Matt's Primer for PDF Analysis
Summary: Cisco Talos' VRT describes a PDF analysis primer covering the obj structure, where object number and genid form a unique identifier within the PDF spec. The article shows how attackers use ASCII hex encoding after a '#' character to obscure tags like JavaScript, and walks through an OpenAction->JavaScript->FlateDecode sequence that leads to randomized variable names, a heap spray, and an exploit of the media.newPlayer vulnerability in Adobe Reader (CVE-2009-4324).
Bottom line: The chain described here - an OpenAction tag that executes immediately, a deflated JavaScript stream, and randomized variable names meant to defeat IDS/AV signatures - is a reminder that a PDF can carry executable logic the moment it is opened, and that CVE-2009-4324 is still the kind of thing showing up in Talos' data feeds.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2009-4324
- Related
- CVE-2009-4324: Adobe Acrobat and Reader Use-After-Free Vulnerability Known Exploited Vulnerabilities · Jun 08, 2022Adobe Reader media.new Player() Analysis (CVE-2009-4324) Cyber Risks ·iPack Exploit Kit Bites Windows Users Cyber Risks ·