Obfuscation and (non-)detection of malicious PDF files. Jose Miguel Esparza
|
|
|
- Paulina Robertson
- 6 years ago
- Views:
Transcription
1 Obfuscation and (non-)detection of malicious PDF files Jose Miguel Esparza
2 Agenda Introduction to the PDF format Obfuscation and evasion techniques Obfuscation vs. Antivirus Obfuscation vs. Analysis tools peepdf Conclusions
3 Header Body Cross reference table Trailer
4 Introduction to the PDF format Sequence of objects Object types Boolean: true false Numbers: Strings: (hola) <686f6c61> Names: /Type /Filters Dictionaries: <</Type /Catalog /Root 1 0 R>> Arrays: [1.0 (test) <</Length 273>>] Streams
5 Introduction to the PDF format
6 Introduction to the PDF format Object types Indirect objects Reference: object_id generation_number R
7 Introduction to the PDF format Object types Indirect objects Reference: object_id generation_number R
8 Introduction to the PDF format Updatable documents Older versions stay in the document Header Body Cross reference table Original Trailer Body Cross reference table Update Trailer
9 Introduction to the PDF format Logical structure Tree structure Root node: /Catalog If an element isn t in the downward path from the /Catalog DOES NOT EXIST
10 Introduction to the PDF format
11 Introduction to the PDF format Actions /Launch /Javascript /GoToE (go to embedded) /URI /SubmitForm Triggers /OpenAction: global /AA: pages, annotations
12 Introduction to the PDF format
13 Introduction to the PDF format Actions /Launch /Javascript /GoToE (go to embedded) /URI /SubmitForm Triggers /OpenAction: global /AA: pages, annotations
14 Introduction to the PDF format
15 Introduction to the PDF format
16 Introduction to the PDF format
17 Practical example pdf.pdf (2009)
18
19
20
21 Automatic execution Avoid /OpenAction Use of /Catalog elements /Names /AcroForm /AA: applied to pages, annotations
22
23
24 Strings to avoid/hide /JavaScript /JS More than two unescape in Javascript code Characteristic metadata /pdftk_pagenum
25
26 Strings to avoid/hide /JavaScript /JS More than two unescape in Javascript code Characteristic metadata /pdftk_pagenum
27
28 Suspicious objects? Strings (21/43) vs. Streams (27/43) Filters Avoid known filters: /FlateDecode /ASCIIHexDecode Parameters (included default ones) Multiple filters [ /FlateDecode /LZWDecode /RunLengthDecode ]
29
30 Suspicious objects? Strings (21/43) vs. Streams (27/43) Filters Avoid known filters: /FlateDecode /ASCIIHexDecode Parameters (included default ones) Multiple filters [ /FlateDecode /LZWDecode /RunLengthDecode ]
31 Strings/names encoding Names Hexadecimal codification Strings /Fl#61#74#65De#63#6f#64e (/FlateDecode) Hexadecimal < c6c636f6465> Octal values \163\150\145\154\154
32 Strings/names encoding Names Hexadecimal codification Strings /Fl#61#74#65De#63#6f#64e (/FlateDecode) Hexadecimal < c6c636f6465> Octal values NO! \163\150\145\154\154
33
34
35
36
37 Splitting up Javascript code Several objects in /Names /Names [(part1) 3 0 R (part2) 7 0 R (part3) 10 0 R] Functions to obtain parts of the document getannots() getpagenumwords()/getpagenthword() this.info.*
38
39
40 Duplicated objects Updated objects Malformed documents Garbage bytes in the header Bad version number (%PDF-1.\0) No xref table No ending tags: endobj or endstream
41
42 Duplicated objects Updated objects Malformed documents Garbage bytes in the header Bad version number (%PDF-1.\0) No xref table No ending tags: endobj or endstream
43
44 Duplicated objects Updated objects Malformed documents Garbage bytes in the header Bad version number (%PDF-1.\0) No xref table No ending tags: endobj or endstream
45
46
47 Compressed objects (object streams) Incompatible with malformed documents Encryption /Encrypt (streams and strings) RC4 o AES (40-128bits) Default password padding = \x28\xbf\x4e\x5e\x4e\x75\x8a\x41\x64\x00\x4e\x56\xff\xfa +\ \x01\x08\x2e\x2e\x00\xb6\xd0\x68\x3e\x80\x2f\x0c\xa9\xfe\x64\x53\x69\x7a password = password + padding[:32-(len(password))] password = password = padding Nested PDFs /EmbeddedFiles
48
49
50 Compressed objects (object streams) Incompatible with malformed documents Encryption /Encrypt (streams and strings) RC4 o AES (40-128bits) Default password padding = \x28\xbf\x4e\x5e\x4e\x75\x8a\x41\x64\x00\x4e\x56\xff\xfa +\ \x01\x08\x2e\x2e\x00\xb6\xd0\x68\x3e\x80\x2f\x0c\xa9\xfe\x64\x53\x69\x7a password = password + padding[:32-(len(password))] password = password = padding Nested PDFs /EmbeddedFiles
51
52 Compressed objects (object streams) Incompatible with malformed documents Encryption /Encrypt (streams and strings) RC4 o AES (40-128bits) Default password padding = \x28\xbf\x4e\x5e\x4e\x75\x8a\x41\x64\x00\x4e\x56\xff\xfa +\ \x01\x08\x2e\x2e\x00\xb6\xd0\x68\x3e\x80\x2f\x0c\xa9\xfe\x64\x53\x69\x7a password = password + padding[:32-(len(password))] password = password = padding Nested PDFs /EmbeddedFiles
