MALICIOUS
110
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
T1059.007 JavaScript
The sample is a PDF file flagged by ClamAV as Heuristics.PDF.ObfuscatedNameObject and a machine learning classifier as malicious. Heuristics indicate the presence of XFA forms and embedded files, suggesting an attempt to exploit PDF vulnerabilities for code execution. The obfuscated nature of the document body and the embedded object further support a malicious intent, likely to download and execute a secondary payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.9191
Heuristics 5
-
ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTIONClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
-
XFA form low PDF_XFAPDF uses XML Forms Architecture — can contain script logic
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILEDThe cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Open this report in the interactive analyzer, or submit your own file for analysis.