PDF malware analysis — malicious · f4ac0c7d94743eb6

MALICIOUS

PDF

111.2 KB

MD5: a3931cf9e7168b9bc8ecba12ecf81116 SHA-1: 92b77f8e48e9252a077b0718b59b3dab89a8962c SHA-256: f4ac0c7d94743eb6f6c7694f0b9959c03c80082cc7791236670baaa31ac3c388

132 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

This PDF file contains an embedded VBScript that reconstructs and executes a Portable Executable (PE) payload. The script utilizes 'Scripting.FileSystemObject' to write the payload to disk as 'svchost.exe', a common tactic to disguise malicious executables. The ML classifier strongly indicates maliciousness, and the embedded PE dropper heuristic confirms the payload delivery mechanism.

Machine Learning

Nyx PDF Classifier malicious score 0.9989

Heuristics 2

VBScript in PDF stream reconstructs and runs a PE payload critical PDF_VBS_HEX_PE_DROPPER

PDF stream contains an HTML/VBScript block that decodes a long hex string into a Windows executable and runs it via WScript.Shell. This is an embedded dropper payload, not ordinary PDF JavaScript.
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_vbs_dropper_00000309.vbs` `50b36b292c4a29f5f0d9642bb1487d597e7f817cb538628ff0d791b00e4fac65`	pdf-embedded-script	PDF raw bytes VBScript dropper at offset 0x309	113122 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s). Carved artifact contains 1 long base64-like blob(s).
`svchost.exe` `fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320`	embedded-pe	Decoded PE from PDF VBScript dropper at offset 0x309	56320 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.89, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.