53
54 Mixing techniques Summary: Remove characteristic strings Split up Javascript code (/Names) If the code is in: String octal encoding (\143\172) Stream filters (not usuals, parameters) Compress (object streams) Encrypt (default password) Malform (endobj, header) Nest PDFs
55 Obfuscation vs. Antivirus Better results JS in string + octal + no characteristic strings object stream malformed + nested + filters with parameters (0/43) filters with parameters + malformed (0/43) malformed: endobj, bad header (2/43) encrypted (5/43) Exploit working
56 Obfuscation vs. Antivirus Updates JS in string + octal + no characteristic strings object stream malformed + nested + filters with parameters (1/43) filters with parameters + malformed (3/43) malformed: endobj, bad header (6/43) encrypted + nested + malformed (1/43) Exploit working
57 Obfuscation vs. Antivirus Antivirus AntiVir Avast AVG BitDefender ClamAV Commtouch DrWeb F-Secure Fortinet GData Kaspersky McAfee Weak points JS in string, without JS strings Embedded, no endobj, Flate params Embedded, Flate params, characteristic strings, without JS strings Characteristic strings, octal strings Flate params, octal strings, bytes header Flate params, octal strings, encrypted Characteristic strings, octal strings Splitted up JS code, octal strings, bytes header, object streams Flate params, splitted up JS code, bytes header, metadata No endobj, Flate params Flate params, characteristic strings, splitted up JS code, object streams Execution with /Names, embedded, characteristic strings, hexadecimal names, octal strings, without JS strings
58 Obfuscation vs. Antivirus Antivirus McAfee-GW Microsoft NOD32 Panda Prevx Sophos Symantec TrendMicro VBA32 VirusBuster Weak points Flate params, characteristic strings, octal strings Splitted up JS code, octal strings, bytes header, object streams Embedded, characteristic strings, bad header (%PDF-1.\0) JS in string, without JS strings No detection Without JS strings, object stream + malformed endobj, encrypted Original detection as Downloader, JS in string, without JS strings No detection Characteristic strings No detection
59 Obfuscation vs. Analysis tools Tools Wepawet PDFDissector PDFStreamDumper pdf-parser (Didier) OPAF Origami PDFExaminer malpdfobj Comments No encryption support, identifies exploits in embeded PDF files Comercial, not tested Tools to help shellcode/js analysis, errors with encryption, does not analyse object streams Search in streams not supported, 3 filters, object streams and encryption not supported Parsing framework, XML output, encryption not supported Good framework (filters, object streams, encryption), it s necessary to code your own tool (Ruby) Encryption and embeded PDF files support, does not support malformed objects, octal decoding Based on PDFTools (Didier Stevens)
60 Obfuscation vs. Analysis tools
61 Obfuscation vs. Analysis tools Tools Wepawet PDFDissector PDFStreamDumper pdf-parser (Didier) OPAF Origami PDFExaminer malpdfobj Comments No encryption support, identifies exploits in embeded PDF files Comercial, not tested Tools to help shellcode/js analysis, errors with encryption, does not analyse object streams Search in streams not supported, 3 filters, object streams and encryption not supported Parsing framework, XML output, encryption not supported Good framework (filters, object streams, encryption), it s necessary to code your own tool (Ruby) Encryption and embeded PDF files support, does not support malformed objects, octal decoding Based on PDFTools (Didier Stevens)
62 peepdf Characteristics Python Command line Interactive console Command file option
63 peepdf
64 peepdf Analysis Encrypted files Compressed objects Malformed documents support Decoding: hexadecimal, octal, names Most used filters (5) References in objects and to objects Strings search (including streams)
65 peepdf Analysis Physical structure (offsets) Tree structure (logical) Metadata Changes between versions (changelog) Extraction of different versions Javascript analysis and modification (Spidermonkey) unescape, replace, join Shellcode analysis (sctest, Libemu) Variables to improve analysis (set command)
66 peepdf Creation/Modification Basic PDF creation Creation of PDF with Javascript execution Object compression (object streams) Encrypted files Nested PDFs creation Malformed PDFs Strings and names codification Filters modification Object modification
67 Demo time!
68 peepdf TODO Automatic analysis of embedded PDFs Missing filters Improve automatic Javascript analysis Add support for PDF JS functions (getannots ) GUI ActionScript?
