural-anomaly heuristics fired on this file.
Format parsers tolerate a wide range of small spec violations in benign files. When multiple independent structural-anomaly rules fire together on the same file, it usually means the file was crafted to confuse a specific parser into mis-handling its content — the canonical shape of exploitation against a memory-safety bug. The aggregate signal is more reliable than any single anomaly.
File was submitted as .pdf but does not contain a PDF header.
A file using a PDF extension without PDF structure is a masquerade or evasion pattern. It should not be considered a clean PDF simply because of the filename.
ZIP local-file header appears after the last %%EOF in a PDF.
Polyglot files carry valid bytes for two formats simultaneously. A PDF followed by a ZIP local-file header at the tail will open in a PDF reader as the document and in an archive parser as the ZIP. This is a known exploitation primitive used to smuggle payloads past one-format scanners.
A file carved from inside the sample matched static suspicious-content checks.
The analyzer performs a lightweight triage pass on carved artifacts in addition to ClamAV. It looks for signals such as script obfuscation, long encoded blobs, PowerShell encoded commands, VBA auto-exec with execution terms, and high-entropy packed content. These are not signature matches by themselves, but they are useful evidence when an embedded payload is trying to hide behavior from simple static inspection.
This combination of heuristics has fired multiple times before, mostly on malicious files.
The analyzer keeps a record of every prior scan's heuristic combination. When the same combination has been seen at least three times in the last 90 days and at least 80% of those were classified malicious, the finding reports that measured corpus prior for the current file.
%PDF- magic and %%EOF trailer found inside a text document.
A document classified as HTML, RTF, or script that also contains a fully formed %PDF body (header and trailer) is a polyglot: browsers render the wrapper, PDF readers open the embedded document. Used to deliver PDF exploits while evading file-type-based filtering.
Non-empty bytes precede the first ZIP local-file header.
Many ZIP-based parsers (including OOXML readers) scan forward to find the central directory and successfully open archives that have arbitrary prefix bytes. Format-aware parsers see only the prefix. Mismatched parser behaviour on the same bytes is a polyglot delivery pattern.
Format-neutral static scan produced the finding.
The analyzer applied a generic static scanner because the file type was ambiguous, unsupported, or not the main source of the suspicious evidence.
PowerPoint record anomaly: PowerPoint Fopt Complex Data Overflow.
The PowerPoint binary record structure contains malformed or oversized record data associated with legacy Office parser exploitation.
PowerPoint record anomaly: PowerPoint Fopt Property Table Truncated.
The PowerPoint binary record structure contains malformed or oversized record data associated with legacy Office parser exploitation.
An unusual combination of heuristics that has been flagged on at least one prior file.
Files that fire heuristic combinations rarely seen in the corpus are worth a closer look — especially when at least one prior occurrence was suspicious or malicious. This is a weaker signal than the historically-malicious combination, but it surfaces low-volume patterns that signature-style rules would miss.
Normalized parser/payload feature set is rare and has appeared on a flagged file before.
This corpus signal groups exact rule IDs into broader structural features such as font-parser anomalies, object-graph divergence, embedded payloads, and shellcode evidence. It can surface recurring exploit shapes even when the precise signature names differ.
Analysis exceeded the wall-clock timeout; phases that had completed before the timeout are preserved.
Some scanners (regex-heavy parsers, large structured documents) can hit the per-file wall-clock budget. Unlike SCAN_INCOMPLETE this finding does not flag the result as needing retry — re-scanning the same bytes will hit the same timeout, so the partial result is cached as-is. Operators investigating individual cases can force a fresh scan via the rescan API.
One or more URLs were extracted from the document bytes but were not attributed to any other specific heuristic.
URL-themed rules attribute URLs they actually evaluated (e.g. PDF link annotations, macro download calls). URLs that appear in the file but were not tied to a specific finding are surfaced here so an analyst can still see and triage them. The per-finding detail names the most likely channel (e.g. 'Macro calls URL', 'PDF link annotation references URL') inferred from the other rules that fired on the same file.
A capability-only Office macro carries a cryptographically valid, CA-issued (non-self-signed) VBA publisher signature and nothing corroborates malice, so its score was downgraded to clean.
A valid, CA-issued publisher signature is a strong benign signal: it ties the VBA project to an accountable, identity-verified author and proves the signed bytes are intact. When that signature verifies AND the same no-corroborator gate the signature gate passes (no obfuscation / download+exec / loader / AV-ML hit / suspicious URL), the verdict is downgraded to clean — clearing legitimately-signed add-ins (e.g. the Microsoft Analysis ToolPak). A valid signature is NOT trusted on its own: a validly-CA-signed but weaponised macro always trips a hard corroborator and stays malicious. Self-signed / unverified / invalid signatures never qualify.
Core static analysis completed; optional late-stage decoders were skipped after the per-file soft deadline.
Large documents (typically multi-megabyte PDFs) can exhaust the soft per-file budget after the core object/action/stream pass has already finished. Unlike SCAN_INCOMPLETE the file WAS substantively inspected, so the verdict is real and the result is not flagged Error — only optional decoders (legacy/XFA JavaScript, late sub-format walkers, embedded-PDF recursion) did not run. This finding carries no risk weight: it records reduced coverage, not evidence about the file. Treat a clean verdict here as slightly less conclusive than a clean verdict on a fully walked file.
A ZIP appended after PDF EOF could not be fully scanned.
ZIP bytes were found after the PDF EOF marker, but the appended archive member scan failed or could not run. Parent PDF findings remain valid, but child payload attribution may be incomplete.
A scanner failed, timed out, or hit an output/resource cap before analysis completed.
This is an operational failure, not evidence that the file is safe. At least one required parser or worker did not finish, so the result is marked Error and should be retried or reviewed manually.
File format was not recognised by the analyzer.
The file does not match any supported document format. Only generic shellcode scanning was performed. The file may still be harmful.
Extracted artifact
1
All Extracted artifact heuristics →
An extracted attachment is exactly the standardized inert EICAR antivirus test record.
The attachment remains carved and its antivirus result remains visible, but the exact canonical test record does not represent live malware. Modified records and files containing any additional executable content do not receive this exception.
