PDF malware analysis — malicious · 049953b9ce4898c2

MALICIOUS

PDF

69.5 KB

MD5: 35469d3abe104ee63d5ad363ec25df21 SHA-1: 2f9fa1ac32bed14276a57cb3f05e62f410cbf1b1 SHA-256: 049953b9ce4898c20ace0954c320909d07cdfe7055b69863a27dc7a2d205ce0c

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The PDF file contains a Base64-encoded PE executable payload. The heuristic 'PDF_BASE64_PE_PAYLOAD' indicates that this payload is likely decoded and executed using process injection APIs such as VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. The ML classifier also strongly suggests maliciousness. The decoded executable's SHA256 hash is provided as an IOC.

Machine Learning

Nyx PDF Classifier malicious score 0.9952

Heuristics 1

Base64-encoded Windows executable payload in PDF critical PDF_BASE64_PE_PAYLOAD

PDF text contains a long base64 blob that decodes to a verified Windows PE executable. This catches payloads hidden after EOF, inside comments, or in plain text outside normal PDF streams.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`base64_pdf_pe_000002fe.exe` `cac25a0c85ff0522a7105b86ac53326b6c5a8b9031d9ab76d5f39249c561bd20`	embedded-pe	PDF raw base64 PE payload at offset 0x2FE	52736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.