Submit web url, comments

Trying out a couple of newly written features - submit a document/pdf/zip from a web link (which is handy to see what's in those emailed links) try it here. Also added a comments box to each MD5 report page to perhaps drive some collaborative analysis. Migrated the forms throughout to HTML5 to take advantage of some of the new browser features.

APT Malware Trends

Some history on the most common Adobe PDF and MS Office exploits and the timeline of their detection on ViCheck.ca:


CVE-2006-2492 MS Word
July 2009 - Current

CVE-2009-0927 PDF Collab.getIcon
July 2009 - Current

CVE-2007-5659 PDF Collab.collectEmailInfo
September 2009 - Current

CVE-2009-3957 PDF Colors
September 2009 - February 2010

CVE-2008-2992 PDF util.printd
December 2009 - Current

CVE-2009-3954 PDF 3D
December 2009 - May 2010

CVE-2009-3953 CVE-2009-3959 PDF U3D
December 2009 - May 2010

CVE-2009-4324 PDF media.newPlayer
December 2009 - Current

CVE-2008-2992 PDF util.printd
December 2009 - Current

CVE-2010-0188 PDF TIFF
March 2010 - Current

CVE-2009-3129 MS Office
June 2010 - Current

CVE-2010-1297 PDF+Flash
June 2010 - Current

View detection hits as hexdump on ViCheck.ca

For recently analyzed reports, we've added a Beta Analysis Report linked to from the regular report page, you can view hex humps of the exploits or embedded executables:

Detect JavaScript exploits in PDF, or embedded executables in MS Office exploits in .doc, xls, ppt files on ViCheck.ca.

More fun with PDF Obfuscation

Another interesting way to hide a block of JavaScript inside a PDF, info.Trailer:

exmu='dmw';if(app.alert)exmu='';WmMw=this;zisc=WmMw.info;exmu=exmu+unescape('%')+exmu;y1vw=zisc.Trailer.replace(/([A-Z])/g,exmu);app.setTimeOut(unescape(y1vw),3)

Shellcode Detection Tool

New web tool - paste your hex right from a hex editor into the Decoder Tool and select Detect as shellcode to run a LibEmu detection scan. Also decode various JavaScript obfuscation methods such as charFromCode, unicode, regular hex escaping.

Executable extraction from documents

New feature in beta, extraction of the EXE files and embedded documents. Check the bottom of the report page for a list of embedded files. The MD5's may vary from actual dropped files as any whitespace at the end of the exe's won't be included.

PDF JavaScript Obfuscation

Here's a quick note on an emerging JavaScript obfuscation technique. The use of getAnnots and syncAnnotScan to iterate through FlateDecode blocks which contain raw encoded data. Inside the encoded data is usually packed obfuscated JavaScript with some recent exploit.

var z; var y; z = y = app.doc;
y = 0; z.syncAnnotScan ( ); y = z;var p = y.getAnnots( { nPage: 0 }) ;var s = p[0].subject; var l = s.replace(/z/g, 'a%b'.replace(/[ab]/g, ''));s = this['unes' + 'cape'] (l) ;var e = app['ev' + 'al']; e(s); s = ''; z = 1;