You will find PDF files everywhere on the Internet: contracts, invoices, reports, etc. As such, many people instinctively feel that they can trust PDF files. However, attackers often take advantage of that inherent trust by hiding malicious code or links within the PDF documents.
To effectively prevent malicious files from reaching an end user, the Security Operations (SOC) team must not only identify a possible file with malware, but more importantly, determine what that file does.
Step 1: Analyzing suspicious PDF files is to collect and triage them
Suspicious PDFs typically arrive via email gateways (EGW), endpoint alerts (EA), or threat intelligence feeds (TIF). In order to effectively analyze the file, you must first determine where the file was originally sent from, who the email was sent from, and create a hash of the file.
Even a minor inconsistency may elicit a flag, such as an invoice that was sent to a finance department using a free email account rather than the official company domain.
Step 2: Analyzing suspicious PDF files is to examine the file's metadata
The headers and metadata of a PDF document can help you determine what is contained within the PDF file. Generally, SOC teams will use tools such as pdfid.py to determine whether the PDF contains JavaScript, embedded files, or automatic actions.
For instance, if you run the command: "pdfid.py suspicious_invoice.pdf", and then run "pdf-parser.py -s /JavaScript suspicious_invoice.pdf" and see that JavaScript was found in the PDF file, it will likely be a red flag. Furthermore, it is important to identify any important links that are contained within the document as well, as they may provide context clues about the sender's intentions.
Step 3: Static inspection of the PDF file
Analysts will extract URLs, inspect forms, and run search strings; An example of this inspection would be:
"suspicious.pdf | grep http"
This process is used to determine whether or not the content of the PDF file has connections with external servers, whether or not malware is present, and if there is any intention of executing malicious code.
Step 4: Behavioral analysis of the PDF file
Using a sandbox environment to provide an isolated space for executed files. Analysts typically use Cuckoo Sandbox, Hybrid Analysis, or others for conducting behavioral analysis; an example of this would be:
"Cuckoo submit suspicious_invoice.pdf"
This process involves executing the PDF file in a sandboxed environment and monitoring its behavior in the sandboxed environment. Analysts look for:
1. Connections to unexpected network addresses
2. The creation of temporary files
3. The injection of code into memory or attempts to run processes
By observing the execution of the PDF file, analysts are able to see what actions the PDF file is trying to execute without placing organizations at risk by having employees execute malicious code.
Step 5: Addresses the issue of advanced PDF files that may contain obfuscated JavaScript, or hidden executables. Analysts can use pdf-parser.py, deobfuscators, or hex editors to extract individual objects from the PDF file and analyze each object in detail:
"pdf-parser.py -o 12 suspicious_invoice.pdf"
This will extract object 12 from the PDF file, which may contain a downloader or other payload. A careful manual analysis of advanced PDF files can yield valuable information.
Real-world examples
Example 1: Invoice malware
A PDF invoice was sent to a finance team; the file contained embedded JavaScript, which was revealed through the file’s metadata, that attempted to download a remote access tool (RAT).
SOC Response: The file was quarantined, and a sandbox analysis confirmed the file contained a payload. Based on the threat intelligence produced from the incident, an IOC was created to block further occurrences of similar files.
Example 2: Exploit targeting Commercial Vulnerability (CVE) in outdated PDF readers
A CVE in outdated software exploited by a PDF file; the payload would only have been triggered from an unpatched endpoint.
SOC Response: The hashes of the malicious PDF were blocked, endpoints were patched, and the user's team was notified.
Example 3: Credential exfiltration through a PDF form
Image of a vendor form soliciting credentials that were submitted via an external URL.
SOC Response: URL blocked, incident documented, and information was shared with the Department.
The SOC teams interpret events using the following signals:
1. Metatag anomalies,
2. Networking activity,
3. Running behavior
4. Intelligence from threats.
Using only one single indicator may not demonstrate that an activity was malicious. A combination of them creates evidence that determines what the activity is doing as opposed to its file format type.
PDF files that appear suspicious can present silent threats. They may appear to be complete and fully functional files, but they do in fact contain hidden malicious behaviors.
SOC teams will perform multiple analysis methods on PDF files, such as inspecting metadata, performing static analysis, running sandboxed tests, and performing reverse engineering. The outcome is a full understanding of the risk presented by a file and creating concrete steps to address that risk before the user even sees it.
