Malicious PDF — malware analysis report

Static analysis result for SHA-256 55539c038f37791f…

MALICIOUS

PDF

69.5 KB
MD5: 7f1ba351956d441d7c17278a7111bee7 SHA-1: a93cebec999c55011175fbe73de99a79fd1d716b SHA-256: 55539c038f37791f03f831a5b65108dd3c596251601217ec19763c774024eae2
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1105 Ingress Tool Transfer T1055 Process Injection

The PDF document contains a Base64-encoded Windows executable payload. The heuristic indicates the payload is decoded and injected into a running process using APIs like VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. This suggests the PDF is a delivery mechanism for a malicious executable.

Heuristics 1

  • Base64-encoded Windows executable payload in PDF critical PDF_BASE64_PE_PAYLOAD
    PDF text contains a long base64 blob that decodes to a verified Windows PE executable. This catches payloads hidden after EOF, inside comments, or in plain text outside normal PDF streams.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
base64_pdf_pe_000002fe.exe
cac25a0c85ff0522a7105b86ac53326b6c5a8b9031d9ab76d5f39249c561bd20		 embedded-pe PDF raw base64 PE payload at offset 0x2FE 52736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.