Comments on: Embedding and Hiding Files in PDF Documents http://blog.didierstevens.com/2009/07/01/embedding-and-hiding-files-in-pdf-documents/ (blog 'DidierStevens) Sun, 14 Mar 2010 21:22:33 +0000 http://wordpress.com/ hourly 1 By: Didier Stevens http://blog.didierstevens.com/2009/07/01/embedding-and-hiding-files-in-pdf-documents/#comment-37568 Didier Stevens Mon, 01 Feb 2010 09:12:43 +0000 http://blog.didierstevens.com/?p=1548#comment-37568 @Jim P: Take a look at my video: http://blog.didierstevens.com/2008/10/20/analyzing-a-malicious-pdf-file/ @Jim P: Take a look at my video: http://blog.didierstevens.com/2008/10/20/analyzing-a-malicious-pdf-file/

]]> By: Jim P http://blog.didierstevens.com/2009/07/01/embedding-and-hiding-files-in-pdf-documents/#comment-37564 Jim P Sun, 31 Jan 2010 23:39:42 +0000 http://blog.didierstevens.com/?p=1548#comment-37564 /#46#69#6cter [ /AS#43I#49#48#65#78D#65co#64#65 /#4c#5aW#44eco#64e /AS#43I#4985#44e#63o#64#65 /R#75#6eL#65#6e#67#74h#44ecode /#46#6c#61#74#65D#65co#64#65 So I convert the hex to... /Filter [ /ASCIIHexDecode /LZWDecode /ASCII85Decode /RunLengthDecode /FlateDecode ] So looking at this, I assume your pdf-parser.py did it for me since in my example it is already decoded in the lines below. Also, I assume the filter string is telling the application how to decode the blob of code that is associated with the same object within the PDF? I have been able to take the java script blob and decode it. I can see the exploit it is using, etc. I can not see what the phone home address is. My goal is to find the address the malware talks back to. /#46#69#6cter [ /AS#43I#49#48#65#78D#65co#64#65 /#4c#5aW#44eco#64e /AS#43I#4985#44e#63o#64#65 /R#75#6eL#65#6e#67#74h#44ecode /#46#6c#61#74#65D#65co#64#65

So I convert the hex to...

/Filter [ /ASCIIHexDecode /LZWDecode /ASCII85Decode /RunLengthDecode /FlateDecode ]

So looking at this, I assume your pdf-parser.py did it for me since in my example it is already decoded in the lines below.

Also, I assume the filter string is telling the application how to decode the blob of code that is associated with the same object within the PDF? I have been able to take the java script blob and decode it. I can see the exploit it is using, etc. I can not see what the phone home address is. My goal is to find the address the malware talks back to.

]]> By: Didier Stevens http://blog.didierstevens.com/2009/07/01/embedding-and-hiding-files-in-pdf-documents/#comment-37561 Didier Stevens Sun, 31 Jan 2010 22:23:49 +0000 http://blog.didierstevens.com/?p=1548#comment-37561 @Jim P This stream is compressed with 5 filters: /ASCIIHexDecode /LZWDecode /ASCII85Decode /RunLengthDecode /FlateDecode The /Names are obfuscated with hex code, like this: /#46#69#6cter -> /Filter @Jim P

This stream is compressed with 5 filters: /ASCIIHexDecode /LZWDecode /ASCII85Decode /RunLengthDecode /FlateDecode
The /Names are obfuscated with hex code, like this: /#46#69#6cter -> /Filter

]]> By: Jim P http://blog.didierstevens.com/2009/07/01/embedding-and-hiding-files-in-pdf-documents/#comment-37550 Jim P Fri, 29 Jan 2010 21:02:33 +0000 http://blog.didierstevens.com/?p=1548#comment-37550 Take 2 /Length 2901 /#46#69#6cter [ /AS#43I#49#48#65#78D#65co#64#65 /#4c#5aW#44eco#64e /AS#43I#4985#44e#63o#64#65 /R#75#6eL#65#6e#67#74h#44ecode /#46#6c#61#74#65D#65co#64#65 ] /Length 2901 /Filter [ /ASCIIHexDecode /LZWDecode /ASCII85Decode /RunLengthDecode /FlateDecode ] Take 2

