Malicious PDF — malware analysis report

Static analysis result for SHA-256 52cc2db9a6798aae…

MALICIOUS

PDF

244.6 KB First seen: 2026-05-11
MD5: d60eb5297f632c1002090cf76a23c3fc SHA-1: ae27baaf755a8cded28cb54094edf93b4d1b7d51 SHA-256: 52cc2db9a6798aae37b66833c0611b2ac9cefc33c1e66db3aa8bacc8d05eb0ba
110 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9881

Heuristics 2

  • VBScript-style decimal byte array decodes to a PE payload critical PDF_VBS_DECIMAL_ARRAY_PE_PAYLOAD
    PDF comment text contains a VB/VBScript-style decimal byte array, such as c(077),c(090), that decodes to a verified Windows PE executable. The rule is gated on a comment-line Array(c(...)) assignment and a valid MZ/PE header to keep false positives low.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
decimal_array_pdf_pe_00000229.exe embedded-pe PDF raw comment decimal-array PE payload at offset 0x229 7538 bytes
SHA-256: de2f332318e913719cd342ca8e0c541394e544eb386c226dba0ec8fe692e1a69
Detection
ClamAV: No threats found
Obfuscation or payload: likely
actual_type=PE; declared_or_context_type=PDF; filename=decimal_array_pdf_pe_00000229.exe; kind=embedded-pe Carved artifact entropy is 7.45, consistent with packed or encrypted content.