MALICIOUS
60
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1566.002 Spearphishing Attachment
The PDF file is encrypted and contains JavaScript, as indicated by the PDF_ENCRYPTED_WITH_JS heuristic. This suggests the document is designed to conceal its malicious payload from static analysis. The high number of streams (PDF_MANY_STREAMS) further points to obfuscation techniques. The combination of encryption and JavaScript points to a likely delivery mechanism for a secondary stage, possibly involving a downloader or exploit.
Machine Learning
- Nyx PDF Classifier clean score 0.0027
Heuristics 2
-
Encrypted PDF carries /js — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JSPDF declares /Encrypt and also references an executable trigger (/js). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
-
Unusually high stream count medium PDF_MANY_STREAMSPDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
Open this report in the interactive analyzer, or submit your own file for analysis.