69 Conclusions Very low detection when: Nested PDFs Compressed objects New filters or filters with parameters Encryption Avoid detection by strings Improve parsers
70 Thanks People working with PDF stuff: Julia Wolf Didier Stevens Felipe Manzano (feliam) Origami team Brandon Dixon AV companies
71 ???
72 Thanks!! Jose Miguel Esparza jesparza eternal-todo.com jesparza s21sec.com
Digital Forensics Lecture 02B Analyzing PDFs. Akbar S. Namin Texas Tech University Spring 2017
Digital Forensics Lecture 02B Analyzing PDFs Akbar S. Namin Texas Tech University Spring 2017 PDF Format and Structure Tools used Text editor (e.g., vi) ClamAV antivirus (http://www.clamav.net/lang/en/download/
Lab 1: UPX Program Packer. From what we see here Netcat s MD5 is (AB41B1E2DB77CEBD9E EE3915D)
Lab 1: UPX Program Packer Lets use UPX Program Packer on Netcat and see what we happens. First lets get the MD5 hash of Netcat and see what it looks like. From what we see here Netcat s MD5 is (AB41B1E2DB77CEBD9E2779110EE3915D)
Digital Forensics Lecture 02 PDF Structure
Digital Forensics Lecture 02 PDF Structure PDF Files Structure Akbar S. Namin Texas Tech University Spring 2017 PDF Format and Structure Tools used Text editor (e.g., vi) ClamAV antivirus (http://www.clamav.net/lang/en/download/
Malicious Document Analysis Beginners Guide.
Malicious Document Analysis Beginners Guide ariesike@naver.com PDF(Portable Document Format) 2012-07-24 Malicious Document Analysis 2 PDF Overview Adobe Systems created the Portable Document Format PDF
PDF. Applying File Structure Inspection to Detecting Malicious PDF Files. Received: November 18, 2013, Accepted: July 11, 2014
PDF 1,a) 2,b) 2 2013 11 18, 2014 7 11 MS Rich Text Compound File Binary PDF PDF PDF PDF 164 99.4% PDF Applying File Structure Inspection to Detecting Malicious PDF Files Yuhei Otsubo 1,a) Mamoru Mimura
Language English. Server load. Suspicious file(s) to scan:
Security risk found in message 'DHL customer services. You should get th... http://virscan.org/report/356346ab231bfab52fe5d0eaef8eb3f6.html 1 of 2 2/5/2010 11:11 AM Language English Server load Suspicious
Detection of Suspicious PDF Document- Embedded Code
Int. J. of Comp. & Info. Tech., (2016) 4(3): 71-78. ISBN: 2345-3877 www.ijocit.org Volume 4, Issue 3 Review Paper Detection of Suspicious PDF Document- Embedded Code Er. Gurjot Singh 1* Received: 13 Jun
BULK ANALYSIS OF MALICIOUS PDF DOCUMENTS. by Shauna M. Policicchio B.S., Saint Vincent College, 2013
BULK ANALYSIS OF MALICIOUS PDF DOCUMENTS by Shauna M. Policicchio B.S., Saint Vincent College, 2013 Submitted to the Graduate Faculty of the School of Information Science in partial fulfillment of the
AhnLab-V AntiVir Antiy-AVL Avast
VT Community Sign in Languages Virustotal is a service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus
Portable Document Format (PDF): Security Analysis and Malware Threats
Portable Document Format (PDF): Security Analysis and Malware Threats Alexandre Blonce Eric Filiol (speaker) efiliol@esat.terre.defense.gouv.fr Laurent Frayssignes French Army Signals Academy (ESAT) Virology
Threat Modelling Adobe PDF
Threat Modelling Adobe PDF Ron Brandis and Luke Steller Command, Control, Communications and Intelligence Division Defence Science and Technology Organisation ABSTRACT PDF documents are increasingly being
A Short Introduction to PDF
A Short Introduction to PDF Peter Fischer, ZITI, Uni Heidelberg 1 pdf vs. Postscript pdf describes graphics, text & document structure It uses vector graphics, very similar to postscript Some differences
APatternRecognitionSystem for Malicious PDF Files Detection
APatternRecognitionSystem for Malicious PDF Files Detection Davide Maiorca, Giorgio Giacinto, and Igino Corona Department of Electrical and Electronic Engineering (DIEE), University of Cagliari, Piazza
Analysis # Sample: Important_WellsFargo_Doc.exe (70e604777a66980bcc751dcb00eafee5) Analysis # /10/ :12 pm
Analysis # 31139 06/10/2013 14:12 pm 1/11 Table of Contents Analysis Summary... 3 Analysis Summary... 3 Digital Behavior Traits... 3 Created Mutexes... 4 Created Mutexes... 4 Registry Activity... 5 Created
Portable Document Malware, the Office, and You
Portable Document Malware, the Office, and You Get owned with it, can't do business without it! Seth Hardy Senior Malware Analyst Threat Research and Response shardy@messagelabs.com SecTor 2009 October
Antivirus. Sandbox evasion. 1
Antivirus Sandbox evasion 1 Introduction Metasploit Metasploit Framework is a tool for developing and executing exploit code against a remote target machine. Also, Metasploit Framework provide the ability
Getting Owned By Malicious PDF - Analysis
Interested in learning more about security? SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission. Getting
Analysis # Sample: Scan_ _29911.exe (8fcba93b00dba3d182b1228b529d3c9e) Analysis # /12/ :41 pm
Analysis # 31187 06/12/2013 18:41 pm 1/12 Table of Contents Analysis Summary... 3 Analysis Summary... 3 Digital Behavior Traits... 3 File Activity... 4 Deleted Files... 4 Created Mutexes... 5 Created Mutexes...
