Malicious PDF File Analysis Example

Suspicious PDF files can be checked either with the help of antiviruses or manually using third-party utilities. Often, anti-virus scanners are not so effective when it comes to malicious PDF files containing encrypted shell code, which typically exploits vulnerabilities in Adobe Acrobat Reader zero day. Before starting the analysis, we will get acquainted with the structure of the PDF document, which is better to understand how the shell code works and where.

Suspicious unlock PDF online files can be checked either with the help of antiviruses or manually using third-party utilities. Often, anti-virus scanners are not so effective when it comes to malicious PDF files containing encrypted shell code, which typically exploits vulnerabilities in Adobe Acrobat Reader zero day. Before starting the analysis, we will get acquainted with the structure of the PDF document, which is better to understand how the shell code works and where.

PDF document structure

Headline

The first line indicates the version by which the PDF file was created. For example,% PDF-1.4 means that the file was created in the fourth version.

Body

The body of the PDF file includes objects that form the contents of the document. Objects are fonts, images, annotations, and text. In addition, the user can add invisible objects or elements. Objects may relate to functions, such as animations or security related functions. The body of a PDF file supports two types of numbers - integer and real.

Cross reference table (xref table)

This table contains all references to objects and elements supported by the PDF format. In addition, the cross-reference table allows you to view the contents of the remaining pages. When the user changes the file, the table is updated automatically.

The final part

The final part contains links to the cross-reference table and always ends with the word % % EOF, which means that the file has ended. The final part may contain links to other pages.

Creating a malicious PDF via Metastploit

After we briefly got acquainted with the structure of the unlock PDF file, we will install the old version of Adobe Acrobat Reader (9.4.6 or 10-10.1.1) with the vulnerability Adobe U3D Memory Corruption Vulnerability. We will create a malicious PDF file using Metasploilt. The analysis will be based on the KALI Linux distribution. Open a terminal and type msfconsole. For everything to work without a hitch, you need to set some variables.

After choosing the type of exploit, you must specify the payload that will be used during the exploitation of the vulnerability on the remote machine. Then open in Meterpreter.

One of the parameters when creating the file is LHOST, where the IP address of our machine is entered (to find out the IP address, you can enter the ifconfig command in another terminal). After setting the parameters, we indicate the type of exploit and create a malicious PDF file.

Malware analysis

We go into the folder with the malicious file and enter the command / usr / bin / peepdf –f msf.pdf. The –f option causes the utility to ignore all errors. First, we see a highlighted object “object 15” with JavaScript code. Next is a single object 4 with two elements: / AcroForm and / OpenAction. The final object is / U3D, indicating that the PDF is trying to exploit a known vulnerability. We will view the found objects in the interactive console. Enter the command / usr / bin / peepdf –i msf.pdf.

Security methods

Here are some ways to protect against malicious files:

·         Filter email and web page content.

·         Using an intrusion prevention system.

·         JavaScript prohibition.

·         Prevent the display of PDF files in browsers.

·         Deny access to the file system and network resources for applications designed to read PDF files.