Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ca58787afe52ed3…

MALICIOUS

PDF

150.9 KB
MD5: 6edd02744785c15e0b975d03afd66b6a SHA-1: d104ac0b38ad7404ce39a1085d30106ba4c195dd SHA-256: 5ca58787afe52ed3560c4cc7eec21f556df58f1bf7dc8dfb644d240e6f91276b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including a critical finding that a VBScript-style decimal byte array decodes to a PE payload. This indicates the document is designed to drop and execute a malicious executable. The embedded PE file has a SHA256 hash of 076e8240eef92e8372830f0b6ce9e13716c91e2faecba78aab06af595b8bcf74. The document body text is minimal and does not provide further context on the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 3

  • VBScript-style decimal byte array decodes to a PE payload critical PDF_VBS_DECIMAL_ARRAY_PE_PAYLOAD
    PDF comment text contains a VB/VBScript-style decimal byte array, such as c(077),c(090), that decodes to a verified Windows PE executable. The rule is gated on a comment-line Array(c(...)) assignment and a valid MZ/PE header to keep false positives low.
  • ClamAV: Pdf.Dropper.Agent-7264102-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7264102-0
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
decimal_array_pdf_pe_00000229.exe
076e8240eef92e8372830f0b6ce9e13716c91e2faecba78aab06af595b8bcf74
embedded-pe PDF raw comment decimal-array PE payload at offset 0x229 21892 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.84, consistent with packed or encrypted content.