PDF malware analysis — malicious · 125726d3e93bb3fd

MALICIOUS

PDF

244.6 KB

MD5: 938336e52aa37117cc47388e4aa92dae SHA-1: ef67947b1f29473cc01ab1fd2bd3a2f49ec38af2 SHA-256: 125726d3e93bb3fd3b09487f1faa601c2da74126a73d492eec8cc9922559cc6f

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a VBScript-style decimal array that decodes to a PE payload, indicating an attempt to deliver an executable. The ML classifier also flagged the PDF as malicious. The embedded executable, identified by its SHA256 hash, is the primary indicator of malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9956

Heuristics 2

VBScript-style decimal byte array decodes to a PE payload critical PDF_VBS_DECIMAL_ARRAY_PE_PAYLOAD

PDF comment text contains a VB/VBScript-style decimal byte array, such as c(077),c(090), that decodes to a verified Windows PE executable. The rule is gated on a comment-line Array(c(...)) assignment and a valid MZ/PE header to keep false positives low.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`decimal_array_pdf_pe_00000229.exe` `9c8ef8e58b70da7ed70929caeb6df8a6c7a5bc80aa93218ed8eaee6f4a54416e`	embedded-pe	PDF raw comment decimal-array PE payload at offset 0x229	30821 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.89, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.