so yeah my name is Oh Jonathan Ross I'm
here to discuss that obfuscation and PDF
malware on how I nearly created a flood
so a micelle from a 43 ethical hockey
shouldn't hear a Bertie hey miss Gwen
Snell enough looking for a gradual I've
got a I'm currently interning as a cyber
security consultant with their curious
Frank which as a division of the
Scottish business of selling center I've
got a past experience and IT support
I'm interests include red teaming
offensive security anti fetching and all
other one who said human be secure so
yeah that wants to come I'm gonna start
covering about the basics of PDFs
themselves and malware and some of the
skating techniques how they work how
these obfuscation attorneys can apply
and evaluating them how effective they
are or not have 18 antivirus I name
could open the floor up questions before
I start no I'd like a bit Shoto to him
dear Stevens because I based a lot of my
work on heads is he's gonna like the
grandfather of the kind of PDF document
bit smaller so here for dummies back to
basics so for those who don't know
basically what PDF is is a document
obviously but it's gonna praise due to
its rich feature set and compatibility
the idea of cross-platform so it's very
widely available so it's contrasting
because and PDFs can contain embedded
executables or even be used to execute
JavaScript a bit embedded within it so
the JavaScript is gonna use for more
likes of enhancing appearance and
additions like kind of dynamic forms and
tables so in terms of actual structure
PDF is consider for parts and you've got
a header which is a kind of tailor to
the version the PDF has been used and
the body which is made up of objects so
this is where all your content has all
your images all your forums and stuff
like that the crowd cross-reference
table or the xref tables that specifies
the positioning of all these objects and
then there's a trailer which has
information that we're talking starts so
in turn flash objects within the body
they can include the likes of numbers
arrays that trace our screens so screen
these are really important to us and I'm
going to discuss that more later but
that's more about em you can finish
dreams you can actually that's where you
can physically embed data so
example as one of Samantha's papers on
PDF malware at the top here we've got
the PDF header I mean the first object
first object declaration second one here
I mean you've got cross-reference table
and the driller so maybe not some PDF
malware like itself so why why is it
being used so it's kind of everything
was less well of all the Mac with a
smile or at least in my opinion when I
was doing this project for university
the first thing I did was a Google PDF
malware and leaving out the first thing
that came up in Google was can a PDF
contain malware which I thought was
quite interesting but to connect put
into context semantic and the 22 2010
paper the rise of PDF malware actually
said that the PDF Malheur is not macro
marsden don't gonna the parent and also
a bit more context so everyone's like
yes you can head to the malware but are
there vulnerabilities and and past
tuesday on december of last year at door
we actually fix 87 vulnerabilities
within readers silver is darvon
developers out there and also virtually
every pc as a PDF reader so attacks are
preserve a lot wider than someone for
example using Microsoft Office and terms
actually executing the malware and the
either within JavaScript within PDF
streams as I discussed or it could be an
executed via
executables the trigger on open the PDF
now currently the JavaScript base like
kind of malware is more popular purely
because back in 2010 and Adobe Reader
main version 9.3 3m departure so that
you can actually use executables anymore
so Delta station turning some by discuss
will focus more on actual JavaScript
side of things rather next before side
of things so going for Elephants
creation techniques the first one we've
got the HDD file format so XML data
package basically Dalby created that's
two so they could convert PDF to an XML
format
so why is it use the malware and
obfuscation to me so basically back to
the principle that M has it's kind of a
weird unusual format the antivirus
vendors can't or their system cache
detect it is the door really know what
is moving on or rather this is actually
what our xdd file looks like so it's
made up of XML header up here there's
chunk in the middle is just
a base64 encoded representation of
contents of a PDF and then there's a
little at the bottom there it's a pretty
basic stuff
next up with my a Jeff Spock I don't
actually know the that's just kind of a
that's not the technical term part but
within geography but within JavaScript
is possible to represent anything with
these following six characters so for
example this is how your episode the
number five using GF Spock so I'm gonna
work through an example if I do this
really horrible that I apologize but I'm
just going to go with it so this is how
you represent the character e energy s
fun so we're gonna break that into two
parts got red and green soybeans
colorblind but I am so if you have an
open square bracket close bracket that's
nothing so I've just a few knots nothing
here that becomes false and if you're
not that again that becomes true surfer
a lot comes true plus nothing equals
true so the second part here it's and
not plus nothing okay few times that
becomes not nothing which becomes true
three trees becomes one plus one plus
one plus one equals three and therefore
third item in theory becomes news that
make sense thanks Mike so I don't
actually know who do not make those up
Scott brain is it brain for maybe
based operators like that yeah this is
if a lot antivirus are gonna look for
keywords and look for instances of
shellcode and one on this kind of just
gonna disguise it there is an issue and
adds complexity and adds like the file
size will if you can imagine it
right so if that's how you represent e
the imagine if you're kind of encoding
an entire chunk of JavaScript with that
oh so execution time slows down next
we've got Java JavaScript string a
police method which is pretty much to
search in a place so the idea is you
