PDF malware analysis — malicious · 47c99fbb1914734f

MALICIOUS

PDF

41.6 KB Created: 2020-08-31 11:12:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5c4bdf0483c43685dcf3af57dcbb7218 SHA-1: 29a19b9001d1559e49810cff5c0e8e4596cef542 SHA-256: 47c99fbb1914734f5bd0627fbf61881cea0f60ab7278f157b2f096a04c1aae4a

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass external link farm, with one link pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text and URLs that suggest a lure, possibly related to 'custom aspirations sims 4'. The presence of a visual download button heuristic further supports the social engineering aspect. The primary malicious IOC is the redirector URL.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=custom+aspirations+sims+4
- https://static.usrfiles.com/ugd/b8c837_1035d7638ebd4db7a7bd4b6e53a0d5f9.pdf
- https://static.usrfiles.com/ugd/89c6ad_1bc9fdabd9e84c21a672565adeed61ec.pdf
- https://static.usrfiles.com/ugd/58a813_db034220e515497297afef3bff1ef42e.pdf
- https://static.usrfiles.com/ugd/ee9d3f_fd10de73e0a4430dbcfad98ad504c36b.pdf
- https://static.usrfiles.com/ugd/b8c837_9b7f122c35bf4c06913c209b901232f2.pdf
- https://static.usrfiles.com/ugd/ae059d_c18a234c5d5241b781085e4457876952.pdf
- https://static.usrfiles.com/ugd/289c5e_e51b158a65c548db88d62a50b9af3f53.pdf
- https://static.usrfiles.com/ugd/b8c837_a8de0b5250514b5fb7de2c281ec5ba82.pdf
- https://static.usrfiles.com/ugd/40512e_08656c26167f4a85be76f5415c898a82.pdf
- https://static.usrfiles.com/ugd/1f2646_7359e4e1ec084678bc5b897c926eb7b4.pdf
- https://static.usrfiles.com/ugd/2e79a6_49e966e057724878b58a0fa7bd2c42e6.pdf
- https://static.usrfiles.com/ugd/ea2f88_041528d0972f4b0a87dddaa8502d1366.pdf
- https://static.usrfiles.com/ugd/b7082a_e9fc9c0652c14ef9b6c9f66158ccc5a4.pdf
- https://static.usrfiles.com/ugd/b8c837_2e4e9d4e11fb4c6595592d5dabff8ae7.pdf
- https://static.usrfiles.com/ugd/b8c837_7c8b2143903642f8994781e8bcc85afc.pdf
- https://static.usrfiles.com/ugd/23e9be_d2396d24037341a9ae1a843ae888b5ad.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://static.usrfiles.com/ugd/ea2f88_041528d0972f4b0a87dddaa8502d1366.p

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000065ec.bin` `7320cb689e169f9ccf67b843d3b1401425a4a01db2308cf0f8f48cd854ee55dc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x65EC	4924 bytes
`font_01_sfnt_off00007697.bin` `bf74ce7b59cef3387aa1f9254fd5f39a357bd23db34aab2996fafa91893e255b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7697	10128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.