![]() ![]() We will either need a script or some special tool to perform rapid conversions. However, due to the sheer amount of character references we have, it would take some time to convert these manually. In order for us to understand what these character references represent, we need to consult the ASCII table. These are control characters that do not represent a printable value. In HTML, character references to are not allowed, except for 9, 10, and 13. ![]() These values are numeric character references (NCRs). It would seem the length of the data stream is not 0 as originally led to believe. Inside the script you’ll see a very long sequence of characters. Python pdf-parser.py -f -o 8 -w pdf_malware.pdf > object8.txtĪnd now we’ll look at the output, which appears to contain some JavaScript. We’re going to look specifically at the raw output of 8 0 using the following command (the output was quite long, so I sent it to a text file): Now that we have our eyes on 8 0, we should investigate it further using pdf-parser. With a malicious PDF, that usually means JavaScript exploit code is inside, which will likely lead to the execution of shellcode. Streams are basically large sets of data. Inside 8 0 we see there is a stream that appears to be zero-length (/Length 0). Here is where things start to get interesting. However, obj 21 references obj 8 0, so let’s stay focused on the first one. The generation number simply represents the version number of the object and increments whenever there are multiple instances of one object ID. There are two objects available with different generation numbers: obj 8 0 and the other 8 2. Since there is no obj 100, we’ll take a look at obj 8 instead. Next to XFA we see two objects referenced: obj 100 and 8. From object 21, we see the text "XFA", which stands for XML Forms Architecture, an Adobe format used for PDF forms. The AcroForm object references object 21 below. For this, we’re going to use a different tool by Stevens called pdf-parser, which will take a closer look at specific PDF objects. From those objects there are two streams, along with an AcroForm object. The output from PDFiD reports there are nine objects. Here is the output from the scan of our target file. PDFiD is the first tool we will use, and is a very simple script that searches for suspicious keywords. For this particular malware, we’ll be using Stevens’ tools along with some other tools used to de-obfuscate and debug code. Stevens’ tools are all written in Python and are very well documented. I find the PDF tools by Didier Stevens to be some of the best out there. The first thing we need is analysis tools. For reference purposes, the md5 hash of our target file is 9ba98b495d186a4452108446c7faa1ac. We’re going to observe a PDF that exploits CVE-2010-0188, a very common exploit found in the wild. Knowing that, let’s look at some PDF malware. Indirect objects are usually what we’re paying attention to when analyzing PDF malware, and can be referenced by other objects in a PDF file. The objects can either be direct or indirect, and there are eight different types of objects.ĭirect objects are inline values in the PDF (/FlatDecode, /Length, etc) while indirect objects have a unique ID and generation number (obj 20 0, obj 7 0, etc). Some PDF files don’t have a header or trailer, but that is rare. Once exploitation succeeds, a malware payload can infect a PC using elevated privileges.įor these reasons, it’s good to know how to analyze PDF files, but analysts first need a basic understanding of a PDF before they deem it malicious: here is the information you’ll need to know.Ī PDF file is essentially just a header, some objects in-between, and then a trailer. However, Adobe Reader has a history of vulnerabilities and gets exploited quite a bit. Adobe Reader-formerly Acrobat Reader-remains the number one program used to handle PDF files, despite competition from others. Chances are you've probably used Adobe Reader before to read Portable Document Format (PDF) files.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |