Knowing that, let’s look at some PDF malware.
Indirect objects are usually what we’re paying attention to when analyzing PDF malware, and can be referenced by other objects in a PDF file. The objects can either be direct or indirect, and there are eight different types of objects.ĭirect objects are inline values in the PDF (/FlatDecode, /Length, etc) while indirect objects have a unique ID and generation number (obj 20 0, obj 7 0, etc).
Some PDF files don’t have a header or trailer, but that is rare. Once exploitation succeeds, a malware payload can infect a PC using elevated privileges.įor these reasons, it’s good to know how to analyze PDF files, but analysts first need a basic understanding of a PDF before they deem it malicious: here is the information you’ll need to know.Ī PDF file is essentially just a header, some objects in-between, and then a trailer. However, Adobe Reader has a history of vulnerabilities and gets exploited quite a bit.
Adobe Reader-formerly Acrobat Reader-remains the number one program used to handle PDF files, despite competition from others. Chances are you’ve probably used Adobe Reader before to read Portable Document Format (PDF) files.
0 kommentar(er)