Analysis # Sample: ss32.exe ( a6e6d b453e73d) Analysis # /08/ :33 pm
Analysis # 31607 07/08/2013 16:33 pm 1/14 Table of Contents Analysis Summary... 3 Analysis Summary... 3 Digital Behavior Traits... 3 File Activity... 4 Stored Modified Files... 4 Created Mutexes... 5 Created
Anti-Virus Comparative No.1
Anti-Virus Comparative No.1 a) On-demand detection of virus/malware b) On-demand detection of dialers Shortened version Date of Test: 6 February 2004 (2004-02) Author: Andreas Clementi Website: http://www.av-comparatives.org
Anti-Virus Comparative No.7
Anti-Virus Comparative No.7 On-demand detection of malicious software Date: August 2005 (2005-08) Last revision of this report: 26 th August 2005 Author: Andreas Clementi Website: http://www.av-comparatives.org
Vulnerability Report
Vulnerability Report Attacks bypassing the signature validation in PDF Vladislav Mladenov, Christian Mainka, Karsten Meyer zu Selhausen, Martin Grothe, Jörg Schwenk November 08, 2018 Chair for Network
Analysis # Sample: google_born_help.exe (584fe856bb348e0089f7b59ec31881a5) Analysis # /05/ :34 pm
Analysis # 20972 10/05/2012 16:34 pm 1/14 Table of Contents Analysis Summary... 3 Analysis Summary... 3 Digital Behavior Traits... 3 File Activity... 4 Deleted Files... 4 Stored Modified Files... 5 Created
DETECTING PDF JAVASCRIPT MALWARE USING CLONE DETECTION
DETECTING PDF JAVASCRIPT MALWARE USING CLONE DETECTION by Saruhan A. Karademir A thesis submitted to the Department of Electrical and Computer Engineering In conformity with the requirements for the degree
PDF in Smalltalk. Chris1an Haider
PDF in Smalltalk Chris1an Haider Introduc1on PDF is a graphics Model a document Format Graphics 2D Vector Graphics Mathema1cal Paths Coordinate transforma1ons Dominant Model PostScript, SVG, Advanced Transparency
Honeypots observations and their usefulness
Honeypots observations and their usefulness Gerard Wagener - TLP:WHITE CIRCL March 15, 2017 The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative designed to provide
Anti-Virus Testing and AMTSO
Anti-Virus Testing and AMTSO Patrik Runald, Security Response Manager Helsinki Kuala Lumpur San Jose Tokyo London Paris Milan Hong Kong Mumbay Warsaw Munich Copenhagen Brussels Oulu Utrecht Oslo Stockholm
k-depth Mimicry Attack to Secretly Embed Shellcode into PDF Files
k-depth Mimicry Attack to Secretly Embed Shellcode into PDF Files Jaewoo Park and Hyoungshick Kim Department of Software, Sungkyunkwan University 2066 Seobu-ro, Suwon, Republic of Korea {bluereaper,hyoung}@skku.edu
ID: Sample Name: A Lire..pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 16:55:31 Date: 07/03/2018 Version:
ID: 4353 Sample Name: A Lire..pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 16:55:31 Date: 07/03/2018 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview Information Detection
A glance into the Eye Pyramid
A glance into the Eye Pyramid RĂZVAN OLTEANU Security Reasercher We keep you safe and we keep it simple. 01 Introduction On January 11, 2017 Italian news agency AGI, published a court order regarding cyber-attacks
QPDF Manual. For QPDF Version 7.1.0, January 14, Jay Berkenbilt
QPDF Manual For QPDF Version 7.1.0, January 14, 2018 Jay Berkenbilt QPDF Manual: For QPDF Version 7.1.0, January 14, 2018 Jay Berkenbilt Copyright 2005 2018 Jay Berkenbilt Table of Contents General Information...
