MALICIOUS
106
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
T1566.002 Spearphishing Attachment
The PDF sample contains multiple heuristic firings indicating malicious intent, including a high-severity OpenAction trigger and the use of ASCIIHexDecode filters with exploit indicators. The ML classifier also strongly flagged this PDF as malicious. These indicators suggest the document is designed to exploit a vulnerability upon opening, likely leading to arbitrary code execution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
OpenAction trigger high PDF_OPENACTIONPDF has an /OpenAction that launches, submits, or opens an external target
-
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEXHex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
-
XFA form low PDF_XFAPDF uses XML Forms Architecture — can contain script logic
-
AcroForm button with action trigger low PDF_ACROFORM_BUTTONPDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
Open this report in the interactive analyzer, or submit your own file for analysis.