Malicious PDF files identified

A wave of malicious PDF files have been identified by ESET.

The company has reported that malicious PDFs have been created to exploit security flaws in PDF reader software with more than 25,000 attacks involving this type of file identified in the last two weeks.

Attackers are exploiting two vulnerabilities in Adobe Acrobat Reader to execute arbitrary code on computers, and are installing malware. Although versions of Adobe Acrobat Reader higher than 8.1.1 are not vulnerable to these attacks

ESET claimed that it had ‘seen malicious PDFs being distributed as email attachments but also in exploitation packs like NeoSploit that use this file as another way to attack web browsers.'

It further said that multiple layers of obfuscation have been introduced into PDF files to try and evade the antivirus detection. The first layer is in the PDF file which can be compressed using zlib compression, which authors use to hide their javascript from direct inspection.

The javascript then checks the reader's version, builds a shellcode and places everything in memory, and then calls on the vulnerable function. In a majority of cases, the shellcode is also obfuscated using another layer of javascript obfuscation.

See original article on scmagazineuk.com

Copyright © SC Magazine, US edition

filesidentifiedmaliciouspdfsecurity