Over at the SANS ISC diary I wrote a diary entry on the analysis of a PDF file that contains a malicious DOC file.
For testing purposes, I created a PDF file that contains a DOC file that drops the EICAR test file.
The PDF file contains JavaScript that extracts and opens the DOC file (with user approval). The DOC file contains a VBA script that executes upon opening of the file, and writes the EICAR test file to a temporary file in the %TEMP% folder.
You can download the PDF file here. It is in a password protected ZIP file. The password is eicardropper, with eicar written in uppercase: EICAR.
This will generate an anti-virus alert. Use at your own risk, with approval.
pdf-doc-vba-eicar-dropper.zip (https)
MD5: 65928D03CDF37FEDD7C99C33240CD196
SHA256: 48258AEC3786CB9BA032CD09DB09DC66E0EC8AA19677C299678A473895E79369
Didier Stevens 
AV is missing both macro based docs at the moment and now the PDF packed delivery should add an extra layer to bypass current detection technologies. Good for the bad … bad for the good.
Comment by Reddevall — Friday 28 August 2015 @ 18:57
I have JavaScript disabled in my Adober Reader, so of course, nothing happened. I enabled JS for this doc once only. OpenOffice then opened the doc, but as macros are disabled, nothing happened again. Only signed macros from trusted sources are allowed to run, per my settings. I’d have to go to a bit of extra work to get this macro to run. I guess my setup is reasonably secure! 🙂
Comment by Anonymous — Saturday 29 August 2015 @ 2:00
[…] Here is how I created the PDF document from this blogpost. […]
Pingback by The Making Of: PDF With Embedded DOC Dropping EICAR | Didier Stevens Videos — Monday 31 August 2015 @ 0:08
Did the password change? “EICAR” doesn’t work.
Comment by Anonymous — Tuesday 1 September 2015 @ 23:38
Nevermind. I re-read the post and got the right password
Comment by Anonymous — Tuesday 1 September 2015 @ 23:39
[…] was asked how one can mitigate my PDF-DOC-VBA test file in Adobe Reader. This video explains […]
Pingback by PDF With Embedded DOC And VBA: Reader Mitigation | Didier Stevens Videos — Wednesday 2 September 2015 @ 0:02
I run it: it works fine as described. I first got a pdf-macro warning and, after enabling Word Viewer to process Word-file, I got a Word macro-warning. These are 2 of my own security measures. Al last MSE said that there was no action required. Good test also. Thanks for the effort in this Didier.
Comment by John Heijmann — Wednesday 2 September 2015 @ 8:53
password eicardropper doesn’t work?
Comment by Anonymous — Thursday 3 September 2015 @ 6:19
Yes it does. Read the instructions closely.
Comment by Didier Stevens — Thursday 3 September 2015 @ 6:20
I had no question from ‘COMODO Antivirus’ at all. Nevertherless the EICAR dropper file name was like ~DF5467.tmp and file size (not on the disk) is 512 bytes all time. ‘eicar-dropper.doc’ was opened by means of ‘Microsoft Office Word Viewer (11.8420.8420) SP3’ and no macro warning was issued. Meanwhile I was not able either to get any hashes of or copy it.
What is actual dropper so?
Comment by Andriy — Friday 11 September 2015 @ 12:46
So it worked. The eicar file was created.
Comment by Didier Stevens — Friday 11 September 2015 @ 12:59
“Nevertherless the EICAR dropper file name was like ~DF5467.tmp and file size (not on the disk) is 512 bytes all time.”
Sorry, that was a mistake, I was wrong.
Once again, in my case the EICAR dropper file name was like ‘rad9A2F3.tmp’ :
CRC32: 6851cf3c
MD5: 44d88612fea8a8f36de82e1278abb02f
SHA-1: 3395856ce81f2b7382dee72602f798b642f14140
SHA-256: 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f
SHA-512: cc805d5fab1fd71a4ab352a9c533e65fb2d5b885518f4e565e68847223b8e6b85cb48f3afad842726d99239c9e36505c64b0dc9a061d9e507d833277ada336ab
and file size 68 bytes.
Comment by Andriy — Friday 11 September 2015 @ 14:24
That’s the hash of the EICAR test file. More evidence that the EICAR test file was created on your system.
Comment by Didier Stevens — Friday 11 September 2015 @ 22:03
[…] produced videos showing how I created my “Test File: PDF With Embedded DOC Dropping EICAR” and how to change the settings in Adobe Reader to mitigate […]
Pingback by PDF + DOC + VBAs Videos | Didier Stevens — Monday 21 September 2015 @ 10:46
[…] In this post, I’m going to illustrate how I analyze a suspicious Pdf file. The target file is provided by Didier Stevens. […]
Pingback by PDF malware analysis With Embedded DOC Dropping EICAR – VINH THE NGUYEN – Blog — Tuesday 27 February 2018 @ 5:47