Discovering C&C in Malicious PDF with Obfuscation, Encoding and Other Techniques
summary
Scan of a malicious PDF reveals 15 objects and an open action executes JavaScript that auto-runs on open; analysis uses file/libmagic, pdfid and pdf-parser (DjVu/DJ Stevens tools), extracting five JS streams and one large stream that decodes to a payload. Obfuscation is percent‑encoded Unicode (UTF‑16/uc2) inside JS; decoding via an HTML unescape workflow produces a binary which, after reassembly and HTTP extraction, reveals a live C2 server IP.
AI-written summary · about
chapters (6)
- 0:00Introduction and speaker intro
- 4:54Understanding threats and malware analysis
- 12:39File identification and magic numbers
- 28:37PDF structure and analysis tools
- 39:32Obfuscation and payload extraction
- 45:57C&C server discovery and conclusion
related talks
01h 03mEffects Malware hunting in Cloud environment
01h 06mPDF Attack: A Journey from the Exploit Kit to the Shellcode (Part 2/2)
49mPDF Attack: A Journey from the Exploit Kit to the Shellcode (Part 1/2)
33mPDF - Mess With The Web
40mLearning from the Enemy: A Look Inside the Techniques of Ocean Lotus /APT32
25mCommSec D1 - A Deep Dive Into Malicious Documents
37mAbusing Adobe Reader’s JavaScript APIs
42mMac-ing Sense of the 3CX Supply Chain Attack: Analysis of the macOS Payloads