Extracted file
1
All Extracted file heuristics →
Carved SWF contains native memory-corruption and process-execution primitives.
Requires memory discovery, page-protection changes, and platform execution surfaces together; generic Flash applications do not satisfy the conjunction.
Generic
2
Decoded content contains a valid executable or risky archive.
Only structurally valid PE headers or ZIP archives with executable/script members qualify. Incidental magic bytes and Office-only theme packages are excluded.
A format-neutral bounded decoder recovered an absolute URL.
The analyzer decoded bounded UTF-16, Base64, hexadecimal, or JavaScript %u content and recovered a network location.
HTML
13
HTA/VBScript document executes code assembled from DOM text.
Malicious HTA attachments often split the real script across HTML text nodes, then use VBScript Execute to run the reconstructed body on load. This hides the payload from simple script-block scanners while preserving automatic execution.
A branded page submits email credentials to a generic form collector and redirects to a trusted decoy.
The rule requires email and password fields, scripted submission, a third-party collection endpoint, and a trusted-brand decoy redirect.
HTML script instantiates ActiveX or COM objects.
CreateObject and ActiveXObject let script reach Windows automation interfaces such as WScript.Shell, XMLHTTP, and ADODB.Stream. That is rare in benign documents and common in script malware.
HTML references COM objects commonly used for execution or payload download.
Objects such as WScript.Shell, Shell.Application, MSXML2.XMLHTTP, and ADODB.Stream provide command execution and staged-download capability from script.
Standalone HTML contains a VBScript script block.
VBScript in local HTML documents is a legacy Windows execution surface. Malicious attachments commonly use it with COM objects to download, drop, or execute payloads.
HTML sign-in form loads assets from or posts to a free dynamic-DNS/tunnel host.
A credential-collecting form combined with a free dynamic-DNS or tunnel host (dedyn.io, duckdns.org, no-ip, ngrok, trycloudflare, serveo, and similar) is the standard shape of a phishing kit. Legitimate brand login pages never serve their sign-in assets from throwaway dynamic-DNS domains.
HTML script dynamically creates objects and invokes execution/open methods.
Dynamic object creation followed by execution-like calls is a staged script malware pattern, especially when hidden inside a file with a document extension.
A contiguous or constant-concatenated base64 value inside an inline script decodes to a complete archive, executable, document or HTA.
The blob is decoded and accepted only on self-validating evidence: container/executable magic bytes (ZIP, PE, PDF, OLE, RAR, 7z) or an explicit <hta:application> declaration. Inline images, fonts, minified bundles and HTML templates do not fire. This is the HTML-smuggling delivery pattern: the payload never crosses the network as a file, so gateway and proxy scanning never inspects it, and the page reassembles it in the browser. The decoded payload is carved as an artifact so ClamAV and static triage can examine it.
Inline script base64-decodes a blob, XORs it byte-by-byte, and evals the result.
The rule fires only when all three appear together: an atob() base64 decode, a byte-by-byte XOR loop (charCodeAt(i) ^ key), and a dynamic-execution sink (eval, new Function, or indirect (0,eval)). This self-decrypting execution primitive has no legitimate purpose in page-embedded inline script — benign minifiers and packers never XOR-decrypt a blob into eval — so requiring the full triad keeps false positives near zero. It is the signature of the compromised-CMS (typically WordPress) JavaScript injector family: card skimmers, malicious redirectors, and drive-by loaders that hide the real payload from static scanners.
HTML script contains a long or constant-concatenated base64-like blob.
Long encoded blobs in script, including payloads split across adjacent constant literals and consumed by atob(), are commonly used for HTML smuggling or for staging a second payload while avoiding simple content filters.
HTML script repeatedly builds strings from small fragments.
Heavy string-fragment construction hides object names, commands, URLs, and payloads from static scanners and is common in malicious script.
Page pairs a CHEQ cloaking handler with an ad-network channel tracking iframe.
The rule fires on the conjunction of a CHEQ anti-bot/cloaking handler ("nCheqResponse") and an ad-network channel tracking iframe ("/ns/<hex>.html?ch=<channel>-iFrame", usually inside <noscript>). Together these are the monetized ad-arbitrage / click-fraud doorway pattern: the page shows automated crawlers and real humans different content and routes visitors through an affiliate channel. It is traffic cloaking / ad fraud rather than code execution, so it is scored low — surfaced for triage and campaign clustering without inflating the document's verdict.
A URL was recovered by decoding a long base64 blob inside an inline script.
Static URL extraction cannot see inside an encoded blob, so this destination would otherwise never reach reputation scoring or campaign clustering. CDN, font and standards boilerplate is filtered out so only candidate infrastructure is reported.
HTML / Script
2
All HTML / Script heuristics →
Browser script retrieves remote content and copies a command
critical
JS_SOURCE_RELATIVE_COMMAND_LOADER
Browser JavaScript derives its origin at runtime and retrieves a clipboard command/iframe payload.
The script combines currentScript-derived network origin, assembled API routes, response decoding, iframe srcdoc injection, and clipboard command writing. This complete chain hides the C2 hostname from literal URL extraction.
A bounded Base64 or hex decode recovered an absolute URL.
Encoded script configuration is decoded within strict count and size bounds so hidden destinations reach IOC search without treating encoding alone as malicious.
Machine Learning
1
All Machine Learning heuristics →
Gradient-boosted classifier scored the PDF above the suspicious threshold.
The Nyx classifier is a LightGBM model trained on byte-level structural features (keyword counts, filter histograms, entropy, object/stream balance) of hundreds of thousands of malicious and benign PDFs. Severity is graded by score: medium >= 0.25, high >= 0.5, critical >= 0.9. The model is complementary to the rule-based heuristics — it can catch families with no individual indicator that trips an explicit rule but whose overall shape matches the malicious training distribution.
Macro
5
VBA decodes a command and Win32_Process moniker from worksheet cells and executes the command through WMI.
The detector requires an Office auto-execution entry, Base64 decoding of Range/Cells values, a decoded winmgmts:Win32_Process moniker, and a decoded network-bearing PowerShell command reaching .Create. It reports the URL and output path, records remote/local extension mismatches, and carves the decoded command for authenticated preview.
