PDF malware analysis — malicious · 0a601e60b210a882

MALICIOUS

PDF

27.4 KB

MD5: e6a896273ce49b6e3a136db315d63d38 SHA-1: c4e0a9b671ab85572eb2f4e4917db8bc2a982728 SHA-256: 0a601e60b210a882cc7e2b21e788fab1974a45af956f9ac1461ebc139d7590ed

74 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript and utilizes filters like ASCIIHexDecode and ASCII85Decode, indicating an attempt to obfuscate malicious code. The ML classifier strongly suggests malicious intent, likely to exploit a client-side vulnerability for code execution. No specific family is identifiable from the available evidence.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85

ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation

Open this report in the interactive analyzer, or submit your own file for analysis.