MALICIOUS
86
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
T1566.002 Spearphishing Attachment
The PDF file contains JPXDecode with active content, strongly indicating an attempt to exploit CVE-2018-4990 or a related vulnerability. The ML classifier also flagged this PDF with high confidence. While no specific document body text or scripts were extracted, the presence of embedded files and XFA forms further supports a malicious intent, likely to deliver a secondary payload.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
JPXDecode + active content — JPEG2000 CVE-family indicator high PDF_JPX_CVE_2018_4990_RELATEDPDF uses /JPXDecode (JPEG2000) alongside JavaScript, XFA, or RichMedia indicators. This matches the delivery pattern for Adobe Reader JPEG2000 parser exploit families, including CVE-2018-4990, but does not prove the exact malformed JP2/JPX primitive.
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
-
XFA form low PDF_XFAPDF uses XML Forms Architecture — can contain script logic
Open this report in the interactive analyzer, or submit your own file for analysis.