MALICIOUS
66
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains JavaScript actions and a URI pointing to an email address, suggesting a phishing or scam attempt. The 'PDF_IMAGE_ONLY_LURE' heuristic indicates the document is designed to appear as legitimate content while hiding its malicious intent. The ML classifier strongly flagged this PDF as malicious. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 0.9514
Heuristics 3
-
PDF paints image(s) but contains no text operators medium PDF_IMAGE_ONLY_LUREPDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
External URI low PDF_URIPDF contains an external URL action
Open this report in the interactive analyzer, or submit your own file for analysis.