PDF malware analysis — malicious · fc2d6b590e3b32d3

MALICIOUS

PDF

226.8 KB

MD5: f718ab9e3d34db0d2cc430ca94fcb916 SHA-1: b0b5c4bae866132f121d0e82982246d75818374e SHA-256: fc2d6b590e3b32d37e07736bc52df396cc442e0d3c1a4c09a09c219b3d4e0910

152 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1105 Ingress Tool Transfer

The PDF contains a VBScript-style decimal array that decodes to a PE payload, as indicated by the 'PDF_VBS_DECIMAL_ARRAY_PE_PAYLOAD' heuristic. This strongly suggests the PDF is designed to drop and execute a secondary malicious executable. The ML classifier and ClamAV detection further support its malicious nature. The extracted PE artifact's hash is provided as an IOC.

Machine Learning

Nyx PDF Classifier malicious score 0.9956

Heuristics 3

VBScript-style decimal byte array decodes to a PE payload critical PDF_VBS_DECIMAL_ARRAY_PE_PAYLOAD

PDF comment text contains a VB/VBScript-style decimal byte array, such as c(077),c(090), that decodes to a verified Windows PE executable. The rule is gated on a comment-line Array(c(...)) assignment and a valid MZ/PE header to keep false positives low.
ClamAV: Pdf.Dropper.Agent-7327785-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7327785-0
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`decimal_array_pdf_pe_00000229.exe` `3ae14b5393f33d6d9093e3ea82eb0a3454761fbf8be9cf4d53659820f82a355b`	embedded-pe	PDF raw comment decimal-array PE payload at offset 0x229	32943 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.90, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.