Abusing File Processing in Malware Detectors for Fun and Profit
2012 IEEE Symposium on Security and Privacy Abusing File Processing in Malware Detectors for Fun and Profit Suman Jana and Vitaly Shmatikov The University of Texas at Austin Abstract We systematically
Static Detection of Malicious JavaScript-Bearing PDF Documents
Static Detection of Malicious JavaScript-Bearing PDF Documents ABSTRACT Pavel Laskov University of Tübingen Sand 1, 72076 Tübingen, Germany pavel.laskov@uni-tuebingen.de Despite the recent security improvements
ESAP Release Notes
ESAP 2.6.6 Release Notes SDK Version: Mac and Windows 3.6.9366.2 (V2 Unified + V3) Note: The SDK embedded in this ESAP version has been tested and qualified to interoperate with a limited list of end endpoint
ESAP. Release Notes Build. Oct Published. Document Version
ESAP Release Notes Build Published 2.8.7 Oct 2015 Document Version Contents Introduction 3 Interoperability and Supported Platforms 3 Noteworthy Changes 3 ESAP 2.8.7 and Pulse Connect Secure/ Pulse Policy
Jsunpack-n: Network Edition. Blake Hartstein Rapid Response Engineer VeriSign idefense
Jsunpack-n: Network Edition Blake Hartstein blake@jeek.org Rapid Response Engineer VeriSign idefense Outline Attacker Attacker s Perspective Defender s Perspective Jsunpack-n Features and Release Problem
Vulnerability Landscape
1 Vulnerability Landscape In 2006 the patches for client-side vulnerabilities overcame other categories in Microsoft software. In 2010, Symantec s Global Internet Security Threat Report indicated that
ExeFilter. An open-source framework for active content filtering. CanSecWest /03/2008
ExeFilter An open-source framework for active content filtering CanSecWest 2008 28/03/2008 http://cansecwest.com Philippe Lagadec NATO/NC3A philippe.lagadec(à)nc3a.nato.int ExeFilter Goals To protect sensitive
INCIDENT RESPONSE. Antiviral shortcomings with respect to real malware. Malware Detection. Gary Golomb
INCIDENT RESPONSE Malware Detection Antiviral shortcomings with respect to real malware Gary Golomb President, Proventsure LLC, Baltimore, MD Jonathan Gross Senior
Anti-Virus Comparative Summary Report 2008
Anti-Virus Comparative Summary Report 2008 Awards, winners, comments Date: December 2008 Last revision: 9 th December 2008 Website: http://www.av-comparatives.org 1. Introduction At the end of every year,
RTTL Certification Test - March Language: English. March Last Revision: 8 th April
RTTL Certification Test March 2016 Language: English March 2016 Last Revision: 8 th April 2016-1 - Introduction 1 st AMTSO Real Time Threat List (RTTL) based certification test What is the RTTL? The Real-Time
Anti-Virus Comparative
Anti-Virus Comparative Advanced Endpoint Protection Test Language: English November 2017 Last Revision: 23 rd March 2018 Commissioned by Bitdefender - 1 - Table of Contents Executive Summary 3 Tested products
ESAP. Release Notes. Release, Build Published Document Version February
ESAP Release Notes Release, Build Published Document Version 3.3.7 February 2019 1.0 Pulse Secure, LLC 2700 Zanker Road, Suite 200 San Jose, CA 95134 https://www.pulsesecure.net 2019 by Pulse Secure, LLC.
City, University of London Institutional Repository
City Research Online City, University of London Institutional Repository Citation: Cukier, M., Gashi, I., Sobesto, B. & Stankovic, V. (2013). Does Malware Detection Improve With Diverse AntiVirus Products?
Anti-Virus Comparative No.8
Anti-Virus Comparative No.8 Proactive/retrospective test (on-demand detection of virus/malware) Date: November 2005 (2005-11) Last revision: 28 th November 2005 Author: Andreas Clementi Website: http://www.av-comparatives.org
Browser Exploits? Grab em by the Collar! Presented By: Debasish Mandal
Browser Exploits? Grab em by the Collar! Presented By: Debasish Mandal (@debasishm89) About Me Security researcher, currently working in McAfee IPS Vulnerability Research Team. Working in information security
Insecurity in Security Software
Insecurity in Security Software Maik Morgenstern Andreas Marx AV-Test GmbH http://www.av-test.org Virus Bulletin 2005 Conference presentation about Insecurity in Security Software Copyright 2005 AV-Test
Anti-Virus Comparative No.4
Anti-Virus Comparative No.4 Proactive/retrospective test (on-demand detection of virus/malware) Date: November 2004 (2004-11) Last revision of this report: 1 st December 2004 Author: Andreas Clementi Website:
Accessing your Check Point VPN
NOTE: The VPN only provides remote access to the network, any required native applications will need to be compatible with your local system. STEP 1 Open your Internet Explorer web browser and enter the
TERM OF REFERENCE PROVISION FOR DEVELOPMENT OF MyEMAS SYSTEM, CYBERSECURITY MALAYSIA
1.0 BACKGROUND 1.1 ycert proposed to develop an appliance system to enhance the LebahNet v2 (Phase I Data Collection) system for Cyber Threat Research Centre research activities relating to HoneyNet project.
