MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1059.003 Windows Command Shell
T1204.002 Malicious File
The PDF file contains a launch action that executes cmd.exe. The command line parameters indicate an attempt to echo a string that likely contains obfuscated commands for downloading and executing a secondary payload. The document body is encrypted and unreadable, but the heuristic firings strongly suggest a malicious intent to execute arbitrary commands.
Heuristics 2
-
Launch action critical PDF_LAUNCHPDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
-
/Launch action target: cmd.exe critical PDF_LAUNCH_COMMANDPDF /Launch action specifies an executable target with parameters '/C echo Set fso=CreateObject("Scripting.FileSystemObject"' — references a known-dangerous executable (cmd, PowerShell, etc.).
Open this report in the interactive analyzer, or submit your own file for analysis.