Malicious PDF — malware analysis report

Static analysis result for SHA-256 3ad10eaaf1e3994d…

MALICIOUS

PDF

28.5 KB
MD5: a823e8b74746e14c34c0d1b217bfc10f SHA-1: 6558fb7d7714d3b2bd436651c68acdec63fa2b52 SHA-256: 3ad10eaaf1e3994d2791b02bce15f85f91044211685a71104ca6551b0b53d92e
86 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: User Execution: Malicious Attachment T1566.002 Phishing: Spearphishing Attachment

The PDF file was flagged as malicious by an ML classifier with high confidence. It contains embedded files and scripts, indicating it's likely a delivery mechanism for further malicious activity. The presence of XFA form elements and embedded content suggests an attempt to exploit PDF vulnerabilities or trick the user into executing embedded payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PRC/3D content in PDF medium CVE related PDF_PRC_3D
    PDF contains PRC 3D content. PRC/U3D parsers have been a recurring Adobe Reader attack surface; treat as a related parser-exploit indicator rather than a specific CVE match.
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/1.0/
    • http://www.xfa.org/schema/xfa-template/2.5/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0002.bin
0a2224c4023b216235b61c3fc4dd17bbfac1ab23a545687f51b97604cf654712		 pdf-embedded-file PDF EmbeddedFile object 2 at offset 0xCA 46 bytes
embedded_file_obj0008.bin
24c130f03a4cf51d470b536e94c1e58af67665739e200e0ce198ad41086243c0		 pdf-embedded-file PDF EmbeddedFile object 8 at offset 0x153 228 bytes
embedded_file_obj0001.bin
b09d6a0ed949a1b735d3ad5f7a95384d4b33942b4cb4d41fcf60f342f124ec1f		 pdf-embedded-file PDF EmbeddedFile object 1 at offset 0x529 27239 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.