A VBA/UserForm hex or Base64 payload decodes to a ZIP containing executable/script content.
The archive is structurally validated, requires a risky child member, and is recursively carved for static and antivirus analysis.
A large binary or script payload is split across a long run of Base64-encoded worksheet cells, often in a hidden sheet and often with a second XOR layer.
The scanner rejoins the cell run in document order, Base64-decodes it, and (when the result is not already recognisable) retries a repeating-key XOR using the short string values held elsewhere in the same workbook — the shape used by loaders that keep the key in a cell. It fires only when the decoded bytes carry executable/container magic or are overwhelmingly printable script, and the recovered payload is carved as an artifact for AV and triage. Spreadsheet cells are a data channel; no legitimate workbook stages megabytes of executable content this way.
A VBA-bearing workbook cell decodes from Base64 to an HTTP(S) payload URL.
The URL is accepted only after successful Base64 decoding and URL validation; this recovers indirect cell-staged C2/download configuration.
A VBA-bearing BIFF workbook cell decodes from Base64 to an HTTP(S) payload URL.
The scanner walks BIFF SST/cell values and accepts only a successfully decoded, syntactically valid payload URL.
Office / Embedded content
1
All Office / Embedded content heuristics →
Embedded AutoCAD drawings bundled with auto-loading AutoLISP code
critical
OFFICE_PACKAGE_AUTOCAD_AUTOLISP_BUNDLE
An Office OLE Package archive places reserved AutoCAD startup code beside DWG drawings.
AutoCAD can load reserved acad/acaddoc FAS, LSP, or VLX startup files from a drawing's working environment. Bundling one of those executable files beside DWG drawings is a documented AutoCAD malware delivery and propagation pattern. Detection uses archive member names and therefore still works when a newer RAR compression method prevents payload decompression.
Office / Embedded script
1
All Office / Embedded script heuristics →
Word body text contains an entity-escaped MSScriptControl/ActiveX loader with encoded script stages.
Some malicious DOCX files render an HTML/JScript/VBScript loader as ordinary Word text, keeping it outside VBA and relationship scanners. The detector entity-decodes the text, recognizes the cross-language ScriptControl execution chain, decodes bounded Base64/reversed stages, carves them for authenticated preview, and surfaces their active URLs and commands.
Office / HWP
1
An HWP file has a short high-entropy suffix outside declared CFB streams without a recoverable payload structure.
The bytes remain visible for investigation, but an unreferenced opaque suffix is not called executable unless a valid PE/archive/script, loader marker, or active document reference corroborates it.
Office / OLE
13
Auto-exec VBA installs script persistence with schtasks
critical
OLE_VBA_SCHTASKS_SCRIPT_PERSISTENCE
An auto-running macro writes a script and creates a scheduled task for it.
The combined auto-execution, script-write, schtasks /create, and script-interpreter command line form a complete persistence chain.
Auto-executing VBA launches an executable UNC path through Shell, Run, or CreateProcess.
The macro combines an automatic document event with a direct process-launch sink whose target is an executable on an SMB share. This is an actionable execution chain rather than inactive metadata; the target is published as an smb:// IOC for network pivoting.
An XOR-hidden script performs network retrieval, host fingerprinting, remote command evaluation, and result posting.
The decoded slack region combines a COM HTTP client, system identity collection, command decoding/evaluation, and response submission. This is a complete remote-command backdoor chain. Recovered URLs retain their XOR key/source provenance and the JavaScript is preserved for review.
Constant VBA Print/Write statements reconstruct a child script.
The macro opens a script file for output and writes a constant body. The analyzer reconstructs and scans that child independently.
Unallocated OLE bytes decode with a single-byte XOR key to validated script content.
Candidate keys are derived from an encoded ActiveXObject token rather than arbitrary URL brute force. A finding additionally requires multiple COM/network APIs, JavaScript grammar, a printable decoded region, and a valid absolute URL. The decoded script is carved for authenticated review.
Unallocated OLE bytes decode to a CScript command, JavaScript filename, and multiple URLs.
This rule handles exploit-era OLE documents whose XOR-hidden region contains a launch configuration rather than a complete script. Candidate keys must reveal the exact CScript /nologo command form, a JavaScript filename, at least two syntactically valid absolute URLs, and a mostly textual decoded region. The URLs retain their XOR provenance and the decoded configuration is carved for authenticated review.
VBA Base64 literals decode to network locations.
A bounded static decode recovered HTTP(S), FTP(S), or UNC configuration from literals used alongside a VBA Base64 decoder.
An auto-run VBA macro only reconstructs and displays the standard EICAR antivirus test string.
The narrow profile rejects any file, process, network, persistence, object-creation, or dynamic-execution behavior. It distinguishes a harmless antivirus demonstration from a macro that writes or launches EICAR or uses the marker as cover for other behavior.
A legacy Excel HLINK record contains a mailto target.
The analyzer walks BIFF record boundaries and extracts mailto URIs only from structurally valid HLINK records. The target is useful contact and campaign provenance, but ordinary spreadsheet email links are common, so this rule has zero verdict weight.
A legacy Excel HLINK URL-Moniker contains an HTTP, HTTPS, or FTP target.
The analyzer extracts network destinations only from structurally valid BIFF HLINK records, groups repetitive query variants, and retains encoded private downstream services as provenance. Ordinary spreadsheet links are common, so this rule has zero verdict weight.
A legacy Excel SUPBOOK record references an HTTP, HTTPS, or FTP workbook location.
The analyzer parses BIFF record boundaries and decodes UTF-16 external-workbook names, including private-address destinations. These targets are useful provenance but have zero verdict weight because legitimate workbooks can retain historical external links.
Legacy document or printer metadata contains UNC paths.
These paths are retained as zero-weight analyst provenance rather than treated as active retrieval. Separate rules cover executable UNC targets and external relationships.
A Word 0Table/1Table KGWebUrl property contains an HTTP, HTTPS, or FTP target.
The analyzer recovers bounded UTF-16 URLs only when they follow Word's KGWebUrl property marker. The target is document-management or campaign provenance and has zero verdict weight unless another rule proves active retrieval or execution.
