Malicious PDF — malware analysis report

Static analysis result for SHA-256 0448fee82b8bbe29…

MALICIOUS

PDF

705 B
MD5: b3519adcd2ec4a13bbf569f0865bfe79 SHA-1: aa2e590d111c32cc5aebd9003a825c16bf51b258 SHA-256: 0448fee82b8bbe293dbb54c50bf813d5644a2e0b67aa07ff8261ea25b41f7735
130 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The PDF contains a launch action that directly executes cmd.exe. This is a common technique for exploiting vulnerabilities in PDF readers to achieve arbitrary code execution. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 2

  • /Launch action target: "cmd.exe" critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target — references a known-dangerous executable (cmd, PowerShell, etc.).
  • Launch action high PDF_LAUNCH
    PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous

Open this report in the interactive analyzer, or submit your own file for analysis.