/Length 2901
/#46#69#6cter [ /AS#43I#49#48#65#78D#65co#64#65 /#4c#5aW#44eco#64e /AS#43I#4985#44e#63o#64#65 /R#75#6eL#65#6e#67#74h#44ecode /#46#6c#61#74#65D#65co#64#65 ]

/Length 2901

/Filter [
/ASCIIHexDecode /LZWDecode
/ASCII85Decode /RunLengthDecode
/FlateDecode ]

]]> By: Didier Stevens http://blog.didierstevens.com/2009/07/01/embedding-and-hiding-files-in-pdf-documents/#comment-37545 Didier Stevens Thu, 28 Jan 2010 20:36:56 +0000 http://blog.didierstevens.com/?p=1548#comment-37545 @Jim P: it looks like that wast lost with the copy/paste... @Jim P: it looks like that wast lost with the copy/paste…

]]> By: Jim P http://blog.didierstevens.com/2009/07/01/embedding-and-hiding-files-in-pdf-documents/#comment-37543 Jim P Thu, 28 Jan 2010 19:58:00 +0000 http://blog.didierstevens.com/?p=1548#comment-37543 I would like some help as I learn to dissect malicious pdf files. In my example below I am having issues decyphering the string... obj 4 0 Type: Referencing: Contains stream <> Immediately following is the inflated java script which I was able to deflate. However the above I have had no luck with. Also, I am not able to find a IP/Name that the malware could be calling home to. I am hoping it is in the string I have attached. Thank you for any advice during this learning exercise for me. I would like some help as I learn to dissect malicious pdf files. In my example below I am having issues decyphering the string…

obj 4 0
Type:
Referencing:
Contains stream

<>

Immediately following is the inflated java script which I was able to deflate. However the above I have had no luck with. Also, I am not able to find a IP/Name that the malware could be calling home to. I am hoping it is in the string I have attached.

Thank you for any advice during this learning exercise for me.

]]> By: simon http://blog.didierstevens.com/2009/07/01/embedding-and-hiding-files-in-pdf-documents/#comment-36740 simon Fri, 04 Dec 2009 21:18:06 +0000 http://blog.didierstevens.com/?p=1548#comment-36740 This trick is really cool!!! Thank you!!! Simon (from <a href="http://www.despegar.com.mx/airlines/aeromexico/aeromexico.html" rel="nofollow">aero mexico</a>) This trick is really cool!!!

Thank you!!!

Simon (from aero mexico)

]]> By: Didier Stevens http://blog.didierstevens.com/2009/07/01/embedding-and-hiding-files-in-pdf-documents/#comment-36107 Didier Stevens Tue, 10 Nov 2009 16:30:20 +0000 http://blog.didierstevens.com/?p=1548#comment-36107 Yes, adding a new key/value pair to an existing dictionary works too. To avoid unwanted side-effects, use a key with no meaning. Yes, adding a new key/value pair to an existing dictionary works too. To avoid unwanted side-effects, use a key with no meaning.

]]> By: Tony http://blog.didierstevens.com/2009/07/01/embedding-and-hiding-files-in-pdf-documents/#comment-36095 Tony Sun, 08 Nov 2009 19:34:09 +0000 http://blog.didierstevens.com/?p=1548#comment-36095 Hello, a way to embed hidden data in a PDF file wouldn't be to add a new key/value pair in the Dictionary object of the pdf file? The key will be something known that will be used to recover the data that will be stored in the value. This thought came from a post found here: http://forums.adobe.com/message/2157533 Thnx in advance, Tony Hello,

a way to embed hidden data in a PDF file wouldn’t be to add a new key/value pair in the Dictionary object of the pdf file?
The key will be something known that will be used to recover the data that will be stored in the value.
This thought came from a post found here: http://forums.adobe.com/message/2157533

Thnx in advance,

Tony

]]> By: Links for 15th July 2009 | Velcro City Tourist Board http://blog.didierstevens.com/2009/07/01/embedding-and-hiding-files-in-pdf-documents/#comment-35358 Links for 15th July 2009 | Velcro City Tourist Board Wed, 15 Jul 2009 22:03:22 +0000 http://blog.didierstevens.com/?p=1548#comment-35358 [...] Embedding and Hiding Files in PDF Documents [...] [...] Embedding and Hiding Files in PDF Documents [...]

]]>