MALICIOUS
108
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1204.002 Malicious File
The PDF file contains embedded executable script, as indicated by the PDF_EMBEDDED_SCRIPT_PAYLOAD and PDF_XFA_SCRIPT heuristics. The ML classifier also strongly flagged this PDF as malicious. The embedded script is likely responsible for downloading and executing a secondary payload, which is a common technique for initial access. The presence of an embedded file further supports this. Confidence is high due to multiple strong indicators, but the exact nature of the payload is unknown without further analysis.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
XFA form contains risky executable script high PDF_XFA_SCRIPTPDF embeds an XFA form whose script block contains exploit, submission/launch, or shell-execution primitives. Ordinary LiveCycle print/update scripts are left as generic XFA/JS signals unless stronger behavior is present.
-
Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOADPDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
-
XFA form low PDF_XFAPDF uses XML Forms Architecture — can contain script logic
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
embedded_file_obj0007.binf82e1e8816f39c92317ed6e1deaad0dbf41f9bcfe3a0b649b4f70e2aef3f7b21 |
pdf-embedded-file | PDF EmbeddedFile object 7 at offset 0x28A | 6519 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.