take a word so use the replace function
on an object or a variable per regular
expression for example what you want to
replace the word with and then rewarded
once the word that you want or rather
that's working for and then that's we
want to replace less so I've got quick
example up here so far a the dog went
for a walk
to pass carrot here and the regular
expression I've seen replace or replace
the letter replace all instances of
thought with electric age as battle
become my dog went for a walk and I
counted past got scared so why do we use
it
so antivirus as I said earlier often
looks trendy selects a shellcode and
function names and by disguising the
shell cord by basically making sort
looks like it's not there and then
reassembling it later on before
execution sometimes i bypass antivirus
hinari but this webinar recording /
impression stream of objects using
certain filters so basically what in
PDFs is possible to compress it
compressed streams or encrypt streams or
encode them an attempt to kind of reduce
the file size so Samantha pixel out here
wise using the PDF malware unless
antivirus software is course all
compression encoding type supported by
Adobe will be able to decompress our D
chord and scan for meshes cool so and
this is just taking a screenshot on the
papers I wrote so in terms of what you
can actually compress or include whether
you like sub head to dance more pain
signify the flake lyrics of plates
there's the default compression method
for PDFs and also mu genes get back to
jpg and so and so forth so it's all well
and good that you're pressing that data
but the PDFs need to read it so we've
got these things here called pH stream
stream filters
slightly in the filter is that it once
the PDF opens it'll recognize all I need
to do all these things so in order to
read that so this pair is that just
example of malware it ends not semantic
papers discussing so the idea as they
worked backwards so that's the sports
accordion one linked four times
repressive way and then so on and
support that way so this is this is the
final recessive activate the code need
inquiry sorry so the idea is when the
PDF opens or read this is the other way
and go forwards so I can be read in
plain text and executed so JavaScript a
valid email functions based this just
principle is just to concatenate strings
together like in a simple secure got is
an example whole world email a plus B
would show : world so why is used
aesthetically used to further off escape
other functions within
I live like telltale function names
within the malware so for example we
will go up here where there's unescape
so unescape is used to decode strings
and that's typically used when there's
presence of shellcode so in terms of
actual methodology for this project
method I to create baseline if so I
created multiple baselines all the same
hint edges are added all the obfuscation
techniques that I've discussed there and
then at the end I added all of them into
one file I tested them to ensure the
people would executed so I use the XP
service pack 3 VM with the Dolby Acrobat
eight point one point two which is
attached to pain because I probably got
malware downloading that as a result I'm
banned I ran it through a virus total
for evaluation so exact creating the
malware itself I'm lazy is masked by
surprise so that the actual exploit here
is is the U tilde printf module so I
depend that is a buffer overflow export
using cheap string and versions of Adobe
Reader before eight point one point
three and because I'm cliche and proof
of concept it's made a pop calculator so
what I did notice is that actual module
and applied some obfuscation by default
so that's a natural PDF stream here I
discovered that it being CODIS
uncompressed so I did about reverse
engineering on it's quite fun so first
thing I did was I ran it through a PDF
stream bumper which is a good tool for
basically breaking down the streams and
be able to read it and reassemble a PDF
it's great for engineering so that that
and then find out the object
declarations and the trailer I like
random hexadecimal characters placed the
route to replace that back with a state
I mean I remove the redundant stream
filters and an addition all the variable
names are really long complex or just
kind of narrow to tell you to made a lot
more simpler more for myself so I could
actually understand what's going on so
before I go on here is the original the
obfuscated PDF and header up here here's
the object decorations and all took five
assess the objects X contains JavaScript
and this is my shell codes and this is
the physical and JavaScript they'll
execute the and open calculator I'm not
I'm saying sure what it does like this
person to offer or stop arguing my party
but in general just of it so
firstly a necklace added an HTP
obfuscation so the guy back in 2011
that's when XDP obfuscation can a first
came to light guy called Alexander
clinica security researcher published I
am on his blog about it and he created
this Metasploit module at PDF txt key
it's basically like is you just give a
PDF and it will convert it to XDP for
you so that's just like the name of the
original file the name the new file very
simple and I'm Jeff Spock and hey as
quinces daily are tired eval as well so
that it used the online field called GF
opcom but because leaked it was like a
web-based I could only in court like one
lane of JavaScript a time three
ages so am i tried to do the shellcodes
but i was like this is a uni project I
don't have hours upon hours till later
in shell cool and a contrast in a
progress and Kalina saw it but I
realized kind of in hindsight could have
released a smaller payload but like all
other payloads but the reason why email
is required it's because obviously if
your concatenate all these things
together and you're not Cattani but
obviously VGA spot you've gotta lace it
looks like a lot links of lots of like
plus ease and whatnot you're gonna have
to use an email to concatenate them all
together
next up string replace so where did I do
it instance ease of a shellcode
instances all you talked about printf as
tail to assign and also the unescape i
mentioned earlier so how can I just I
