PDF malware analysis — malicious · d20970b01a2abb4c

MALICIOUS

PDF

69.5 KB

MD5: 2b13c70e660b778635e1d6b22eaff2bb SHA-1: 072c8c97876a37ed94eb140d556772b5e386d503 SHA-256: d20970b01a2abb4cd62dfe596944919579a7f3c457ff982ea7e9747a3a4f962f

60 Risk Score

Malware Insights

MITRE ATT&CK

T1027 Obfuscated Files or Information T1140 Deobfuscate/Decode Files or Information T1059.001 PowerShell T1055 Process Injection

The PDF document was found to contain a Base64-encoded Windows executable payload. The heuristic indicates that this payload is likely decoded and injected into a running process using APIs such as VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. The embedded executable has a SHA256 hash of cac25a0c85ff0522a7105b86ac53326b6c5a8b9031d9ab76d5f39249c561bd20.

Heuristics 1

Base64-encoded Windows executable payload in PDF critical PDF_BASE64_PE_PAYLOAD

PDF text contains a long base64 blob that decodes to a verified Windows PE executable. This catches payloads hidden after EOF, inside comments, or in plain text outside normal PDF streams.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`base64_pdf_pe_000002fe.exe` `cac25a0c85ff0522a7105b86ac53326b6c5a8b9031d9ab76d5f39249c561bd20`	embedded-pe	PDF raw base64 PE payload at offset 0x2FE	52736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.