Effects Malware hunting in Cloud environment
summary
Shows a reproducible chain: a malicious PDF (one sample has 15 objects, 2 streams, 5 JS refs) uses a magic number trick to bypass upload checks, embeds obfuscated JavaScript extracted with PDF ID and PDFParser, is uncompressed with pdftk uncompress to reveal JS that decodes UCS‑2 into a Windows payload and triggers a reverse shell (payload traced to an IP in Estonia). Demonstrates file‑upload and CV/invoice vectors, and an AWS escalation using create policy version exploit to gain full access; a free sandboxed tool for hunting such misconfigs is published.
AI-written summary · about
chapters (9)
- 0:00Malware hunting in Cloud
- 4:42Security threats and investigation
- 10:03File manipulation techniques
- 17:50File upload vulnerabilities
- 25:02PDF file structure analysis
- 31:52Malicious PDFs with JavaScript
- 48:47Cloud security model
- 53:00AWS IAM misconfigurations
- 1:00:05Mitigation tools demo
related talks
48mDiscovering C&C in Malicious PDF with Obfuscation, Encoding and Other Techniques
49mPDF Attack: A Journey from the Exploit Kit to the Shellcode (Part 1/2)
01h 06mPDF Attack: A Journey from the Exploit Kit to the Shellcode (Part 2/2)
01h 02mPrompt-Jacking: The Rise of a New Supply Chain Risk
52mFlying Under the Radar - New Security Evasion Techniques
44mWhen you can't afford 0days: Client-side exploitation for the masses
46mLiving off the Cloud: A Server-Free Approach to Malware Ops
47mDetecting and analyzing files-less malware