MALICIOUS
60
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1027 Obfuscated Files or Information
The PDF file was identified as malicious due to a critical heuristic firing for a hidden ZIP payload. This payload contains several DLL files, indicating the PDF is likely acting as a dropper for a more complex malware infection. The presence of these DLLs suggests the attacker intends to deliver and execute malicious code.
Machine Learning
- Nyx PDF Classifier clean score 0.0478
Heuristics 1
-
Hidden ZIP payload with executable entries inside PDF stream critical PDF_HIDDEN_ZIP_EXECUTABLE_PAYLOADPDF stream bytes contain an embedded ZIP archive whose local headers name executable payload files. This is not a normal PDF attachment (/EmbeddedFile); it hides Windows payloads inside an ordinary stream, a strong malware-loader or smuggling pattern.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
hidden_pdf_zip_off00000048.zip798a7efb32506ee40951355bb354c618d5d58fc77bc22fef23a769fc5caef04e |
pdf-hidden-zip | PDF raw stream ZIP payload at offset 0x48 | 888881 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.