SUSPICIOUS
50
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
The ML classifier strongly indicates this PDF is malicious. It contains an embedded file, which is a common technique for delivering secondary payloads. The embedded file itself was flagged as a suspicious artifact during static triage due to its size and encoding.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
-
XFA form low PDF_XFAPDF uses XML Forms Architecture — can contain script logic
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ns.adobe.com/xdp/ In PDF document text
- http://www.xfa.org/schema/xci/1.0/In PDF document text
- http://www.xfa.org/schema/xfa-template/2.4/In PDF document text
- http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
- http://ns.adobe.com/xtd/In PDF document text
- http://www.xfa.org/schema/xfa-form/2.8/In PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
embedded_file_obj0001.bin |
pdf-embedded-file | PDF EmbeddedFile object 1 at offset 0x50 | 13410 bytes |
SHA-256: 5568f6c4f32910fde86cdb8f0126cf7d937a36b6381923bb7a939790d0c2bbca |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 1 long base64-like blob(s).
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.