PDF malware analysis — malicious · 40bbe71c55eebc0b

MALICIOUS

PDF

48.4 KB Created: 2020-08-29 02:45:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4a2f8542be1c71cf136cfdece155ab2d SHA-1: 3c96864bcf58c1b427fbd0ba8db33b5f3c9a8ac9 SHA-256: 40bbe71c55eebc0b74e7a367d1b37b3d23b09ee5ca513afd3973f888bef33cc0

160 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.001 Malicious Link: User Execution

The PDF document contains a social engineering lure, presenting a fake error message about 'Battlefront 2 won't launch' to trick the user into clicking a malicious link. This link, 'https://ttraff.cc/wix?keyword=battlefront+2+won%2527+t+launch', is identified as a malicious redirector. The document also functions as a link farm, pointing to numerous other PDFs, likely for SEO poisoning or to distribute further malicious content.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClickFix social engineering attack high SE_CLICKFIX

Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=battlefront+2+won%2527+t+launch
- https://cdn.shopify.com/s/files/1/0433/7070/9150/files/78307313817.pdf
- https://cdn.shopify.com/s/files/1/0438/1219/2413/files/28906924828.pdf
- https://cdn.shopify.com/s/files/1/0429/6871/1321/files/nutiluvoxupade.pdf
- https://cdn.shopify.com/s/files/1/0433/6956/2266/files/pejisimoxuk.pdf
- https://cdn.shopify.com/s/files/1/0434/5102/3526/files/3580297114.pdf
- https://cdn.shopify.com/s/files/1/0434/0213/3671/files/32088716206.pdf
- https://static.usrfiles.com/ugd/b8c837_22bc19524ce3429b82a7f7c3e132ef20.pdf
- https://static.usrfiles.com/ugd/b8c837_6eb42687800c443eb52a2112910756ff.pdf
- https://static.usrfiles.com/ugd/b8c837_3f3fbc9f2fba4818ba50ef98047c3bf5.pdf
- https://static.usrfiles.com/ugd/b8c837_6718665c2c244bb0a2cd4bbcf9101354.pdf
- https://cdn.shopify.com/s/files/1/0438/3758/7613/files/pelicula_de_spirit_en_espaC3B1ol.pdf
- https://cdn.shopify.com/s/files/1/0438/0576/9888/files/spyder_4_software.pdf
- https://cdn.shopify.com/s/files/1/0433/7808/1955/files/firefox_windows_xp.pdf
- https://cdn.shopify.com/s/files/1/0439/4264/1832/files/36598724386.pdf
- https://cdn.shopify.com/s/files/1/0441/1890/0888/files/wallpaper_3d_full_hd.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007854.bin` `6489109cc510ff20aaa618e673676a809bb9be5a7ceb781990cd7348a7cf6da9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7854	5096 bytes
`font_01_sfnt_off000089bf.bin` `390d7fd3e92db8025f57571fb5f2912b82a77582c99c7b9ad62b9f72497234a5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x89BF	13036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.