PDF malware analysis — malicious · 3fbef5d72fd25c7d

MALICIOUS

PDF

34.2 KB

MD5: bd70bab72e85e0196e3fb0de45b4cee7 SHA-1: 1fc751c13b718dce4c145fdb1b1dd9559d60d581 SHA-256: 3fbef5d72fd25c7d7e20ebe356173cbf0e5aea47e316e895708a950eda063771

74 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: Malicious File

The PDF contains embedded JavaScript and uses filters like ASCIIHexDecode and ASCII85Decode, which are commonly used to obfuscate malicious code within PDF documents. The ML classifier strongly indicates malicious intent. The primary attack vector appears to be exploiting a PDF vulnerability to execute arbitrary code via JavaScript.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85

ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation

Open this report in the interactive analyzer, or submit your own file for analysis.