MALICIOUS
66
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
The PDF document was identified as suspicious due to the presence of an embedded file and XFA form, both common techniques for obfuscating malicious content. A machine learning classifier assigned a very high probability of maliciousness (0.999955). While no specific malicious behavior was directly observed in the limited document body, the combination of these indicators strongly suggests an attempt to deliver a malicious payload.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
Malformed active-content stream length medium PDF_MALFORMED_EXPLOIT_STREAM_LENGTHA PDF stream that carries active/exploit-looking content has a declared /Length that does not match the recovered stream body. Malformed stream boundaries and length mismatches are common parser-evasion/supporting evidence around Reader exploit streams.
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
-
XFA form low PDF_XFAPDF uses XML Forms Architecture — can contain script logic
Open this report in the interactive analyzer, or submit your own file for analysis.