MALICIOUS
102
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF contains embedded heuristics indicating a critical finding of an embedded Windows executable payload. The ML classifier also flagged the PDF as malicious with a high score. The embedded URL, while not directly malicious in this context, is associated with the PDF creation tool, suggesting a potential vector for the malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9255
Heuristics 4
-
Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOADPDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.go2pdf.com PDF link annotation
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_001_off00001149.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x1149 | 31073 bytes |
SHA-256: de5288959893b4514f11d0e9fa4e49727082cfa7df17e81bf3239ccc7fd546c4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.