MALICIOUS
134
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 JavaScript/JScript
T1559.001 Component Object Model Hijacking
The PDF was flagged by a machine learning classifier and exhibits multiple heuristic indicators of maliciousness, including embedded JavaScript and the use of ASCIIHexDecode filters, which are often used in exploit delivery. The embedded JavaScript is the primary mechanism for exploitation, likely leading to the download and execution of a secondary payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 5
-
Correlated malicious PDF JavaScript signals critical PDF_CORRELATED_MALICIOUS_JSPDF JavaScript or auto-action content is corroborated by exploit staging, ML, or suspicious extracted-artifact findings. This correlation promotes old exploit-kit PDFs that otherwise remain in the suspicious band because each individual signal is intentionally weighted conservatively.
-
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEXHex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
Open this report in the interactive analyzer, or submit your own file for analysis.