PDF malware analysis — malicious · 693ea9f0837c9e0c

MALICIOUS

PDF

104.9 KB Created: 2025-11-02 10:50:12 +00:00 Authoring application: (unspecified) (via ReportLab PDF Library - www.reportlab.com)

MD5: 944ff8c66e470e1477231f5e9e79ca65 SHA-1: a2d4755b3c103983ce0273e682de9d07efb9363a SHA-256: 693ea9f0837c9e0c0413da6198b6316a6ca6dfd9f4d3db71664d2270a65bcf38

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains a critical heuristic firing for a Base64-encoded PE executable payload embedded within it. An additional critical heuristic indicates a secondary embedded PDF with similar suspicious findings. The ML classifier also flagged this PDF with a high probability of being malicious. The embedded executable is the primary indicator of malicious intent, likely intended for execution upon extraction.

Machine Learning

Nyx PDF Classifier malicious score 0.9945

Heuristics 4

Base64-encoded Windows executable payload in PDF critical PDF_BASE64_PE_PAYLOAD

PDF text contains a long base64 blob that decodes to a verified Windows PE executable. This catches payloads hidden after EOF, inside comments, or in plain text outside normal PDF streams.
Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.reportlab.com

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`base64_pdf_pe_0000110d.exe` `48e18db10bf9fa0033affaed849f053bd20c59b32b71855d1cc72f613d0cac4b`	embedded-pe	PDF raw base64 PE payload at offset 0x110D	77312 bytes
`polyglot_child_pdf_off00000310.pdf` `4935b7a30aa4a92cec78c3337708faca6525b7bea3e57a9e5f613149ba06281e`	polyglot-child-pdf	Secondary PDF body inside pdf container at offset 0x310	106665 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.