PDF malware analysis — malicious · 43e793b42f40af2b

MALICIOUS

PDF

66.7 KB First seen: 2026-06-11

MD5: f5e50ab9355419efbf4b1b2ea5035dd3 SHA-1: 83eb5b97d3331b5e805f7094f84c3b0dd1977f5d SHA-256: 43e793b42f40af2bdc9883f66d870c1f1bdb969705137a792c6b5ba3bd2dc8e7

130 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.9952

Heuristics 2

Base64-encoded Windows executable payload in PDF critical PDF_BASE64_PE_PAYLOAD

PDF text contains a long base64 blob that decodes to a verified Windows PE executable. This catches payloads hidden after EOF, inside comments, or in plain text outside normal PDF streams.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`base64_pdf_pe_00000284.exe`	embedded-pe	PDF raw base64 PE payload at offset 0x284	50688 bytes
SHA-256: `9eba7a77b4348c3de253c93b6f0d9fb99915bbe14d7fb2e8203abb1fe12c47b0`
Detection ClamAV: No threats found Obfuscation or payload: likely actual_type=PE; declared_or_context_type=PDF; filename=base64_pdf_pe_00000284.exe; kind=embedded-pe Static shellcode analysis recovered command string(s): PowerShell

Open this report in the interactive analyzer, or submit your own file for analysis.