Office / OOXML
3
All Office / OOXML heuristics →
A worksheet or XLM formula uses a URL-bearing defined name in a network sink.
The workbook both stores a network URI in a defined name and references that identifier from a formula containing HYPERLINK, WEBSERVICE, or an equivalent network function. This demonstrates active use rather than historical metadata.
An Excel workbook defined name stores an HTTP, HTTPS, or FTP target.
The analyzer parses xl/workbook.xml structurally and decodes XML entities before extracting the target. Reporting integrations can legitimately retain these values, so this rule is searchable, zero-weight provenance unless code or a formula consumes the name.
A printerSettings part retains printable Windows printer-share paths.
Printer drivers commonly preserve server and queue names inside Office documents. These paths are exposed as zero-weight provenance and are kept separate from active external SMB relationships.
Office Macros
21
All Office Macros heuristics →
A character-array XOR decoder reconstructs data that flows to Shell.
Auto-execution plus a custom Chr/Asc/Mid XOR loop and a Shell sink is an obfuscated command loader even when the decoder key is stored in document state and the final IOC cannot be fully recovered.
VBA copies ActiveDocument text to disk and launches the staged path through COM.
The correlated auto-exec, document-body read, Print# file write, and Navigate2/Open/Run sink form a complete drop-and-execute chain. This also catches raw-CLSID Shell.Application indirection without relying on a readable ProgID.
Dangerous API name reassembled from split string literals
critical
OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell) appearing in no single literal.
Splitting an API or ProgID name across string concatenation is done only to evade keyword scanning; the rule keys on the reconstructed token rather than on concatenation density, so benign macro-heavy documents (which concatenate even more) are not flagged.
Macro virus persists through AUTOEXEC.BAT and Normal.dot
critical
OLE_VBA_AUTOEXEC_NORMAL_TEMPLATE_VIRUS
VBA rewrites AUTOEXEC.BAT to replace the global Normal.dot template.
Deleting or renaming Normal.dot during boot so an attacker-controlled template becomes the global Word template is legacy macro-virus persistence, not ordinary document automation.
Auto-exec VBA reconstructs strings with a heavy custom decoder and feeds them to a COM-instantiation or execution sink.
A numeric char-array decoder, repeated hex-string decode, dynamic CreateObject(decoder(...)), or many chained Replace() junk-token reconstructions — combined with an auto-exec entry point and a CreateObject/Shell/exec sink — is the obfuscated-loader shape used to keep indicators out of the macro source.
Raw OLE macro native-memory callback shellcode loader
critical
OLE_RAW_MACRO_NATIVE_MEMORY_CALLBACK_LOADER
Raw OLE/VBA project text exposes an auto-exec entry plus native memory allocation, process-memory write/copy, and callback/timer execution APIs.
Some malicious Office documents are source-stomped or only partially recovered by normal VBA extraction. The raw project bytes still expose the loader triad: allocate memory, copy payload bytes into it, then execute through a callback/timer primitive such as CreateTimerQueueTimer.
OOXML VBA reads a worksheet cell into a URL variable and downloads it.
Some Excel macro droppers keep the payload URL outside the VBA source and read it from a worksheet cell at runtime. Literal macro URL extraction misses these because the URL is stored in sheet XML or sharedStrings.xml. This detector follows the Range("A1").Value assignment into Microsoft.XMLHTTP.Open or URLDownloadToFile and surfaces the resolved cell URL as an IOC.
An auto-running macro passes an executable destination to an HTTP SaveToFile helper and launches the same variable.
This rule follows a destination variable across reachable VBA procedures. A downloader helper writes HTTP ResponseBody through SaveToFile; its caller supplies a variable assigned an executable path; and that same variable reaches Shell. Requiring this variable flow avoids both filename-specific signatures and unrelated project-wide keyword conjunctions.
VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile) — a download-drop dropper even when the COM ProgIDs are built dynamically.
Macro downloaders often hide the MSXML/ADODB ProgID in a variable so the URLDownloadToFile / ProgID keyword rules never fire. The .ResponseBody and .SaveToFile operations still expose the download-and-write chain without those names.
An auto-running VBA macro passes an HTTP text response directly to WScript.Shell.Run or Exec.
The detector correlates object and variable flow within one reachable procedure: a bound XMLHTTP/WinHttpRequest object must issue a request, its responseText/responseStream must be assigned to a variable, and that same variable must reach Run or Exec on a bound WScript.Shell object. This implements a remote-command backdoor. Unrelated HTTP and Shell helpers, binary ResponseBody downloads, and image insertion workflows do not match.
VBA passes a worksheet cell/comment reference to GetObject and drives an Exec/Open/Run sink.
Malware hides the COM moniker and command in cell data (Range().Value / .NoteText) so the macro source carries no literal indicators; the GetObject(cell)+exec shape catches it regardless.
VBA writes Excel-4 (XLM) =CALL() formulas targeting urlmon URLDownloadToFile / Shell32 ShellExecute and runs them.
This VBA-to-XLM bridge downloads and executes a payload while keeping the API names out of normal VBA keyword scanning (the names are split / CHAR-built into cell formulas).
VBA auto-exec macro combines native memory allocation, process-memory write/copy, and callback/timer execution APIs.
In-memory VBA loaders allocate writable memory, copy a decoded payload into it, then transfer control through a callback or timer API such as CreateTimerQueueTimer. Benign document automation does not need the NtAllocateVirtualMemory/NtWriteVirtualMemory/callback triad.
VBA assembles a PowerShell/LOLBin download primitive (Start-BitsTransfer, Invoke-WebRequest, Net.WebClient, bitsadmin, certutil) that fetches a remote payload and then executes it.
Downloader macros split the download cmdlet, URL and command keywords with PowerShell backtick (`) / cmd caret (^) escapes and stage the command to a .cmd/.ps1 that they run via Shell.Application.Open / WScript.Shell. The detection de-escapes the source, then requires a download primitive, a URL, and an execution sink (file-write+run or auto-exec+run).
VBA reads payload content from a UserForm/control property, writes it to disk, and launches it as a script or executable.
