MALICIOUS
130
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.9870
Heuristics 2
-
Base64-encoded Windows executable payload in PDF critical PDF_BASE64_PE_PAYLOADPDF text contains a long base64 blob that decodes to a verified Windows PE executable. This catches payloads hidden after EOF, inside comments, or in plain text outside normal PDF streams.
-
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
base64_pdf_pe_00000284.exe |
embedded-pe | PDF raw base64 PE payload at offset 0x284 | 49664 bytes |
SHA-256: a102c8c2cae0682143851b5620e08ea2d7daa173a26768a90ff3e78be7a6b6d7 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
actual_type=PE; declared_or_context_type=PDF; filename=base64_pdf_pe_00000284.exe; kind=embedded-pe Static shellcode analysis recovered command string(s): PowerShell
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.