Anti-Virus Comparative. Factsheet Business Test (August-September 2018) Last revision: 11 th October
Anti-Virus Comparative Factsheet Business Test Language: English August-September 2018 Last revision: 11 th October 2018 https:// - 1 - Introduction This is a short fact sheet for our Business Main-Test
UC Davis UC Davis Previously Published Works
UC Davis UC Davis Previously Published Works Title Multiprocess Malware Permalink https://escholarship.org/uc/item/0v40f6h3 Authors Ramilli, Marco Bishop, Matt Sun, Shining Publication Date 2011-10-01
PassMark S O F T W A R E
PassMark S O F T W A R E Antivirus, Internet Security and Total Security Products Performance Benchmarking (2009) Vista/Dual Core Hardware March 2009 Document: Antivirus, Internet Security and Total Security
A Study of the Relationship Between Antivirus Regressions and Label Changes
A Study of the Relationship Between Antivirus Regressions and Label Changes Ilir Gashi 1, Bertrand Sobesto 2, Stephen Mason 1, Vladimir Stankovic 1, and Michel Cukier 2 1 Centre for Software Reliability,
WebShell AV signature bypass and identification C99 Webshell case study. Gil Cohen, CTO
WebShell AV signature bypass and identification C99 Webshell case study Gil Cohen, CTO Agenda Endpoint anomaly detection - intro Signature based detection alone is not good How bad is it? C99 WebShell
QPDF Manual. For QPDF Version 2.2.0, August 14, Jay Berkenbilt
QPDF Manual For QPDF Version 2.2.0, August 14, 2010 Jay Berkenbilt QPDF Manual: For QPDF Version 2.2.0, August 14, 2010 Jay Berkenbilt Copyright 2005 2010 Jay Berkenbilt Table of Contents General Information...
How to use a computer safely Tips and Tricks. Dr. Pierre Darmon
How to use a computer safely Tips and Tricks Dr. Pierre Darmon 2 Agenda Routers Software firewall Wireless encryption Antivirus Backups Windows updates Application updates OS X updates Passwords User accounts
Malware Initial Findings Report (MIFR)
US-CERT MIFR-10124171 1 of 41 Malware Initial Findings Report (MIFR) - 10124171 2017-05-14 Notification This report is provided "as is" for informational purposes only. The Department of Homeland Security
The Ultimate Windows 10 Hardening Guide: What to Do to Make Hackers Pick Someone Else
The Ultimate Windows 10 Hardening Guide: What to Do to Make Hackers Pick Someone Else Paula Januszkiewicz CQURE: CEO, Penetration Tester CQURE Offices: New York, Dubai, Warsaw MVP: Enterprise Security,
Presentation by Brett Meyer
Presentation by Brett Meyer Traditional AV Software Problem 1: Signature generation Signature based detection model Sheer volume of new threats limits number of signatures created by one vendor Not good
THE WOMBAT API handling incidents by querying a world-wide network of advanced honeypots
THE WOMBAT API handling incidents by querying a world-wide network of advanced honeypots Piotr Kijewski, Adam Kozakiewicz 15th June 2010 22nd Annual FIRST Conference, Miami WOMBAT Project EU 7th FRAMEWORK
1. I am a Computer Forensics Researcher with Kyrus Technology. I make this
I, Jesse D. Kornblum, declare as follows: 1. I am a Computer Forensics Researcher with Kyrus Technology. I make this declaration in support of Plaintiffs Application For An Emergency Temporary Restraining
Anti-Virus Comparative
Anti-Virus Comparative Malware Protection Test Consumer Products File Detection Test with Execution including false alarm test Language: English March 2018 Last Revision: 13 th April 2018 Table of Contents
AXIGEN Features and Supported Platforms
AXIGEN Features and Supported Platforms GECAD Technologies 10A Dimitrie Pompei Blvd., BUCHAREST 2, ROMANIA Tel.: +40 21 303 20 80 +40 21 303 20 81 Last modified: 09/18/2007 Product Features v 4.0 and v
Malicious origami in PDF
J Comput Virol (2010) 6:289 315 DOI 10.1007/s11416-009-0128-2 ORIGINAL PAPER Malicious origami in PDF Frédéric Raynal Guillaume Delugré Damien Aumaitre Received: 4 January 2009 / Accepted: 30 July 2009
The ABC of PDF with itext
The ABC of PDF with itext PDF Syntax essentials itext Software This book is for sale at http://leanpub.com/itext_pdfabc This version was published on 2015-01-06 This is a Leanpub book. Leanpub empowers
CONSUMER AV / EPP COMPARATIVE ANALYSIS
CONSUMER AV / EPP COMPARATIVE ANALYSIS Exploits Evasion Defenses 2012 Randy Abrams, Nathan Taylor Tested Vendors Avast, AVG, Avira, ESET, F- Secure, Kaspersky, McAfee, Microsoft, Norman, Norton, Panda,
SSQA Seminar Series. Server Side Testing Frameworks. Sachin Bansal Sr. Quality Engineering Manager Adobe Systems Inc. February 13 th, 2007
SSQA Seminar Series Server Side Testing Frameworks Sachin Bansal Sr. Quality Engineering Manager Adobe Systems Inc. February 13 th, 2007 1 Agenda Introduction Drivers for Server Side Testing Challenges
PDF PDF PDF PDF PDF internals PDF PDF
PDF Table of Contents Creating a simple PDF file...3 How to create a simple PDF file...4 Fonts explained...8 Introduction to Fonts...9 Creating a simple PDF file 3 Creating a simple PDF file Creating a
SECURE2013 ANDROTOTAL A SCALABLE FRAMEWORK FOR ANDROID ANTIMALWARE TESTING
SECURE2013 ANDROTOTAL A SCALABLE FRAMEWORK FOR ANDROID ANTIMALWARE TESTING Federico Maggi, Andrea Valdi, Stefano Zanero Politecnico di Milano, DEIB fede@maggi.cc ROADMAP 1. Android threats and protections
Free antivirus software download
Cari untuk: Cari Cari Free antivirus software download 3-11-2015 Avast has one of the most popular antivirus apps around, due in part to offering a free version, and it's one that performs respectably.
