PDF malware analysis — malicious · 5790afe19eeb30aa

MALICIOUS

PDF

33.4 KB

MD5: 5c08fbd7f55d7375e2d15f684d4ee198 SHA-1: 00799d3815a0c32e9d00d353b3ecbadf424d5c32 SHA-256: 5790afe19eeb30aa1cfc141834f8630097ae0298b9ccdbacc6110207a1b50361

134 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1566.002 Spearphishing Attachment

This PDF file was flagged as malicious by a machine learning classifier and exhibits multiple heuristic signals related to embedded JavaScript and exploit indicators. The presence of JavaScript actions and embedded JS streams, combined with ASCIIHexDecode and ASCII85Decode filters, strongly suggests an attempt to execute malicious code. The correlated malicious JavaScript signals further confirm this intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 5

Correlated malicious PDF JavaScript signals critical PDF_CORRELATED_MALICIOUS_JS

PDF JavaScript or auto-action content is corroborated by exploit staging, ML, or suspicious extracted-artifact findings. This correlation promotes old exploit-kit PDFs that otherwise remain in the suspicious band because each individual signal is intentionally weighted conservatively.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85

ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation

Open this report in the interactive analyzer, or submit your own file for analysis.