PDF Insider exploit analysis tool

CloneRanger · Jul 18, 2010

Not generally released, as yet But looks useful

Analysis of a malformed and exploited PDF

Hi today I’m going to analyze an infected PDF which allows Acrobat exploitation

The file target is called soreheadprattler.pdf
md5: AF485196F31F66B07D87E63DFCA41239
At moment when I’m writing, referring to Virustotal, PDF is detected by 29.27% of AV ( 12/41 ), to be honest, very low rate to the potential of the exploit in question. This PDF, using the Sophos nomenclatur, is identified as Troj/PDFJs-LJ

Let’s go to analyze the PDF.

First of all I take this opportunity to thank my friend Daniel for giving me the opportunity to act as tester, being still under development. Thx =)
The tool in question is PDF Insider, for more info visit ntcore.com.

Opening the PDF file in PDF Insider we immediately notice a malformation.

http://antelox.wordpress.com/2010/07/11/analysis-of-a-malformed-and-exploited-pdf

Just some Acrobat exploits

In this second post I will explain the functions in the javascript code carved out used to exploit the Acrobat vulnerability.

First of all we take a look at the function that acts as a version-check of Acrobat with which the victim opened to read the pdf infected.

http://antelox.wordpress.com/2010/07/11/just-some-acrobat-exploits

In the next post I’ll try to explain what makes the malware downloaded through the PDF.
Click to expand...

Log in or Sign up

PDF Insider exploit analysis tool

CloneRanger Registered Member

Log in or Sign up

PDF Insider exploit analysis tool

CloneRanger Registered Member

Useful Searches