PDF malware analysis — malicious · 5a726419028e04c0

MALICIOUS

PDF

69.5 KB

MD5: 0f02d13af8de0347b282d5b191f4360a SHA-1: e0c4e69a387162a2c02edaf2efe225d6bb691bed SHA-256: 5a726419028e04c00decc892c1385f8edad5eb6d252f24ffbb687873a3b4c07b

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The PDF contains a Base64-encoded PE payload, identified by the PDF_BASE64_PE_PAYLOAD heuristic. This payload is likely intended to be decoded and executed, potentially using process injection APIs such as VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. The ML classifier also strongly indicated maliciousness. The embedded executable's SHA256 hash is provided as a high-priority IOC.

Machine Learning

Nyx PDF Classifier malicious score 0.9952

Heuristics 1

Base64-encoded Windows executable payload in PDF critical PDF_BASE64_PE_PAYLOAD

PDF text contains a long base64 blob that decodes to a verified Windows PE executable. This catches payloads hidden after EOF, inside comments, or in plain text outside normal PDF streams.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`base64_pdf_pe_000002fe.exe` `cac25a0c85ff0522a7105b86ac53326b6c5a8b9031d9ab76d5f39249c561bd20`	embedded-pe	PDF raw base64 PE payload at offset 0x2FE	52736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.