Malicious macro builders hide command text or payload bytes in UserForm/control properties such as Caption, Text, Value, Tag, or ControlTipText. The detector requires that hidden source together with a file-write primitive, a script/executable extension or rename, and a process-launch primitive. Together these operations implement a macro dropper; form UI code alone does not match.
VBA resolves a URL-bearing defined name and contains a network or execution sink.
The macro explicitly looks up the named value through Names, Range, or Evaluate and contains a sink such as FollowHyperlink, XMLHTTP, URLDownloadToFile, or Shell. The stored target is surfaced as an IOC.
OOXML VBA reads a worksheet cell as the URL for a download API, but the stored cell does not contain an extractable URI.
The macro has download behavior and the URL source is a worksheet cell rather than a literal string. If that cell is blank or contains non-URL text in the stored workbook, there is no external URI to list as an IOC. This finding explains the dynamic source so analysts know the absence of an extracted URL is due to workbook state, not because the downloader path was missed.
VBA macro opens the Windows hosts file for writing and appends 'address hostname' redirect entries.
The macro opens %SystemRoot%\System32\drivers\etc\hosts for output or append and writes entries mapping a hostname to an address. The redirect is system-wide and survives reboot. Pointed at an attacker-controlled address it silently substitutes a site the user keeps visiting — the Xanpei/Sibhost family did this to Chinese e-commerce domains for affiliate fraud; pointed at 127.0.0.1 it blackholes antivirus and update domains so the infection cannot be cleaned. A document has no legitimate reason to edit the hosts file. Merely naming the path does not fire this rule: a write primitive and a parsed address/hostname entry are both required.
VBA declares/calls a Win32 keystroke-monitoring API (GetAsyncKeyState, SetWindowsHookEx, GetKeyboardState) to capture keystrokes system-wide.
No legitimate document automation polls global key state. These APIs implement a VBA keylogger and are often paired with active-window capture and a log file. The behavior identifies spyware without requiring download or Shell evidence.
OOXML VBA downloads a URL held in a worksheet cell and inserts the result as a picture, with no launch primitive anywhere in the macro.
The macro fetches a URL taken from a worksheet cell and passes the downloaded file to an image sink (Pictures.Insert / Shapes.AddPicture). Office parses those bytes with its image loader and never launches them, and the macro contains no Shell/Run/Exec primitive and no executable or script file target. That is the shape of a legitimate application form — a scholarship, HR or registration template that pulls the applicant's photo from a signed URL pasted into a cell — rather than a download-and-execute dropper. It is reported as a capability so the download is still visible, but it does not on its own establish malicious intent. A dropper that inserts a decoy image still carries its launch primitive and is reported as OOXML_VBA_DYNAMIC_CELL_URL_SOURCE.
VBA macro source contains a globally routable IPv4 address written as a bare dotted quad.
The macro hardcodes a public IP address with no URL scheme around it, so scheme-anchored URL extraction never sees it. Droppers use this to reach a command-and-control host without a resolvable domain — for example writing an FTP command script ("o 203.0.113.10", "user anonymous") and running ftp -s: against it. Private, loopback, link-local, CGNAT and reserved ranges are excluded, and version/build strings such as 16.0.0.0 are filtered out, so a benign macro rarely trips this.
Polyglot
3
A valid image is followed by a large appended overlay that is a second container (PE/ZIP/...) or a loader-delimited base64-encoded payload.
Image-stego-loaders ship a real lure image (often a 4K screenshot) with an encoded or raw payload appended after the image's logical end (JPEG EOI / PNG IEND / GIF trailer). The image renders normally while a loader (AutoIt/.NET, AsyncRAT/njRAT/DCRat family) extracts and runs the hidden PE. Benign images carry at most a few KB of structured slack, never a large executable/archive or a delimiter-marked base64 blob, so this overlay shape has no benign use.
A valid JPEG carries a loader-delimited encoded Windows executable after the JPEG end marker.
The JPEG itself does not exploit an image viewer. Instead, a separate loader reads the rendered lure image as a carrier, locates a marker such as INICIO after the JPEG EOI marker, decodes the hidden MZ/PE payload, and writes or reflectively runs it. Benign JPEG encoders do not append large loader-marked executable payloads after the logical image end.
Polyglot child-content evidence: Polyglot Child PDF Static Triage.
The file contains a child document or payload in a secondary format. The embedded content produced suspicious static-analysis evidence.
RTF / Equation Editor
1
All RTF / Equation Editor heuristics →
RTF objdata contains a half-byte-shifted CFB that realigns to a valid Microsoft Equation 3.0 object.
Attackers can prepend a single hexadecimal nibble so the CFB magic, directory, CLSID, and payload streams no longer occur on byte boundaries. The detector performs bounded realignment only when olefile validates the reconstructed compound file, its root CLSID is Microsoft Equation 3.0, and readable streams exist. It carves the reconstructed OLE and any case-insensitive Ole10Native payload for authenticated inspection and IOC extraction.
Script
13
Windows Script Host content includes execution or obfuscation indicators.
The WSH script contains repeated string construction, encoded data, or shell/COM execution terms associated with script malware.
PowerShell embeds C# P/Invoke code for suspicious WinAPI process/window/shell operations.
The file contains PowerShell Add-Type source that compiles C# with DllImport declarations for multiple Windows APIs used in process memory access, window discovery, or shell notification tampering. This is executable script behavior and should be treated as a Windows script artifact even if the file extension or submitted type claims it is a document.
A shortcut reconstructs a downloader endpoint from large integer arithmetic.
The PowerShell arguments subtract large integer constants and repeatedly take remainder/divide by 256 to rebuild endpoint bytes before passing them to a network retrieval primitive. Detection is bounded and requires the complete arithmetic loop, a valid domain/path result, a script interpreter, and a downloader command.
PowerShell captures the desktop and uploads saved screenshots with WebClient.
The script combines screen capture, bitmap persistence, and WebClient UploadFile using FTP/STOR semantics. Together these operations form a high-confidence screenshot-exfiltration chain.
Hidden PowerShell invokes certutil -decode and rundll32 on the result.
This LOLBin chain materialises an encoded DLL and immediately executes one of its exports.
