MALICIOUS
90
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a remote GoTo action, indicating an attempt to redirect the user to an external resource. The document body is heavily obfuscated and unreadable, preventing a more detailed analysis of its specific lure. The ClamAV heuristic for obfuscated objects further supports the malicious nature of the file.
Heuristics 4
-
ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTIONClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
-
Remote GoTo action medium PDF_GOTO_REMOTEPDF references a remote or embedded document via GoToR/GoToE with an extension-less or unresolved target
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
-
Encrypted PDF (string and stream contents are opaque to static scan) info PDF_ENCRYPTEDPDF declares /Encrypt — string objects and stream contents are encrypted with the standard security handler (RC4 or AES). On its own this is informational; legitimate encrypted documents include signed contracts, billing statements, and rights-managed material. Static heuristics cannot inspect encrypted payload bytes.
Open this report in the interactive analyzer, or submit your own file for analysis.