PDF malware analysis — malicious · a938a15e4ba08dc1

MALICIOUS

PDF

4.1 KB

MD5: 03d74647bfb5528193337da24feab39a SHA-1: fcca1c1174d7180c3e871e4e3a66586c799545e6 SHA-256: a938a15e4ba08dc1d852e108b94b1501888a7a6194a001c44e4f9d83e86c0bf1

66 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1566.002 Spearphishing Attachment

The PDF was flagged as malicious by an ML classifier with high confidence. Heuristics indicate the presence of an embedded script payload within a PDF stream, suggesting it's designed to execute malicious code. The embedded file further supports the payload delivery vector.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0008.bin` `6b795cc257ac45105c582f1243bd9f7255dda3a06553e01a90e1719e21032de5`	pdf-embedded-file	PDF EmbeddedFile object 8 at offset 0xEA	12881 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.