PDF malware analysis — malicious · 310df94c8db39ba0

MALICIOUS

PDF

6.6 KB

MD5: e2b88030a62aea34542f157d495fd891 SHA-1: 4477235656cbf6eae25e7a66972033a3b9dc5ab3 SHA-256: 310df94c8db39ba0748d733052b805b86442efb437944a67dd76c53645fe0a80

74 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: Malicious JavaScript

The PDF contains embedded JavaScript and utilizes ASCIIHexDecode and ASCII85Decode filters, which are commonly used to obfuscate malicious code within PDF documents. The ML classifier strongly indicates malicious intent. While no specific URLs or hashes were extracted, the presence of these obfuscation techniques and embedded JavaScript suggests the PDF is likely intended to exploit a vulnerability and execute a malicious payload.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85

ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation

Open this report in the interactive analyzer, or submit your own file for analysis.