Didier Stevens Malicious Pdf

1. Analysing Malicious Documents One of our resident trainers and fellow Belgian, Didier Stevens, will teach you how to analyse malicious PDF or MS Office documents using his own created Phyton tools in this 2-day course! Course Description PDF exploits and.
2. Didier Stevens Labs 73 Total References Web References Black Hat .
3. Didier Stevens works for Contraste Europe NV. He's a Microsoft Consumer Security MVP and a leading expert on malicious PDF files. You can find his open-source tools on his blog at blog.didierstevens.com.
4. Today, I will show you how to analyze and troubelshoot a corrupted or malicious PDF document.

Didier Stevens' Malicious PDF Analysis Screencasts Didier Stevens has created a web page with all his screencasts on Malicious PDF analysis. Analyzing Malicious PDF Files Since a couple of years, malware authors have turned to PDF documents to deliver malware to Windows machines they desire to infect. Because common executables (EXE files) are often blocked by many e-mail servers and clients.

It will not render a PDF document. The code of the parser is quick- and- dirty, I’m not recommending this as text book case for PDF parsers, but it gets the job done. You can see the parser in action in this screencast. The stats option display statistics of the objects found in the PDF document. Use this to identify PDF documents with unusual/unexpected objects, or to classify PDF documents.

For example, I generated statistics for 2 malicious PDF files, and although they were very different in content and size, the statistics were identical, proving that they used the same attack vector and shared the same origin. The search option searches for a string in indirect objects (not inside the stream of indirect objects). The search is not case- sensitive, and is susceptible to the obfuscation techniques I documented (as I’ve yet to encounter these obfuscation techniques in the wild, I decided no to resort to canonicalization). For the moment, only Flate. Decode is supported (e. This ID is not version dependent.

If more than one object have the same ID (disregarding the version), all these objects will be outputted. This ID is not version dependent. The type is a Name and as such is case- sensitive and must start with a slash- character (/). It’s essentially glue- code for the m. PDF. py module which contains a class with methods to create headers, indirect objects, stream objects, trailers and XREFs. If you execute it without options, it will generate a PDF document with Java. Script to display a message box (calling app.

To provide your own Java. Script, use option –javascript for a script on the command line, or –javascriptfile for a script contained in a file. PDF file with an embedded file. Download: make- pdf. PDFi. D will also handle name obfuscation. The idea is to use this tool first to triage PDF documents, and then analyze the suspicious ones with my pdf- parser.

An important design criterium for this program is simplicity. Parsing a PDF document completely requires a very complex program, and hence it is bound to contain many (security) bugs. To avoid the risk of getting exploited, I decided to keep this program very simple (it is even simpler than pdf- parser. PDFi. D will scan a PDF document for a given list of strings and count the occurrences (total and obfuscated) of each word: objendobjstreamendstreamxreftrailerstartxref/Page/Encrypt/Obj. Stm/JS/Java. Script/AA/Open. Action/JBIG2. Decode/Rich.

Media/Launch/XFAAlmost every PDF documents will contain the first 7 words (obj through startxref), and to a lesser extent stream and endstream. I’ve found a couple of PDF documents without xref or trailer, but these are rare (BTW, this is not an indication of a malicious PDF document)./Page gives an indication of the number of pages in the PDF document. Most malicious PDF document have only one page./Encrypt indicates that the PDF document has DRM or needs a password to be read./Obj. Stm counts the number of object streams. An object stream is a stream object that can contain other objects, and can therefor be used to obfuscate objects (by using different filters)./JS and /Java. Script indicate that the PDF document contains Java. Script. Almost all malicious PDF documents that I’ve found in the wild contain Java.

Script (to exploit a Java. Script vulnerability and/or to execute a heap spray).

Of course, you can also find Java. Script in PDF documents without malicious intend./AA and /Open. Action indicate an automatic action to be performed when the page/document is viewed. All malicious PDF documents with Java. Script I’ve seen in the wild had an automatic action to launch the Java.

Script without user interaction. The combination of automatic action  and Java.

Script makes a PDF document very suspicious./JBIG2. Decode indicates if the PDF document uses JBIG2 compression.

This is not necessarily and indication of a malicious PDF document, but requires further investigation./Rich. Media is for embedded Flash./Launch counts launch actions./XFA is for XML Forms Architecture. A number that appears between parentheses after the counter represents the number of obfuscated occurrences. For example, /JBIG2. Decode 1(1) tells you that the PDF document contains the name /JBIG2. Decode and that it was obfuscated (using hexcodes, e.

For example, a simple text file starting with %PDF- 1. PDF document. Download: pdfid.