Malicious PDF — malware analysis report

Static analysis result for SHA-256 78cae91b0ec312a8…

MALICIOUS

PDF

729 B
MD5: d757139dbc030d02c3123a9a874fbd78 SHA-1: 0e3d02851c293b093cbd44303ad780a3721fd4f8 SHA-256: 78cae91b0ec312a811f0dad5dc23287926befed090cf966080b424f600ba04b4
130 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The PDF contains a launch action that directly executes cmd.exe. This is a common technique for exploiting vulnerabilities in PDF readers to achieve arbitrary code execution. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 2

  • /Launch action target: "cmd.exe" critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target — references a known-dangerous executable (cmd, PowerShell, etc.).
  • Launch action high PDF_LAUNCH
    PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous

Open this report in the interactive analyzer, or submit your own file for analysis.