Malicious PDF — malware analysis report

Static analysis result for SHA-256 703b3d609f98c19c…

MALICIOUS

PDF

2.8 KB
MD5: 21a110d45c9f38f005c2cd011393bc2a SHA-1: 576d47dd9b6ec3eba40a64cde8850509bac5807a SHA-256: 703b3d609f98c19ced95e848a1e8ff2a89faac20717fcd421c9827c1a9f8daa4
66 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF sample was flagged as malicious by an ML classifier with high confidence. Heuristics indicate the use of XFA forms and ASCIIHexDecode filters, commonly associated with PDF exploits. While no document body text or scripts were extracted, the presence of these indicators suggests the file is designed to execute malicious code upon opening, likely as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic

Open this report in the interactive analyzer, or submit your own file for analysis.