A Windows script creates COM objects, writes a file, and reaches a shell execution sink.
The complete write-and-execute chain remains high-confidence when computed identifiers obscure exact ProgIDs or URLs.
Scheduled Task XML launches a script interpreter or LOLBin.
The file is a Windows Scheduled Task definition whose Exec action starts a script host or LOLBin such as wscript, cscript, PowerShell, mshta, cmd, rundll32, or regsvr32. This is a persistence/execution artifact, especially when arguments point into user-writable locations such as Users\Public, ProgramData, AppData, or Temp.
WSH/JScript uses XMLDOM Base64 conversion and ADODB.Stream with a large embedded blob.
The conjunction of ActiveX/WSH object creation, binary Base64 conversion, ADODB.Stream and a large encoded payload identifies an embedded binary dropper.
Shell Link arguments launch a script host/LOLBin and retrieve a remote payload.
The scanner parses LNK StringData and UTF-16 ExtraData, then requires both an interpreter/LOLBin and a URL or download primitive.
File bytes contain a base64/gzip shell loader executed with zsh.
The file contains a shell command or embedded shell script that decodes a URL or gzip-compressed stage and executes it with zsh. The decoded stage is treated as malware when it retrieves and executes AppleScript via osascript, posts host/locale telemetry, or uses geofencing logic. The detector runs across submitted file types because this loader can be carried by a misnamed document, script, HTML, RTF body, or wrapper.
A large near-single-line script hides behavior behind rotated string tables and character-code decoding.
This combination is substantially stronger than ordinary minification but remains suspicious until a concrete payload behavior is recovered.
File contains Windows Script Host code while masquerading as a document.
WScript/CScript content can execute directly on Windows. When it is submitted with a document-like name or extension, it is a common attachment masquerade pattern.
LNK launches a script host with hidden or reduced-interaction flags.
Hidden PowerShell/script-host execution is a common shortcut-phishing technique and corroborates a downloader chain.
Social Engineering
37
All Social Engineering heuristics →
Document contains lottery/beneficiary, large-value funds, and claim/contact/payment instructions.
The rule requires multiple independent fraud-letter cues: beneficiary or lottery/prize language, large-value draft/funds wording, and claim, contact, payment-bureau, or courier instructions. This is the classic advance-fee scam shape and is stronger than generic prize wording alone.
Document combines fake CAPTCHA language with instructions to paste or run a command.
The document presents a CAPTCHA or human-verification frame and instructs the user to run a command through Win+R, Ctrl+V, PowerShell, cmd, mshta, or a comparable execution path. A CAPTCHA reference alone does not match.
A fake police notice threatens sexual-crime prosecution and supplies a free-mail contact.
Official judicial notices do not route responses about arrest threats through consumer webmail. The rule requires both law-enforcement impersonation and coercive criminal accusations.
A PDF combines a payment charge, dispute/cancellation language, and a callback number.
Invoice and cryptocurrency callback scams are inert documents whose payload is the telephone conversation. Requiring context, an amount, and a dialable number avoids treating ordinary contact details as malicious.
Document requests recovery phrases, private keys, backup codes, or saved passwords.
The rule matches requests for seed phrases, private keys, backup codes, or saved passwords. These are recovery secrets; asking for them inside a document is a high-risk signal.
A security-product invoice directs an unauthorized-charge callback to a phone number.
The detector requires a consumer security brand, a monetary charge, invoice or renewal language, an unauthorized-charge or refund directive, and a dialable callback number.
Document uses viral-video lure text and links to a suspicious disposable-looking host.
The rule combines viral or leaked-video lure wording with a URL on a disposable-looking host or TLD. This catches PDF traffic-scam/clickbait carriers while avoiding ordinary PDFs that merely discuss video content or link to established media sites.
Document impersonates a well-known consumer brand and uses account-security language to drive the reader to a credential-harvesting link.
The rule fires when a brand name (Amazon, PayPal, Apple, Microsoft, a bank, etc.) appears together with account-security / verification lure language ("unusual activity", "account on hold", "verify your account", "restore access") AND at least one corroborator: lure text written with homoglyph letter swaps (capital 'I' for lowercase 'l', e.g. "hoId", "unusuaI" — a deliberate keyword-filter evasion), an action link to an abused app-hosting / redirector service (Google Apps Script /macros/.../exec, *.web.app, *.workers.dev, Google Forms), or a call-to-action link whose host does not match the impersonated brand's own domain. Requiring a corroborator keeps legitimate brand notices — which link to the real domain and spell their words normally — from tripping it. Critical when the link points at an abused redirector or two corroborators are present.
Document tells the user to install a browser extension, plugin, viewer, or update.
The rule matches instructions to install a browser extension, plugin, viewer, or browser update to read the document. This is high-risk in an unsolicited file because fake updates and extensions are common malware delivery paths.
Document instructs the user to press Win+R and paste or run a command.
ClickFix lures ask the user to open the Run dialog or a shell and paste a command, usually PowerShell or cmd. The rule looks for those instructions in document text. It is high-risk because the command is supplied by the lure, not because an exploit is present.
Document tells the user to copy or paste clipboard content into a command context.
The rule matches clipboard, copy, paste, or Ctrl+V instructions near Run, PowerShell, cmd, terminal, mshta, regsvr32, or similar execution contexts. That combination is uncommon in ordinary documents and is typical of ClickFix-style social engineering.
A credential or document-share lure whose every external link resolves to a non-reputable host, at least one of them disposable free hosting.
The image-only carrier already correlated its lure with link reputation (PDF_IMAGE_LURE_NONREPUTABLE_LINK); the text carrier did not, so a phishing document that spells its lure out in real text scored on the lure alone and stayed under the malicious threshold. Measured examples: a Spanish 'confidentiality agreement' share notice pointing at spai.secureddocz.workers.dev scored 24 (CLEAN), and an SSA impersonation pointing at an Okta-lookalike path on a tenant subdomain scored 52. Neither half convicts alone — lure wording is common in genuine workflow documents, and throwaway hosts are common in developer previews — but a lure whose only destinations are non-reputable, with at least one on disposable infrastructure, is the phishing carrier shape. HIGH so conviction still rests on two independent signals.
