PDF malware analysis — malicious · 334091e25c6f7e62

MALICIOUS

PDF

69.5 KB

MD5: acebe629b635ae96109fd1048c54eaa4 SHA-1: a49c0bd5331ebd69ac9e4216b21d9f035c680048 SHA-256: 334091e25c6f7e62423da852986a21b63406e912178393a77c04cc781cba85fd

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1055.012 Process Hollowing

The PDF file contains a Base64-encoded PE payload. The heuristic indicates the payload is decoded and likely executed using process injection APIs such as VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. The embedded executable's SHA256 hash is identified as a high-priority IOC.

Heuristics 1

Base64-encoded Windows executable payload in PDF critical PDF_BASE64_PE_PAYLOAD

PDF text contains a long base64 blob that decodes to a verified Windows PE executable. This catches payloads hidden after EOF, inside comments, or in plain text outside normal PDF streams.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`base64_pdf_pe_000002fe.exe` `cac25a0c85ff0522a7105b86ac53326b6c5a8b9031d9ab76d5f39249c561bd20`	embedded-pe	PDF raw base64 PE payload at offset 0x2FE	52736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.