ESAP Release Notes
ESAP 2.7.8 Release Notes SDK Version: Mac and Windows 3.6.9981.2 (V2 Unified + V3) Note: The SDK embedded in this ESAP version has been tested and qualified to interoperate with a limited list of end endpoint
SQL Parsers with Message Analyzer. Eric Bortei-Doku
SQL Parsers with Message Analyzer Eric Bortei-Doku Agenda Message Analyzer Overview Simplified Operation Message Analyzer Parsers Overview Desktop UI Demos Analyzing Local Ping Traffic Analyzing a Capture
Symantec Endpoint Protection 12
Symantec Endpoint Protection 12 Hundreds of Millions of New Pieces of Malware Mean You Have to Do Things Differently Graham Ahearne, Marcus Brownell Product Management 1 Agenda 1 2 3 Challenges How Symantec
ELIMINATING ZERO-DAY MALWARE ATTACKS IN DOCUMENTS DO NOT ASSUME OPENING A NORMAL BUSINESS DOCUMENT IS RISK FREE
ELIMINATING ZERO-DAY MALWARE ATTACKS IN DOCUMENTS DO NOT ASSUME OPENING A NORMAL BUSINESS DOCUMENT IS RISK FREE WWW.GLASSWALLSOLUTIONS.COM THE STATE OF THE INDUSTRY A trend towards finding the breach Identify
ESAP. Release Notes. Release, Build Published Document Version December
ESAP Release Notes Release, Build Published Document Version 3.3.4 December 2018 1.0 Pulse Secure, LLC 2700 Zanker Road, Suite 200 San Jose, CA 95134 https://www.pulsesecure.net 2018 by Pulse Secure, LLC.
CSCD 303 Essential Computer Security Fall 2018
CSCD 303 Essential Computer Security Fall 2018 Lecture 10 - Malware Evasion, Prevention, Detection, Removal Reading: Chapter 6 CompTIA Book, Links Overview Malware Techniques for Evasion Detection/Removal
PDF Essentials. The Structure of PDF Documents
Dr. Edgar Huckert 63773 Goldbach, Germany E-Mail: Huckert@compuserve.com 6-97 PDF Essentials PDF is an acronym for "Portable Document Format". The format has been designed by Adobe for the exchange of
McAfee Web Gateway
Release Notes Revision A McAfee Web Gateway 7.6.2.6 Contents About this release Enhancements Resolved issues Installation instructions Known issues Find product documentation About this release This document
Network Performance Test. Business Security Software. Language: English August Last Revision: 11 th October
Network Performance Test Business Security Software Language: English August 2016 Last Revision: 11 th October 2016 Test commissioned by the vendor - 1 - Introduction This report, commissioned by ESET,
Management Tools. Management Tools. About the Management GUI. About the CLI. This chapter contains the following sections:
This chapter contains the following sections:, page 1 About the Management GUI, page 1 About the CLI, page 1 User Login Menu Options, page 2 Customizing the GUI and CLI Banners, page 3 REST API, page 3
Jsunpack: An Automatic JavaScript Unpacker
Jsunpack: An Automatic JavaScript Unpacker http://jsunpack.jeek.org/ Shmoocon, Washington DC Sunday February 8, 2009 Blake Hartstein Agenda + Problem statement + Prior research and solutions + Jsunpack
Cisco Advanced Malware Protection (AMP) for Endpoints
Cisco Advanced Malware Protection (AMP) for Endpoints Endpoints continue to be the primary point of entry for attacks! 70% of breaches start on endpoint devices WHY? Gaps in protection Gaps in visibility
ESAP Release Notes. ESAP and Junos Pulse Secure Access/Access Control Service Compatibility Chart:
ESAP 2.2.4 Release Notes ESAP 2.2.4 and Junos Pulse Secure Access/Access Control Service Compatibility Chart: This ESAP package can be installed on the following Junos Pulse Secure Access/Access Control
ID: Sample Name: IF-BOQ for Grupo Salinas Demo Test_#Uff ) ( )quotation.pdf Cookbook: defaultwindowspdfcookbook.