Document displays a fake CAPTCHA or robot-verification prompt.
The rule matches CAPTCHA or human-verification phrases ('verify you are not a robot', 'complete the verification', etc.) in document text. In malicious lures this is typically the framing for a ClickFix-style step that asks the user to paste a command, but the rule fires on the verification language alone.
Document combines browser/security-check language with instructions to run a command.
The rule looks for browser check, connection verification, or security verification language together with a command-running step. This catches fake browser checks that use the same ClickFix workflow without saying CAPTCHA.
Document claims to be encrypted/protected and steers the reader to a deceptive 'secure view' link.
The secure-document phishing carrier: the page claims the file is encrypted or protected by a secure service ("this document is encrypted using …", "click below to securely view") and the action link uses deceptive infrastructure — a destination host whose first DNS label is literally 'http'/'https' (e.g. 'https.file-transfers.example.com'), or an abused app-hosting/redirector service. Legitimate secure-mail gateways use similar wording but link to their own honest domains, so the lure text alone never fires; the deceptive-link corroborator is required.
Document impersonates a government agency and uses identity/benefits-verification coercion to drive the reader to a non-.gov link.
The rule fires when a government-agency identity (Social Security Administration, IRS, Medicare/Medicaid, US Treasury, HMRC, DWP, USCIS, Service Canada, etc.) appears together with identity/benefits-verification coercion language ("identity verification required", "this review is mandatory", "temporary account restrictions", "failure to verify") AND the document's action link is NOT an official .gov/.mil destination. A genuine agency notice links to its own government domain, so the non-gov link is the phishing tell that keeps false positives near zero.
Invoice/payment document routes remittance contact through a consumer webmail domain.
Legitimate vendor invoices can include payment instructions, but a bank-transfer or remittance workflow that points to generic consumer webmail (for example gmail.com, outlook.com, mail.com, or post.com) is a strong business-email-compromise indicator, especially when the document impersonates a named organisation.
Extracted document text contains a Windows execution tool name within 220 characters of a dangerous flag, command verb, or URL.
The rule matches the name of a script/execution tool (PowerShell, cmd, mshta, rundll32, regsvr32, wscript, cscript, certutil, bitsadmin, curl, wget) within 220 characters of a dangerous flag (-enc, downloadstring, iex, /i:, javascript:, vbscript:) or a URL. This catches two distinct shapes: (1) a visible 'run this' instruction in HTML/PDF/RTF lure bodies, where the matched span really is the command a victim is asked to run; and (2) macro-laden Office files where the macro's own string-pool entries (CreateObject names, action verbs, payload URLs) end up adjacent in the extracted text. The detail field shows the head and tail of the matched span so an analyst can tell which case applies.
Document asks for an MFA, OTP, authenticator, or one-time passcode action.
The rule matches requests for MFA, OTP, authenticator, one-time code, or push approval actions. Documents that ask for these actions should be reviewed carefully, especially when combined with credential or account language.
Document gives password instructions for an archive or attachment.
The rule matches password instructions near archive or attachment language. Encrypted archives are often used to keep gateway scanners from inspecting the payload before the recipient extracts it.
Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions.
The rule matches text about changed bank, wire, ACH, IBAN, SWIFT, or routing details. This is a high-value business email compromise pattern, but it still needs business-context review.
Document asks the user to scan a QR code for HR, payroll, compensation, signing, or policy workflow.
Business-process QR lures move the malicious destination into the QR image, where normal URL extraction cannot see it. The rule requires both QR-scan language and HR, payroll, compensation, employee-handbook, DocuSign, or signature wording, and the two must appear within 800 bytes of each other so a long benign report that prints a QR code in one section and discusses HR in another does not match. The finding reports how far apart the two cues were.
Document asks the user to share a support code or allow remote control.
The rule matches remote-support tools such as AnyDesk, TeamViewer, Quick Assist, ScreenConnect, or Splashtop near requests for a session code, support code, connection ID, or permission to control the machine.
Document instructs the user to install or open remote-support software.
The rule matches instructions to install or open remote-support tools such as AnyDesk, TeamViewer, Quick Assist, ScreenConnect, or Splashtop. This is high-risk in an unsolicited document because it can lead to interactive control of the machine.
Document instructs the user to disable antivirus or security software.
The rule matches instructions to disable antivirus, security tools, or protections before opening content. That request is unusual for ordinary documents and should be treated as high-risk.
Document impersonates a file-sharing notification and its only action is to click a rendered button/link to 'access the document'.
The rule fires when a document's extracted text contains BOTH a file-share impersonation claim ("… shared a secured file with you", "you have received a secure document") AND a call-to-action to click a button or link to access / view the document. This is the SharePoint/OneDrive consent-phishing template: the click target is typically a flattened image with no extractable URL, so link-based lure rules never see it. Requiring BOTH phrases together keeps false positives near zero — a benign document almost never carries both. Note: the incriminating text often lives in a DrawingML textbox ("<a:t>" shape runs), so the OOXML text extractor now reads drawing parts as well.
Document repeats phone numbers in airline, travel, refund, or support-scam wording.
Travel-support scam PDFs use repeated phone numbers and airline/refund/support phrases to rank in search results and route victims to attacker-controlled call centers. The rule requires multiple phone hits plus travel/support terminology and repeated call-language stuffing. A single phone number in an itinerary or invoice does not satisfy these conditions.
Document asks the user to call a phone number in a finance or security context.
The rule matches phone-call instructions in finance, renewal, refund, fraud, or account-security contexts. Callback phishing commonly starts this way, but some legitimate notices also use phone numbers.
Document impersonates a cloud file-sharing or collaboration service.
The rule matches cloud-file service names such as SharePoint, OneDrive, Google Drive, Dropbox, Box, Teams, or Microsoft 365 in a verify-to-view or secure-document context. Real sharing workflows can look similar, so use this as supporting evidence.
Document impersonates DocuSign, Adobe Sign, or similar service to lure users.
The rule matches visible references to e-signature services such as DocuSign or Adobe Sign in a signing-request context. This is common in phishing, but real signature workflows can use the same names, so the service reference is supporting evidence rather than proof.
