Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7f6783257a03ec3…

MALICIOUS

PDF

150.9 KB First seen: 2012-07-12
MD5: d4ccf8a3fd7ed65df7204bbc9cffe330 SHA-1: 8b52f9d1fa218fe69e04e287a1c1de3a7bc661c0 SHA-256: a7f6783257a03ec3824aa402222eab3cea9c041112df1ae4119ffed1769eb0e1
110 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The ML classifier strongly indicates this PDF is malicious, likely due to an embedded exploit. The document body contains minimal text, offering no specific lure. Without further script or URL evidence, the exact attack vector and payload remain unclear, but the primary mechanism appears to be a PDF exploit.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 2

  • VBScript-style decimal byte array decodes to a PE payload critical PDF_VBS_DECIMAL_ARRAY_PE_PAYLOAD
    PDF comment text contains a VB/VBScript-style decimal byte array, such as c(077),c(090), that decodes to a verified Windows PE executable. The rule is gated on a comment-line Array(c(...)) assignment and a valid MZ/PE header to keep false positives low.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
decimal_array_pdf_pe_00000229.exe embedded-pe PDF raw comment decimal-array PE payload at offset 0x229 21895 bytes
SHA-256: 1b3f6ada093de8558438f137a4e1f799f04e8a5cfa8d6fa1e9c8e2ea2a1fffb7
Detection
ClamAV: No threats found
Obfuscation or payload: likely
actual_type=PE; declared_or_context_type=PDF; filename=decimal_array_pdf_pe_00000229.exe; kind=embedded-pe Carved artifact entropy is 7.84, consistent with packed or encrypted content.