PDF malware analysis — malicious · 691af9c4efb73387

MALICIOUS

PDF

244.6 KB

MD5: afa177cdcc379cb44fe1b076375d90e5 SHA-1: 4cf6ab0b42f54cb4a4bb1abbe1614e8daaa1efd7 SHA-256: 691af9c4efb73387127b60f9a7a2a25a84c22c53db3f9cb1ae98ef9ef9daa18e

92 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The critical heuristic firing indicates that VBScript-style decimal array data within the PDF decodes to a PE payload. This suggests the PDF is acting as a dropper for a secondary executable. The ML classifier also flagged the PDF as malicious with high confidence. The embedded PE file is the primary IOC.

Machine Learning

Nyx PDF Classifier malicious score 0.9594

Heuristics 2

VBScript-style decimal byte array decodes to a PE payload critical PDF_VBS_DECIMAL_ARRAY_PE_PAYLOAD

PDF comment text contains a VB/VBScript-style decimal byte array, such as c(077),c(090), that decodes to a verified Windows PE executable. The rule is gated on a comment-line Array(c(...)) assignment and a valid MZ/PE header to keep false positives low.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`decimal_array_pdf_pe_00000229.exe` `26a6b164398466ca1b17833467f495c56f6687fd02ffdb50a8d89702a240bb2f`	embedded-pe	PDF raw comment decimal-array PE payload at offset 0x229	14603 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.74, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.