Obfuscated script code in malicious PDF files
June 30th, 2008
One of the features of the Portable Document Format (PDF) is the ability to embed JavaScript code within the document. With this powerful scripting language at hand, the multimedia possibilities of PDF documents can be enhanced by adding some interactive magic to it. Of course, it didn’t take long for malware authors to abuse this interface for their evil deeds and they began to include malicious scripts into PDF documents. In order to avoid detection, they are already using strong obfuscation techniques and it’s getting even harder to manually decode and analyze these scripts if the origin of the document is unknown. The reason for this is the key for the decryption algorithm being outsourced - it’s not included with the script anymore.
That nasty, unreadable script code displayed in the screenshot above is taken from a malicious PDF document. In order to get that, it first needs to be extracted from the compressed stream of the PDF that it is stored in. A subsequent closer look reveals the decoder using the ‘location.href‘ property - which returns the current document’s location (URL). Without having the correct URL, attempts to decode the script will fail and you’ll only get rubbish, as the document’s location is the key used to encrypt the script.
But once the correct URL is provided as the script’s key, it can easily be decoded - to another piece of obfuscated JavaScript code. After having decoded that one as well, the original plain script code becomes visible, unravelling exploit code that attempts to install further malware.
These PDF documents with strongly obfuscated script code are blocked proactively by Secure Computing’s Anti-Malware engine as ‘Exploit.PDF.RecurseDecrypt.gen‘. Any document carrying suspicious-looking code like this is blocked at the gateway regardless of the exploit code it uses. Script code making use of heavy obfuscation methods like this are a typical sign for malware and should never ever be used within legitimate documents.
Author: Anti-Malware Team
Back to TrustedSource™ Blog overview