Document impersonates a file-sharing notification ('a new document has been shared with you').
Consent-phishing and credential-harvest PDFs open with a file-share notification and put the real destination behind a button image. Legitimate share notices use the same wording, so the detector stays MEDIUM on its own; it is intended as the lure half of a composite that also requires an outbound link on a non-reputable host. The phrases are matched against a whitespace-removed copy of the text as well, because this family is usually rendered glyph-by-glyph.
Document instructs the user to enable macros or editing.
Macro malware often uses fake preview text or security-warning language to push the user toward 'Enable Content' or 'Enable Macros'. This finding means the document contains that kind of instruction; it does not prove the macros are malicious by itself.
Document instructs the user to scan a QR code, likely as an off-band phishing vector.
The rule matches instructions to scan a QR code to view, verify, or access a document. QR codes are common in legitimate material, but these access-oriented phrases are useful supporting evidence for QR phishing.
Document contains invoice or payment language paired with an action instruction.
The rule matches invoice or payment language paired with an action such as open, download, review, or click. Genuine invoices use the same vocabulary, so this finding is mainly useful when paired with macro, link, or attachment indicators.
Document contains urgency or deadline language to pressure the user into acting.
The rule matches deadline and account-pressure phrases such as 'final notice' or 'action required within 24 hours'. This language is common in both phishing and legitimate billing, legal, and account notices, so it is low-signal on its own.
Document contains a call-to-action phrase ('Click here to download', etc.).
The rule matches call-to-action text such as 'Download Now' or 'Open Document'. That wording is common in manuals and setup guides, so this is low-signal unless other findings point to a malicious workflow.
HTML presents commands in a security-research or proof-of-concept context.
Localhost, CVE/project references, multiple citations, and explanatory prose distinguish quoted research commands from a run-this social-engineering lure.
Social engineering
13
All Social engineering heuristics →
A Booking.com guest-complaint lure sends its review action to an unrelated domain.
The rule requires the brand, hospitality complaint context, a complaint-review CTA, and an off-domain destination.
An Adobe/PDF compatibility prompt links to an installer or remote-management agent.
Requires component-failure language plus an executable or RMM delivery endpoint.
An embedded QR URL is paired with a scan/sign-in/document-access lure.
The scanner decodes bounded OOXML media with zxing-cpp and requires visible credential or document-access context before asserting phishing.
An unauthorized-payment callback lure contains unresolved campaign placeholders.
Multiple victim, amount, support-label, and phone placeholders identify operational scam-kit source before final rendering.
A branded account-lock or payment warning uses a non-brand destination.
Account suspension and payment urgency paired with a mismatched action URL is a credential or payment-phishing pattern.
An image-heavy PDF repeats a machine-readable decoy layer while redirecting externally.
Repeated decoy prose hides the rasterized call-to-action from text-based inspection while preserving an external click target.
An image-only document carrier links to a host named like a review, signing, or sharing service.
Established DocuSign, Microsoft, SharePoint, Canva, Dropbox, and Google domains are excluded; a generic image link is insufficient without document-workflow naming on the destination host.
A localized download/view instruction points to object storage or an unrelated host.
The PDF acts as a social-engineering doorway while the external site performs the next stage.
A content-free view/open-document carrier links through tracking, preview, or user hosting.
Requires near-empty rendered text, a document-view CTA, and one actionable external redirect.
A PDF link hides a different destination host behind multiple percent-encoding layers.
The rule requires a redirect parameter, at least two encoded layers, and a registrable host change; ordinary encoded query values do not match.
A request-for-proposal CTA uses an external form or document workflow.
Procurement phishing uses plausible supplier invitations; an unrelated sender and destination domain makes the workflow mismatch high confidence.
A utility overpayment or refund notice directs the recipient to unrelated hosting.
Utility branding, refund language, and a mismatched actionable destination form a phishing pattern.
A nearly empty PDF says an article moved and supplies one external action.
This is typically an abusive traffic doorway; it is suspicious but does not imply embedded code execution.
Suspicious
2
PDF JavaScript combines app.addToolButton(), app.removeToolButton(), heap-spray arrays, and unescape('%u...') shellcode markers.
The ToolButton lifecycle calls, heap-spray arrays, and encoded shellcode form an Adobe Reader use-after-free exploitation pattern. The broad API and heap-spray conjunction is intentionally not assigned to one CVE because it does not distinguish CVE-2013-3346 from later Reader object-lifetime bugs.
PDF JavaScript constructs a hidden second stage through a JSFuck primitive table and the Function constructor.
The scanner evaluates only a bounded, inert subset of the JSFuck character-construction grammar and never executes JavaScript. Deriving Function and supplying it with a large dynamically assembled body is a strong exploit-stager signal in PDF JavaScript.
Webshell
4
The file contains PHP code with the signature of a webshell/backdoor (request input fed to a command/code-exec sink, or a named-shell banner).
A webshell takes attacker input from an HTTP request and runs commands or code on the server (RCE). It is flagged as a malicious hacktool artifact even when carried inside a document or archive (e.g. a c99/Locus7s PHP shell pasted into an RTF) — the code does not run from the carrier, but the file IS a webshell. Detection requires a multi-token combination (script tag + request input + exec sink, a decoder/second sink, or a distinctive named-shell banner) so ordinary server code does not false-positive.
The file contains ASP webshell code (eval/Execute over Request input, or WScript.Shell.Run of request data).
Classic ASP server-side remote-command-execution backdoor source — attacker-supplied Request data is passed to eval/Execute or a shell.
The file contains JSP webshell code (Runtime.exec / ProcessBuilder driven by a request parameter).
JSP server-side remote-command-execution backdoor source — a request parameter is passed to Runtime.exec / ProcessBuilder to run commands.
A distinctive named-webshell marker (c99shell/r57/WSO/b374k/Locus7s/…) was found without surrounding script context.
A named-webshell identifier string appeared but no script body was matched around it (e.g. the marker sits in a binary or document). Surfaced at medium for review as a likely hacktool artifact; the bare 3-char forms (c99/r57) are deliberately excluded to avoid coincidental substring matches in large binaries.