PDF malware analysis — malicious · fe8a23c48791baf0

MALICIOUS

PDF

4.9 KB Created: 2011-04-05 23:46:28 Authoring application: bub lob

MD5: 97d2fc5666dd14cc329e58edc9ffe2a6 SHA-1: 07e5fa42d9c73e38d864c0a2c591558fde780494 SHA-256: fe8a23c48791baf0c06038a9f2803c0d1d1cb0390c432807add739cb0e609ce3

66 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: User Execution T1566.002 Phishing: Spearphishing Attachment

The PDF file was flagged by a machine learning classifier with high confidence as malicious. Heuristics indicate the presence of an embedded script payload within a PDF stream, suggesting an attempt to execute malicious code upon opening. The ML_NYX_PDF_MALICIOUS heuristic firing strongly supports this. No document body text was available for analysis, but the embedded script is the primary indicator of malicious intent. The SHA256 hash is included as a primary IOC.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_001_off00000331.js` `26fecc438e63067ddda47d1691b4ecd4b085df6f7dc13eb372967daf8c796d36`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x331	13627 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.