ID: 39863 Sample Name: IF-BOQ for Grupo Salinas Demo Test_#Uff0820171206-1134) (12071145)quotation.pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 18:26:05 Date: 12/12/2017 Version: 20.0.0 Table of Contents
Errata for PDF Reference, third edition (as published in the first printing, November 2001) -------- Copyright (c) 2001-2003 Adobe Systems Incorporated. All rights reserved. Last modified: 18 June 2003
ESAP. Release Notes. Release, Build Published Document Version November
ESAP Release Notes Release, Build Published Document Version 3.3.2 November 2018 1.0 Pulse Secure, LLC 2700 Zanker Road, Suite 200 San Jose, CA 95134 https://www.pulsesecure.net 2018 by Pulse Secure, LLC.
ESAP Release Notes. ESAP and Junos Pulse Secure Access/Access Control Service Compatibility Chart:
ESAP 2.5.3 Release Notes SDK Version: Windows and Mac 3.6.8682.2 (V2 Unified + V3) ESAP 2.5.3 and Junos Pulse Secure Access/Access Control Service Compatibility Chart: This ESAP package can be installed
CSCD 303 Essential Computer Security Fall 2017
CSCD 303 Essential Computer Security Fall 2017 Lecture 13 - Malware Evasion, Prevention, Detection, Removal Reading: Chapter 6 CompTIA Book, Links Overview Malware Techniques for Evasion Detection/Removal
Destructive Malware 12 February 2015
JOINT INDIC ATOR BULLETIN Distributed as TLP: GREEN Reference Number: JIB-14-20199C Destructive Malware 12 February 2015 DISCLAIMER: This bulletin is provided as is for informational purposes only. The
Abusing JSONP with. Michele - CVE , CVE Pwnie Awards 2014 Nominated
Abusing JSONP with Michele Spagnuolo @mikispag - https://miki.it Pwnie Awards 2014 Nominated CVE-2014-4671, CVE-2014-5333 Rosetta Flash FWSÏx DADË
Self-Learning Systems for Network Intrusion Detection
Self-Learning Systems for Network Intrusion Detection Konrad Rieck Computer Security Group University of Göttingen GEORG-AUGUST-UNIVERSITÄT GÖTTINGEN About Me» Junior Professor for Computer Security» Research
The Future of PDF/A and Validation
PDF Days Europe 2017 The Future of PDF/A and Validation Dietrich von Seggern, callas software GmbH The Future of PDF/A (and) Validation 2017 by PDF Association 1 The Future of PDF/A (and) Validation verapdf
How To Remove Xp Internet Security 2011 Virus Manually
How To Remove Xp Internet Security 2011 Virus Manually Contact your anti-malware vendor for assistance with identifying or removing virus or worm infections. If you need more help with malware removal
How To Manually Uninstall Symantec Antivirus Corporate Edition 10.x Client
How To Manually Uninstall Symantec Antivirus Corporate Edition 10.x Client Download Symantec Norton AntiVirus Definition Update (Upgrade/Patch). proactively block attacks and detect and remove threats
ID: Sample Name: Curriculum Empresarial.pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 17:52:22 Date: 09/11/2017 Version: 20.0.
ID: 36564 Sample Name: Curriculum Empresarial.pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 17:52:22 Date: 09/11/2017 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview Information
How To Remove Internet Security Pro Virus. Manually >>>CLICK HERE<<<
How To Remove Internet Security Pro Virus Manually Instructions to remove Defender PRO 2015 virus and get rid of Defender PRO 2015 malware from Windows. Tech & Internet Security / News & Guides Click the
Test Strategies & Common Mistakes International Antivirus Testing Workshop 2007
Test Strategies & Common Mistakes International Antivirus Testing Workshop 2007 Andreas Marx, MSc. CEO, AV-Test GmbH http://www.av-test.org Table of Content About AV-Test.org Tests of Security Software
TH IRD EDITION. Python Cookbook. David Beazley and Brian K. Jones. O'REILLY. Beijing Cambridge Farnham Köln Sebastopol Tokyo
TH IRD EDITION Python Cookbook David Beazley and Brian K. Jones O'REILLY. Beijing Cambridge Farnham Köln Sebastopol Tokyo Table of Contents Preface xi 1. Data Structures and Algorithms 1 1.1. Unpacking
Obfuscating Transformations. What is Obfuscator? Obfuscation Library. Obfuscation vs. Deobfuscation. Summary
? Obfuscating Outline? 1? 2 of Obfuscating 3 Motivation: Java Virtual Machine? difference between Java and others? Most programming languages: Java: Source Code Machine Code Predefined Architecture Java