PDF malware analysis — malicious · a4e09cb37e4f090d

MALICIOUS

PDF

4.2 KB

MD5: ae614a58e3f2b90507d684f16cbfe44d SHA-1: 780678adc3d5d7caa64459b08fad3674c90920af SHA-256: a4e09cb37e4f090d38c160dd663a4b84af1ec73a1bce38ba34ca3ad9bdbf2b80

66 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF sample was flagged by a machine learning classifier as highly malicious. Static analysis revealed an embedded script payload within a PDF stream, indicating an attempt to exploit vulnerabilities or deliver malicious content. The presence of an embedded file further supports the malicious nature of the document.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0008.bin` `64c7ab8d8054be69195de3f1e29dc3941b4d730da8a3b7e975f130f84c1e704a`	pdf-embedded-file	PDF EmbeddedFile object 8 at offset 0xEA	13055 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.