Ever since I read about the incremental updates feature of the PDF file format, I’ve been patiently waiting for a malicious PDF document with incremental updates to come my way. Thanks to Bojan, that day has finally arrived.
data.pdf is very interesting to me: it’s one PDF file containing 5 incremental updates, essentially bringing us an archeological record of the malware author’s trial-and-error session. So let’s start uncovering what the malware writer has been up to.
Looking at the type of objects inside data.pdf (with my PDF parser), we can see many startxref and xref objects:
The metadata of data.pdf reveals that the guy (from personal experience, I know that most bad programmers are males ) used Adobe Acrobat 8.1.0 to create this document in the early hours of Thursday November 6th 2008, and that his machine has timezone setting +01:00.
44 seconds later, a second version is created, containing this script:
This script performs a heap spray (the most indented section of function main) of shellcode (contained in variable sccs) and then exploits the util.printf format string bug. This exploit is contained in function main, which should be triggered by app.setTimeOut after 3 seconds. However, the use of setTimeOut in this script is buggy (details can be found in Adobe’s JS API Reference), and main() will never execute.
After 44 seconds, another version is created to try to get this exploit to work. He modified the call to setTimeOut like this:
This is completely wrong, so after 4 minutes and 12 seconds (probably spend Googling for an answer as to why this doesn’t work), he returns to the previous call, but now hopes that 5 seconds will do better than 3 seconds.
Of course, it doesn’t. After one minute and a half, he gives up, and modifies the script to execute his exploit without delay:
I can’t say he’s a sharp programmer or tenacious, but at least, he’s result-driven…
Bojan confirmed he was the first to submit these files to Virustotal. I calculated the MD5 hashes for the different versions of data.pdf, but none were submitted to VT, so our guy didn’t use VT for QA.
It was an interesting experience, “spying” on this malware author. Let’s hope they don’t stop using incremental updates, and that some of them will be careless enough to leave personal data hidden in their malicious PDF documents.
data.pdf MD5 1A8E5242F21727959683FA8CC7AA94AD
info.pdf MD5 23F31C83EE658BB5C2635BEFDE56199A