MALICIOUS
60
Risk Score
Malware Insights
MITRE ATT&CK
T1553.005 Mark-of-the-Web Bypass
T1204.002 Malicious File
The PDF contains an embedded file, indicated by the PDF_EMBEDDED heuristic. Additionally, a remote GoTo action suggests an attempt to redirect the user to malicious content. The ML classifier strongly flagged this PDF as malicious. The document body was unreadable, but the combination of heuristics points to a malicious PDF designed to deliver a secondary payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.9782
Heuristics 3
-
Remote GoTo action medium PDF_GOTO_REMOTEPDF references a remote or embedded document via GoToR/GoToE with an extension-less or unresolved target
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
-
Encrypted PDF (string and stream contents are opaque to static scan) info PDF_ENCRYPTEDPDF declares /Encrypt — string objects and stream contents are encrypted with the standard security handler (RC4 or AES). On its own this is informational; legitimate encrypted documents include signed contracts, billing statements, and rights-managed material. Static heuristics cannot inspect encrypted payload bytes.
Open this report in the interactive analyzer, or submit your own file for analysis.