MALICIOUS
80
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious Link
The PDF file is identified as a malicious screenshot lure, designed to trick users into clicking a link. This link directly points to an executable file hosted on Dropbox. The primary attack vector is the embedded URL, which serves as a direct download for a potentially malicious payload.
Machine Learning
- Nyx PDF Classifier clean score 0.0006
Heuristics 2
-
PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINKPDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
-
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LUREPDF has 2 image(s), only 2 text block(s), carries a click-outward action, and is only 49 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Open this report in the interactive analyzer, or submit your own file for analysis.