Malicious PDF — malware analysis report

Static analysis result for SHA-256 c4df49fce38dbf7e…

MALICIOUS

PDF

52.8 KB Created: 2020-08-31 11:46:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6b1129f929cb2a236a2be844a3b02d17 SHA-1: ccc4c1b428ddd042b67529dcd78065449bcc9cd6 SHA-256: c4df49fce38dbf7ea5d4585610fa70063f06be9d81abb1672d4c0d890809410f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. Additionally, it exhibits characteristics of a PDF link farm, embedding numerous external links, with the first identified link being to a Shopify domain. The document body, though heavily obfuscated, contains text related to 'Sims 4 mc command center guide' and 'wkhtmltopdf', suggesting a lure to disguise the malicious intent. The primary malicious URL is 'https://ttraff.com/wix?keyword=sims+4+mc+command+center+guide'.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=sims+4+mc+command+center+guide
    • https://cdn.shopify.com/s/files/1/0434/8392/2585/files/interpersonal_communication_3rd_edition.pdf
    • https://cdn.shopify.com/s/files/1/0439/4264/1832/files/ziduxexifinaf.pdf
    • https://cdn.shopify.com/s/files/1/0427/8901/1612/files/biographies_of_great_leaders_of_the_world.pdf
    • https://static.usrfiles.com/ugd/9421c8_ea5abe911c1e4185afc0102a359584bd.pdf
    • https://static.usrfiles.com/ugd/b8c837_467f2dc5953d4a34aabb7284f47b995b.pdf
    • https://static.usrfiles.com/ugd/b8c837_b01b54efad984754a2f8fd1c8321ce2c.pdf
    • https://static.usrfiles.com/ugd/b11f6d_d2b825d06d074a1da3f20a819f598d8d.pdf
    • https://static.usrfiles.com/ugd/f65518_776ea530f32740fabd5f3541cab4c676.pdf
    • https://static.usrfiles.com/ugd/5de1df_434d15f2d77c444a8ea97fefc32dfe6c.pdf
    • https://static.usrfiles.com/ugd/b8c837_03fc07f525374df0bcae17c46697bc14.pdf
    • https://static.usrfiles.com/ugd/7f16bd_d0dc943d5f164a869580987d8c8e4d5a.pdf
    • https://static.usrfiles.com/ugd/c0b427_f3e5cca9f1b9445fbec92c07b02f7783.pdf
    • https://static.usrfiles.com/ugd/83e24f_80d32425e3fd45d58ebbd3926b7f1691.pdf
    • https://cdn.shopify.com/s/files/1/0433/4524/8407/files/mitotic_inhibitors.pdf
    • https://cdn.shopify.com/s/files/1/0463/2500/6491/files/cara_lagu_di_free_music_iphone.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000087a0.bin
63dc65e5529e905d566a5ce6d8afbbf340541611ab85352efea6c7f879279019		 pdf-font-stream PDF embedded font (sfnt) at offset 0x87A0 5420 bytes
font_01_sfnt_off000099e5.bin
7e8f06ed7fc83758f2b0838d09b3d578ca4259befb4a710b3492e74eb81df669		 pdf-font-stream PDF embedded font (sfnt) at offset 0x99E5 14204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.