PDF malware analysis — malicious · e6e3991f62b065ee

MALICIOUS

PDF

69.5 KB

MD5: b2247dec3d98625acbf37ea3c029babc SHA-1: 2e7772e478d3aeeeb821e2921382d551b6c22d09 SHA-256: e6e3991f62b065eea1a12719a1f0fc37ea92324f4e224ea604548c452074a9d5

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1140 Deobfuscate or Obfuscate Malicious Code T1071.001 Web Protocols T1204.002 Malicious File T1055.012 Process Hollowing

The PDF document contains a Base64-encoded Windows executable payload. The heuristic indicates the payload is decoded and likely injected into a running process using VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. This suggests a downloader or dropper functionality, where the PDF acts as a container for the malicious executable.

Heuristics 1

Base64-encoded Windows executable payload in PDF critical PDF_BASE64_PE_PAYLOAD

PDF text contains a long base64 blob that decodes to a verified Windows PE executable. This catches payloads hidden after EOF, inside comments, or in plain text outside normal PDF streams.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`base64_pdf_pe_000002fe.exe` `cac25a0c85ff0522a7105b86ac53326b6c5a8b9031d9ab76d5f39249c561bd20`	embedded-pe	PDF raw base64 PE payload at offset 0x2FE	52736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.