Malicious PDF — malware analysis report

Static analysis result for SHA-256 13c1d8c156b229d0…

MALICIOUS

PDF

69.5 KB
MD5: 965a1f0f30681c33224ee739f6217776 SHA-1: a3b7749b3bce87431710579560080168af8ef547 SHA-256: 13c1d8c156b229d06a86155320e176914ec9d40e17208d42f72e41c0a389bf75
100 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The PDF file contains a Base64-encoded PE payload, which is a strong indicator of malicious intent. The payload is likely designed to be decoded and executed using process injection techniques, as suggested by the presence of APIs like VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9952

Heuristics 1

  • Base64-encoded Windows executable payload in PDF critical PDF_BASE64_PE_PAYLOAD
    PDF text contains a long base64 blob that decodes to a verified Windows PE executable. This catches payloads hidden after EOF, inside comments, or in plain text outside normal PDF streams.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
base64_pdf_pe_000002fe.exe
cac25a0c85ff0522a7105b86ac53326b6c5a8b9031d9ab76d5f39249c561bd20		 embedded-pe PDF raw base64 PE payload at offset 0x2FE 52736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.