文件类型识别

Invoice_0425.pdf.html
<html><body><script>
var data = atob('UEsDBBQAAAAIAA==');
var blob = new Blob([data], {type: 'application/zip'});
var a = document.createElement('a');
a.href = URL.createObjectURL(blob);
a.download = 'Invoice_0425.zip';
a.click();
</script></body></html>

Invoice_0425.pdf.html

254 B (254 bytes) · read 254 B

DETECTED TYPE
HTML document
KIND
web page text/html
EXTENSION
.html matches

.html fits HTML document.

Danger: HTML smuggling pattern: script decodes embedded data and offers it as a download (Blob/atob/msSaveOrOpenBlob).
Warning: Double extension: ".pdf" is decoration, the real extension is ".html" (a web page posing as a document, typical of phishing attachments).
Text encoding
UTF-8 or ASCII
Script and form hints
script element; atob() Base64 decoding; Blob construction; URL.createObjectURL(); forced download (download attribute)
FIRST 64 BYTES
0000  3C 68 74 6D 6C 3E 3C 62  6F 64 79 3E 3C 73 63 72  <html><body><scr
0010  69 70 74 3E 0A 76 61 72  20 64 61 74 61 20 3D 20  ipt>.var data =
0020  61 74 6F 62 28 27 55 45  73 44 42 42 51 41 41 41  atob('UEsDBBQAAA
0030  41 49 41 41 3D 3D 27 29  3B 0A 76 61 72 20 62 6C  AIAA==');.var bl
Copy hex dump

Next: HTML Attachment Analyzer (inspect scripts, forms and embedded payloads); File Hash Calculator (hash the file for VirusTotal and MalwareBazaar lookups). Open it and drop the same file there.