| Original | +5 | |----------|----| | r → w | | z → e | | h → m | | (space) | | r → w | | b → g | | y → d | | n → s | | – | | s → x | | w → b | | d → i | | w → b | | t → y | | (space) | | w → b | | s → x | | q → v | | r → w | | y → d | | m → r |
| Step | Observation | Screenshot | |------|-------------|------------| | | PDF document, version 1.6 | ![file-header] | | Metadata | Creator: Microsoft Word ; Producer: AcroPDF ; CreationDate: 2023‑11‑02T08:13:00Z | ![metadata] | | Objects | /JavaScript object found in page 3 ( /AA << /O << /JS (app.alert('Gotcha')) >> >> ) | ![object] | | Embedded file | payload.exe (size 24 KB) extracted via binwalk | ![embedded] | | VirusTotal | 98/100 AV engines flagged as Trojan.GenericKD.3214 | ![vt] | rzh rbyn - swdwt wsqrym.pdf
| | What it usually means | |------------|---------------------------| | Obfuscation | The sender wants to hide the real purpose (e.g., phishing, ransomware). | | Automation | A script generated the file and gave it a hash‑like name. | | Puzzle / ARG | An Alternate Reality Game (ARG) where the title is a clue. | | Simple typo | A human error—nothing sinister at all. | | Original | +5 | |----------|----| | r