Malicious PDF — malware analysis report

Static analysis result for SHA-256 2454025f396d29f8…

MALICIOUS

PDF

69.5 KB
MD5: 04c54199a76dc90f544744132f976f67 SHA-1: bbf9c598e0261fa772b59064ca4c502cf78df211 SHA-256: 2454025f396d29f888b188c47b8ceb2f06259757cc81fc5b42e14834c5a132b4
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1055 Process Injection

The PDF document contains a Base64-encoded Windows executable payload. The heuristic indicates that this payload is decoded and executed using process injection APIs such as VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. The embedded executable's SHA256 hash is identified as a key indicator of compromise.

Heuristics 1

  • Base64-encoded Windows executable payload in PDF critical PDF_BASE64_PE_PAYLOAD
    PDF text contains a long base64 blob that decodes to a verified Windows PE executable. This catches payloads hidden after EOF, inside comments, or in plain text outside normal PDF streams.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
base64_pdf_pe_000002fe.exe
cac25a0c85ff0522a7105b86ac53326b6c5a8b9031d9ab76d5f39249c561bd20		 embedded-pe PDF raw base64 PE payload at offset 0x2FE 52736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.