PDF malware analysis — malicious · 6ba5d9cad7f7d41e

MALICIOUS

PDF

69.5 KB

MD5: db43972be531897cb571c1569d7187e2 SHA-1: cb7a9ad7ce49302d2318a1348718107da9cc8caa SHA-256: 6ba5d9cad7f7d41e471c4ad15fb61076b14c6639e5b2c3ff272380345e29b2bf

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1055 Process Injection

The PDF document contains a Base64-encoded Windows executable payload. This payload is designed to be decoded and injected into a running process, likely to evade detection and execute malicious code. The ML classifier strongly indicates malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9952

Heuristics 1

Base64-encoded Windows executable payload in PDF critical PDF_BASE64_PE_PAYLOAD

PDF text contains a long base64 blob that decodes to a verified Windows PE executable. This catches payloads hidden after EOF, inside comments, or in plain text outside normal PDF streams.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`base64_pdf_pe_000002fe.exe` `cac25a0c85ff0522a7105b86ac53326b6c5a8b9031d9ab76d5f39249c561bd20`	embedded-pe	PDF raw base64 PE payload at offset 0x2FE	52736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.