PDF malware analysis — malicious · 05160a05b82be6dc

MALICIOUS

PDF

244.6 KB

MD5: a49ddbe5d2576ce39af923f39c9c0f91 SHA-1: 1d16f3a10aecc6ad11cbffdf4cf9cc601c42e21f SHA-256: 05160a05b82be6dcee11cc60bd230e8abbaf5abff50e27e87ef00c68bf9d8f73

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a VBScript-style decimal array that decodes to a PE payload, indicating an attempt to deliver an executable. The ML classifier also flagged this PDF as malicious. The embedded PE artifact is the primary indicator of malicious intent, likely intended to be executed by the user.

Machine Learning

Nyx PDF Classifier malicious score 0.9948

Heuristics 2

VBScript-style decimal byte array decodes to a PE payload critical PDF_VBS_DECIMAL_ARRAY_PE_PAYLOAD

PDF comment text contains a VB/VBScript-style decimal byte array, such as c(077),c(090), that decodes to a verified Windows PE executable. The rule is gated on a comment-line Array(c(...)) assignment and a valid MZ/PE header to keep false positives low.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`decimal_array_pdf_pe_00000229.exe` `7a3e16aabbfdde2a0e590f3d98d436fd4bfb6863c779b92ee19b847a2231e2a6`	embedded-pe	PDF raw comment decimal-array PE payload at offset 0x229	8048 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.49, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.