MALICIOUS
72
Risk Score
Malware Insights
MITRE ATT&CK
T1553.001 Mark-of-the-Web Bypass
The PDF contains an embedded file, indicated by the PDF_EMBEDDED heuristic. The ClamAV detection of 'Win.Worm.VBS-95' strongly suggests malicious intent. The PDF is also encrypted and appears to be image-only, which are common tactics to evade static analysis and trick users. The embedded file is the primary indicator of a potential attack vector.
Heuristics 4
-
ClamAV: Win.Worm.VBS-95 critical CLAMAV_DETECTIONClamAV detected this file as malware: Win.Worm.VBS-95
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
-
Encrypted PDF (string and stream contents are opaque to static scan) info PDF_ENCRYPTEDPDF declares /Encrypt — string objects and stream contents are encrypted with the standard security handler (RC4 or AES). On its own this is informational; legitimate encrypted documents include signed contracts, billing statements, and rights-managed material. Static heuristics cannot inspect encrypted payload bytes.
-
PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LUREPDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
Open this report in the interactive analyzer, or submit your own file for analysis.