PDF malware analysis — malicious · 610429be8cad5f75

MALICIOUS

PDF

150.9 KB

MD5: 3400145d7038b416cd9af62e06511cd6 SHA-1: d8a7e38ece237b105879745db5b8c92a803e6283 SHA-256: 610429be8cad5f750230963f7f2991433d7402eabda16f13c529c8f2679d89aa

92 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF contains a heuristic firing indicating a VBScript-style decimal array that decodes to a PE payload. This suggests the document is a dropper, designed to extract and execute a secondary malicious executable. The ML classifier also strongly flagged this PDF as malicious. The extracted PE payload's hash is provided as an IOC.

Machine Learning

Nyx PDF Classifier malicious score 0.9977

Heuristics 2

VBScript-style decimal byte array decodes to a PE payload critical PDF_VBS_DECIMAL_ARRAY_PE_PAYLOAD

PDF comment text contains a VB/VBScript-style decimal byte array, such as c(077),c(090), that decodes to a verified Windows PE executable. The rule is gated on a comment-line Array(c(...)) assignment and a valid MZ/PE header to keep false positives low.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`decimal_array_pdf_pe_00000229.exe` `a34f9a3550c33b63a4523944c11ce5e0ce1629df29e3664c81768731cee22b2e`	embedded-pe	PDF raw comment decimal-array PE payload at offset 0x229	21898 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.84, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.