PDF malware analysis — malicious · 5af7484d2bd83627

MALICIOUS

PDF

244.6 KB

MD5: 7d68d78cffe73176039c576f94404c83 SHA-1: 8dc730204f435d0c93c9ed8b9058ba9f606100a5 SHA-256: 5af7484d2bd8362703d6195cc9c4eff9dca17f90ba9fb08b250fc50bb2996b21

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a VBScript-style decimal byte array that decodes to a PE payload, indicating it's designed to deliver an executable. The ML classifier also flagged this PDF as malicious. The embedded executable, identified by its SHA256 hash, is the primary payload, likely intended to be run by the user.

Machine Learning

Nyx PDF Classifier malicious score 0.9948

Heuristics 2

VBScript-style decimal byte array decodes to a PE payload critical PDF_VBS_DECIMAL_ARRAY_PE_PAYLOAD

PDF comment text contains a VB/VBScript-style decimal byte array, such as c(077),c(090), that decodes to a verified Windows PE executable. The rule is gated on a comment-line Array(c(...)) assignment and a valid MZ/PE header to keep false positives low.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`decimal_array_pdf_pe_00000229.exe` `5f3e264c76d31e414756d04d4911f095cbb3d0fb501341e400b00fbaa5e4f940`	embedded-pe	PDF raw comment decimal-array PE payload at offset 0x229	30402 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.89, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.