Techniques for analysing PDF malware

Caglar Ulucenk; Vijay Varadharajan; Venkat Balakrishnan; Udaya Tupakula

doi:10.1109/APSEC.2011.41

Techniques for analysing PDF malware

Caglar Ulucenk^*, Vijay Varadharajan, Venkat Balakrishnan, Udaya Tupakula

^*Corresponding author for this work

School of Computing

Research output: Chapter in Book/Report/Conference proceeding › Conference proceeding contribution › peer-review

5 Citations (Scopus)

Abstract

Today, PDF is one of the widely used applications for sharing documents. Some of the important factors for the popular use of the PDF application are due to its platform independency and rich digital offerings such as ability to include multimedia files, direct URL access and HTTP communication. However its wider acceptance among the user community has also attracted the attackers to develop and spread malware using PDF files. Most of the existing security tools are not equipped to deal with the attacks related to PDF. In this paper we present different techniques that can be used by an attacker to generate PDF attacks. Then we propose portable document scanner (PDSCAN) which can detect the attacks by analyzing the suspicious objects and the scripts that are embedded in the documents. PDSCAN makes use of dynamic and static analysis techniques to deal with the malware. Finally we present detail analysis of a malicious PDF file in VirtualBox environment.

Original language	English
Title of host publication	Proceedings of the 18th Asia-Pacific Software Engineering Conference, APSEC 2011
Place of Publication	Los Alamitos, Calif.
Publisher	Institute of Electrical and Electronics Engineers (IEEE)
Pages	41-48
Number of pages	8
ISBN (Print)	9780769546094
DOIs	https://doi.org/10.1109/APSEC.2011.41
Publication status	Published - 2011
Event	18th Asia Pacific Software Engineering Conference, APSEC 2011 - Ho Chi Minh, Viet Nam Duration: 5 Dec 2011 → 8 Dec 2011

Other

Other	18th Asia Pacific Software Engineering Conference, APSEC 2011
Country/Territory	Viet Nam
City	Ho Chi Minh
Period	5/12/11 → 8/12/11

Access to Document

10.1109/APSEC.2011.41

Cite this

@inproceedings{9404fbe03f8b4f02b7e01dadf0285254,

title = "Techniques for analysing PDF malware",

abstract = "Today, PDF is one of the widely used applications for sharing documents. Some of the important factors for the popular use of the PDF application are due to its platform independency and rich digital offerings such as ability to include multimedia files, direct URL access and HTTP communication. However its wider acceptance among the user community has also attracted the attackers to develop and spread malware using PDF files. Most of the existing security tools are not equipped to deal with the attacks related to PDF. In this paper we present different techniques that can be used by an attacker to generate PDF attacks. Then we propose portable document scanner (PDSCAN) which can detect the attacks by analyzing the suspicious objects and the scripts that are embedded in the documents. PDSCAN makes use of dynamic and static analysis techniques to deal with the malware. Finally we present detail analysis of a malicious PDF file in VirtualBox environment.",

author = "Caglar Ulucenk and Vijay Varadharajan and Venkat Balakrishnan and Udaya Tupakula",

year = "2011",

doi = "10.1109/APSEC.2011.41",

language = "English",

isbn = "9780769546094",

pages = "41--48",

booktitle = "Proceedings of the 18th Asia-Pacific Software Engineering Conference, APSEC 2011",

publisher = "Institute of Electrical and Electronics Engineers (IEEE)",

address = "United States",

note = "18th Asia Pacific Software Engineering Conference, APSEC 2011 ; Conference date: 05-12-2011 Through 08-12-2011",

}

Ulucenk, C, Varadharajan, V, Balakrishnan, V & Tupakula, U 2011, Techniques for analysing PDF malware. in Proceedings of the 18th Asia-Pacific Software Engineering Conference, APSEC 2011., 6130668, Institute of Electrical and Electronics Engineers (IEEE), Los Alamitos, Calif., pp. 41-48, 18th Asia Pacific Software Engineering Conference, APSEC 2011, Ho Chi Minh, Viet Nam, 5/12/11. https://doi.org/10.1109/APSEC.2011.41

Techniques for analysing PDF malware. / Ulucenk, Caglar; Varadharajan, Vijay; Balakrishnan, Venkat et al.
Proceedings of the 18th Asia-Pacific Software Engineering Conference, APSEC 2011. Los Alamitos, Calif.: Institute of Electrical and Electronics Engineers (IEEE), 2011. p. 41-48 6130668.

Research output: Chapter in Book/Report/Conference proceeding › Conference proceeding contribution › peer-review

TY - GEN

T1 - Techniques for analysing PDF malware

AU - Ulucenk, Caglar

AU - Varadharajan, Vijay

AU - Balakrishnan, Venkat

AU - Tupakula, Udaya

PY - 2011

Y1 - 2011

N2 - Today, PDF is one of the widely used applications for sharing documents. Some of the important factors for the popular use of the PDF application are due to its platform independency and rich digital offerings such as ability to include multimedia files, direct URL access and HTTP communication. However its wider acceptance among the user community has also attracted the attackers to develop and spread malware using PDF files. Most of the existing security tools are not equipped to deal with the attacks related to PDF. In this paper we present different techniques that can be used by an attacker to generate PDF attacks. Then we propose portable document scanner (PDSCAN) which can detect the attacks by analyzing the suspicious objects and the scripts that are embedded in the documents. PDSCAN makes use of dynamic and static analysis techniques to deal with the malware. Finally we present detail analysis of a malicious PDF file in VirtualBox environment.

AB - Today, PDF is one of the widely used applications for sharing documents. Some of the important factors for the popular use of the PDF application are due to its platform independency and rich digital offerings such as ability to include multimedia files, direct URL access and HTTP communication. However its wider acceptance among the user community has also attracted the attackers to develop and spread malware using PDF files. Most of the existing security tools are not equipped to deal with the attacks related to PDF. In this paper we present different techniques that can be used by an attacker to generate PDF attacks. Then we propose portable document scanner (PDSCAN) which can detect the attacks by analyzing the suspicious objects and the scripts that are embedded in the documents. PDSCAN makes use of dynamic and static analysis techniques to deal with the malware. Finally we present detail analysis of a malicious PDF file in VirtualBox environment.

UR - http://www.scopus.com/inward/record.url?scp=84856612033&partnerID=8YFLogxK

U2 - 10.1109/APSEC.2011.41

DO - 10.1109/APSEC.2011.41

M3 - Conference proceeding contribution

AN - SCOPUS:84856612033

SN - 9780769546094

SP - 41

EP - 48

BT - Proceedings of the 18th Asia-Pacific Software Engineering Conference, APSEC 2011

PB - Institute of Electrical and Electronics Engineers (IEEE)

CY - Los Alamitos, Calif.

T2 - 18th Asia Pacific Software Engineering Conference, APSEC 2011

Y2 - 5 December 2011 through 8 December 2011

ER -

Techniques for analysing PDF malware

Abstract

Other

Access to Document

Other files and links

Fingerprint

Cite this