MALICIOUS
76
Risk Score
Malware Insights
MITRE ATT&CK
T1204 Malicious Link
T1204.002 Malicious File
The PDF file contains multiple heuristic firings indicating malicious intent, including an OpenAction trigger and the use of ASCIIHexDecode filters with exploit indicators. These suggest the document is designed to execute arbitrary code when opened, likely leveraging a known PDF vulnerability. The presence of XFA forms and AcroForm buttons with actions further supports the exploitation of PDF features for malicious purposes.
Heuristics 4
-
OpenAction trigger high PDF_OPENACTIONPDF has an /OpenAction that launches, submits, or opens an external target
-
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEXHex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
-
XFA form low PDF_XFAPDF uses XML Forms Architecture — can contain script logic
-
AcroForm button with action trigger low PDF_ACROFORM_BUTTONPDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
Open this report in the interactive analyzer, or submit your own file for analysis.