MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1059.003 Windows Command Shell
T1204.002 Malicious File
The PDF file contains a launch action that executes cmd.exe with a command designed to display a misleading message to the user. This indicates an attempt to trick the user into believing the document is performing a legitimate function while potentially performing malicious actions in the background. The ML classifier strongly supports the malicious nature of this PDF.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 2
-
Launch action critical PDF_LAUNCHPDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
-
/Launch action target: cmd.exe critical PDF_LAUNCH_COMMANDPDF /Launch action specifies an executable target with parameters '/c echo Please wait while advanced functionality is initialized... && (for /F "delims=% skip=3" %i in ('find "%%%" evil_launch.pdf'' — references a known-dangerous executable (cmd, PowerShell, etc.).
Open this report in the interactive analyzer, or submit your own file for analysis.