was him every Monday and I just looked
around for random objects in terms of
all I was gonna rooster in a place left
for example yeah goodbye zero guitar one
lamp so that's white replace it life
similarly further you till the printf
just I just add random characters up you
can be T begin X and so on and so forth
so this is what the GS but PDF looks
like so again similar I got shellcodes I
forgot to show you just what but you
know that's my bad so message message as
just British context or so that's here
so that's a little bit code here as all
of those and interesting off if the
player was paid but so the original ad
office kata version and to come on
develop I'm a second there so to execute
that's a good good
seven seconds from open the PDF for
calculator popped up so it really does
smell very Mexican
I think you might report it was about in
the pan mixing sporty pages or if
they're before just for this one
document
so yeah I'm want to replace that PDF so
here's the Shelf it looks like or share
photos hey it's just all the random
collections of words scroll down and
then here's me doing the replace
interest law on the unescape all I did
was shut up I did instances of one
between it and then reassemble that I'm
replacement instances of one nothing I
don't say that's available and here we
have the variable that is the I think
that's why she popped the cow and so
that was what you tale that printf
became and then I replace that so
student felt obfuscation it wasn't
difficult connect to try and get done so
I decided to just look in the basic so I
did a base 85 to hexadecimal and I can
press the resulting hex and to fleets
so I just took the source code for the
Metasploit module ident an 82 they're
slightly and then because I used the
actual module I had to remove the Belton
office kitchen as before to only make up
your text so in terms of actually
changing the source code its retina
really kind of cool never done any
really stuff before and so this is kind
of where the JavaScript is then I just
replaced that everything between the
line and that line there with the
hexadecimal I named because M I'd
already use the hex
that's function here's where it
compresses it using slate I just removed
in a bunch the redundant function call
so in addition obviously the stream
filters has changed was tracing so I
just had to change it to incorporate
base 85 so this one is is not really
much to see because it's just all kind
of gobbledygook which can be read in the
PDF reader but are about mirrors and
there's just extreme felt I thought I'd
just show so as I said earlier I applied
all the obfuscation techniques at the
end so I dared this trigger place then J
spot an eval I now use extreme filters
and finally converted to XDP so in terms
of evaluation I just had earlier used
virustotal
for those who don't
our school closes basically like an
online way or it's looking online
antivirus also you see Matt URL or
malicious what we think to be a
malicious document and I'll scan it for
you and so there's over 60 scanning
engines but what's interesting is
they're pretty much about what
capability they work at because obvious
is a free service
you're not gonna it likes of avast or
AVG giving you the full suite online for
free so take these kind of results I'm
about to show you that I'm a pinch of
salt you want more information about
that and there's a good talk I be safe
london buying a collar bones called
offensive ant analysis i recommend
checking out so terms actual results the
job force katie PDF about 33 detections
which is actually all right considering
I've done nothing to that straight the
Box myths like hex TP was really good at
15 geez
and he valves 12-string a place 22 and
unsurprisingly the stream folk who were
selected to because I was a real
adventurous without this was ran an
effective April last year so I know it
for a fact if I reran these I would get
until II different results to the in
Japan updated but most importantly the
combined 5-htp omega1 detection which I
thought was gonna cool and also is Trend
Micro no one uses Trend Micro all so I
created a thought well then tracing
thing I found was that every time you
run something through a virus code you
can watch your a stick picked up or walk
scat the whatever floats up so not
something interesting that multiple
scallion engines detected my malware
using the same signatures so for example
here we've got fair skinned zone alarm
using the same to know your s think I
think you detect it it's kind of the
more of the story is if you can bypass
one antivirus engine there's like the
likely chance to bypass another one so
yeah I'm very spending my talk I'll open
the floor for questions if you thought
once attachment know you catch though
the day on the pop or on Twitter and
adduction I know a lot of presentations
there's gonna talked I thought I'd bring
her back to her cat lovers yes that says
gdpr compliant I did ask my cafe could
it uses use the spudger and all I did
not turn the washing machine on with my
cats later thank you very much
is anybody any questions yeah there was
some more complex ones I it's been like
a year since I've um that's how I looked
at it much but there are other
techniques you know there's a couple of
good papers if uh if you want me to
point in your way anyone else it's more
I think it's because not all of them can
read it or not all of them are the same
capability I also the more virus tools I
see is kind of hush-hush about how they
do it
but his babies I think it was the yeah
so XD Peter says have an unusual file
format only 53 of the engines actually
were able to run it hey no else so the
heuristic you've got up there presumably
is that your stick is this this PDF
looks crazy yeah I think I think it was
pretty much fun and falling off that did
you ever try using bunch of these
obfuscation techniques to obfuscate
something completely innocent and not
the least bit malicious
no that would be actually good idea
because that will be an issue that just
just it's just running through it yeah
but for weird stuff in here
nobody does that for legitimate reasons
why don't we just that would've made a
good idea actually didn't think about
anyone else well thank you much