PDF malware analysis — malicious · d7bcc53fb7dfeb1a

MALICIOUS

PDF

38.4 KB Created: 2020-09-03 02:07:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6bb1a7d6257ed647d5595ca164b6cf6f SHA-1: 912efe9d44a7ecdca983645453f461551b029b87 SHA-256: d7bcc53fb7dfeb1a25bcff745ab800c2e95f026b0b6843d7f95bcf8917928fde

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link farm and a specific redirector URL, indicating a phishing or malicious redirection attempt. The document body, though heavily garbled, contains text related to a 'Frigidaire ice maker troubleshooting guide' and the malicious URL, suggesting a lure to a scam or malware distribution site. The presence of numerous links to external PDFs hosted on static.usrfiles.com, combined with the malicious redirector, points to a coordinated effort to drive traffic to potentially harmful content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=frigidaire+ice+maker+troubleshooting+guide
- https://static.usrfiles.com/ugd/b8c837_65e21b207f954b5aa20bf575f0bf44ab.pdf
- https://static.usrfiles.com/ugd/c7ef1a_8bfcf6bf7d2e45ca8e08770595bfb546.pdf
- https://static.usrfiles.com/ugd/b8c837_349c252372984fe9b3410c02ef022d81.pdf
- https://static.usrfiles.com/ugd/bae363_1e99f8103088450aa02ba1353ade7885.pdf
- https://static.usrfiles.com/ugd/238140_40a4fcca7408459ba46fa2f3fc3a971b.pdf
- https://static.usrfiles.com/ugd/b8c837_3cb3d912147b4bcf965305c13a1a36b4.pdf
- https://static.usrfiles.com/ugd/b3bc21_5fba19e5bf4c4c1bb4883f8aef6b09fc.pdf
- https://static.usrfiles.com/ugd/0bcf16_8f1fff20f942463a82d04bbc1d9a98ae.pdf
- https://static.usrfiles.com/ugd/957eb4_3b1c9339cb574d33a70511e76655e2d0.pdf
- https://static.usrfiles.com/ugd/9d869b_24c70d5a27ed401285e16a7ad0ca0dca.pdf
- https://static.usrfiles.com/ugd/299074_e03c2071bce742798ce8da96a022141f.pdf
- https://static.usrfiles.com/ugd/d2751c_ac2b5eee17364374bafd19f5ffee4310.pdf
- https://static.usrfiles.com/ugd/0d002d_20ccadc4b2434987b805a4474db0c84a.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004c55.bin` `02405e04e184c026d31e0cbe2f7bd0f4d965be23286452be672d787c8f4339ee`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4C55	5396 bytes
`font_01_sfnt_off00005e7c.bin` `3eefb955ba32554a354aa9a3d2e1be825ebe762ae527ccca49798e5b87cd631c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5E7C	9432 bytes
`font_02_sfnt_off00007ea8.bin` `ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7EA8	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.