MALICIOUS
60
Risk Score
Malware Insights
MITRE ATT&CK
T1105 Ingress Tool Transfer
The PDF file was identified as malicious due to a critical heuristic firing for a hidden ZIP payload containing executable DLLs. This indicates the PDF is likely acting as a container to deliver secondary malicious components. The presence of multiple DLLs within the archive suggests a multi-stage attack or a collection of tools.
Machine Learning
- Nyx PDF Classifier clean score 0.0253
Heuristics 1
-
Hidden ZIP payload with executable entries inside PDF stream critical PDF_HIDDEN_ZIP_EXECUTABLE_PAYLOADPDF stream bytes contain an embedded ZIP archive whose local headers name executable payload files. This is not a normal PDF attachment (/EmbeddedFile); it hides Windows payloads inside an ordinary stream, a strong malware-loader or smuggling pattern.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
hidden_pdf_zip_off00000048.zip626dcee43632b01f34a2ef935b9fe2abfac47208f89c27ffc95b081bd294e43a |
pdf-hidden-zip | PDF raw stream ZIP payload at offset 0x48 | 601662 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.