MALICIOUS
108
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
T1566.001 Spearphishing Attachment
This PDF document contains a launch action that executes calc.exe, indicating an attempt to exploit a vulnerability or trick the user into running a program. The embedded URL, while local, suggests potential command and control or payload delivery infrastructure. The presence of JavaScript further supports malicious intent, likely to facilitate the execution of the launched application.
Heuristics 4
-
Launch action critical PDF_LAUNCHPDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
-
/Launch action target: calc.exe high PDF_LAUNCH_COMMANDPDF /Launch action specifies an executable target.
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://192.168.0.199
Open this report in the interactive analyzer, or submit your own file for analysis.