Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f0f7d42fe5daebd…

MALICIOUS

PDF

990 B
MD5: 2890333543c994398f71fd2c982b5934 SHA-1: c2b4bbc9f707282c8ae7d5ce569ffd6bc7f0ec11 SHA-256: 6f0f7d42fe5daebdf0792a541d7e8d87af532fa3996ba910f3ce119262e4795f
150 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The PDF file contains a launch action that directly invokes 'cscript.exe', indicating an attempt to execute a script. The document body text, though minimal, reinforces the presence of 'cscript.exe'. This suggests the file is designed to exploit a vulnerability or trick the user into running a malicious script, likely for further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 2

  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • /Launch action target: cscript.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target — references a known-dangerous executable (cmd, PowerShell, etc.).

Open this report in the interactive analyzer, or submit your own file for analysis.