PDF malware analysis — malicious · 5ca42481db244902

MALICIOUS

PDF

69.5 KB

MD5: 48403f1d6ad0327d0c1115e8918b6bab SHA-1: 304c2d6b670ab713d46e3181b8aa783ae2107945 SHA-256: 5ca42481db244902029b8c971ff78063d94a909a6a75484e8b6d0fe2bb1949b5

100 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1055 Process Injection

The PDF document contains a Base64-encoded PE payload, identified by the PDF_BASE64_PE_PAYLOAD heuristic. This payload is likely intended to be decoded and executed, potentially using process injection techniques as indicated by the presence of VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread APIs. The embedded executable's SHA256 hash is provided as a primary IOC.

Machine Learning

Nyx PDF Classifier malicious score 0.9952

Heuristics 1

Base64-encoded Windows executable payload in PDF critical PDF_BASE64_PE_PAYLOAD

PDF text contains a long base64 blob that decodes to a verified Windows PE executable. This catches payloads hidden after EOF, inside comments, or in plain text outside normal PDF streams.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`base64_pdf_pe_000002fe.exe` `cac25a0c85ff0522a7105b86ac53326b6c5a8b9031d9ab76d5f39249c561bd20`	embedded-pe	PDF raw base64 PE payload at offset 0x2FE	52736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.