MALICIOUS
76
Risk Score
Malware Insights
MITRE ATT&CK
T1204 Malicious Link
T1204.002 Malicious File
The PDF file contains multiple heuristic firings indicating malicious intent, including PDF_OPENACTION and PDF_FILTER_HEX with exploit indicators. These suggest the file is designed to trigger an exploit when opened, likely leading to arbitrary code execution. The presence of XFA forms and AcroForm buttons with action triggers further supports this. No specific family could be identified.
Heuristics 4
-
OpenAction trigger high PDF_OPENACTIONPDF has an /OpenAction that launches, submits, or opens an external target
-
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEXHex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
-
XFA form low PDF_XFAPDF uses XML Forms Architecture — can contain script logic
-
AcroForm button with action trigger low PDF_ACROFORM_BUTTONPDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
Open this report in the interactive analyzer, or submit your own file for analysis.