Malicious PDF — malware analysis report

Static analysis result for SHA-256 1bf8dc99d05ef723…

MALICIOUS

PDF

250.1 KB First seen: 2026-05-11
MD5: b72e1b6b7123b9c854c9e2c21a05baf9 SHA-1: b5b34168a962c6ae8a9a5ea79d5dce19edeae954 SHA-256: 1bf8dc99d05ef7237a98f595bce5976a9370c1e155603333fbedb26a22a9418c
110 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9945

Heuristics 2

  • VBScript-style decimal byte array decodes to a PE payload critical PDF_VBS_DECIMAL_ARRAY_PE_PAYLOAD
    PDF comment text contains a VB/VBScript-style decimal byte array, such as c(077),c(090), that decodes to a verified Windows PE executable. The rule is gated on a comment-line Array(c(...)) assignment and a valid MZ/PE header to keep false positives low.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
decimal_array_pdf_pe_00000229.exe embedded-pe PDF raw comment decimal-array PE payload at offset 0x229 2191 bytes
SHA-256: 4629a0cf653bfbe133954d5ffd25fd86e852394ad9dbd412cd587f10941051ef
Detection
ClamAV: No threats found
Obfuscation or payload: likely
actual_type=PE; declared_or_context_type=PDF; filename=decimal_array_pdf_pe_00000229.exe; kind=embedded-pe