di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Events & Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DEPLOYMENT

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ Tanium

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE LEGACY AV

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

hermeticwiper-russia-ukraine-cyber-warfare.jpg

On February 24, the Russian-Ukrainian conflict escalated into an invasion of Ukraine by Russian armed forces. However, these hostilities were not limited to the physical domain. Cyber warfare is&nbsp;happening in parallel to the armed conflict, becoming an inseperable part of the hostile exchanges between these nations.&nbsp;Our Threat Research team noted various cyberattacks deployed by Russia in the weeks preceding the invasion aimed at sowing chaos and disrupting communications within Ukraine’s government and military institutions. While the most publicized of these cyberattacks were the DDoS attacks, official government website take-downs, and website defacements, the most disruptive attack was a disk-wiping malware called <a href="/blog/the-ukrainian-government-cyberattack-what-you-need-to-know" target="_self">WhisperGate</a> which we covered in a previous post. &nbsp;On February 23, one day before the larger Russian land invasion began, Ukrainian organizations were targeted by another destructive disk-wiping malware dubbed HermeticWiper designed to wipe a computer’s hard disk data and destroy the Master Boot Record and partitions, making any impacted&nbsp;machines inoperable.&nbsp;<h5>What is HermeticWiper&nbsp;&nbsp;</h5>HermeticWiper makes use of a driver belonging to an outdated version of EaseUS Partition Master application, developed by CHENGDU YIWO Tech Development. The attackers used a benign, digitally signed kernel driver to evade detection while utilizing the driver's ability to interact with storage devices and acquire low-level disk access for retrieving partition information, corrupting the device’s disks.&nbsp;While the driver is digitally signed by ‘Hermetica Digital Ltd’ (hence the wiper name), the certificate is now revoked.&nbsp;&nbsp;<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt60a3216c14924275" alt="Figure1 – left – EaseUS invalid signed driver; right – HermeticWiper signed certificate " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt60a3216c14924275/621e37b2ae198a13f6e78d85/01-easeus-invalid-signed-driver-and-hermetic-signed-certificate.png" /><figcaption >Figure1 – left – EaseUS invalid signed driver; right – HermeticWiper signed certificate</figcaption></figure>The malware stores 32-bit and 64-bit versions of the driver in MS-compressed copies within its resource section, deploying it according to the operating system version. Forensic analysis reveals that the malware has several variants, one with a timestamp dating to December 2021, indicating the attack has been 'in progress’ for quite some time.&nbsp;We've observed several attacks which precede the execution of the wiper. In one case, the attackers exploited a known vulnerability in Microsoft SQL Server <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1636" target="_blank">(CVE-2021-1636)</a> to gain a foothold in one of the Ukrainian organizations. In a separate case, the attackers gained access to the network via malicious SMB activity against a Microsoft Exchange Server, which led to credential theft, and later to the deployment of the wiper. Several other methods were also employed, including the <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1938" target="_blank">Apache Tomcat vulnerability</a>, which allowed the attackers to run PowerShell commands, dump credentials, and execute the malware.&nbsp;When executed, HermeticWiper will first gain higher privileges by utilizing <a href="https://attack.mitre.org/techniques/T1134/" target="_blank">Access Token Manipulation [T1134]</a> and then obtain "SeBackupPrivilege" (which allows it to retrieve any file content) and "SeLoadDriverPrivilege" (which allows it to load/unload any driver). As we previously mentioned, HermeticWiper uses EaseUS signed driver in order to manipulate the disk.&nbsp;Next, HermeticWiper will disable Volume Shadow Service (vss) and disable crash dumps by modifying specific registry keys, ensuring that no backups will be available and covering its tracks.&nbsp;It will then enumerate the system’s physical drives. For each, it will then corrupt the first 512 bytes and destroy the Master Boot Record (MBR).&nbsp;While this should be enough to make any computer inoperable, HermeticWiper doesn't stop there. It next checks for NTFS or FAT file systems and corrupts them, ensuring that systems with both MBR and GPT drives are compromised. The Wiper will then force system shutdown to complete the wiping operation.&nbsp;Similar to the previous WhisperGate attack, where the wiper was disguised as <a href="/ransomware-protection-solution" target="_self">ransomware</a>, the attackers appear to be using PartyTicket ransomware as a decoy in addition to the HermeticWiper malware to distract from the wiper attacks.<h5>Russia-Ukraine Cyber Warfare&nbsp;</h5>As we mention above, Russia started its&nbsp;cyberattack campaign long before the armed forces invasion. However, after the HermeticWiper attack began on February 23 we’ve seen a surge in cyber warfare between the two countries.&nbsp;Here is the timeline of the&nbsp;major events:&nbsp;<ul><li>Feb 23</li><ul><li>Ukraine’s ministry of foreign affairs and the Security Service of Ukraine (SBU) websites were taken down while Ukrainian troops received threatening SMS messages with the aim of demoralizing them by urging them to flee or be killed.</li><li>Sandworm/VoodooBear group, both of which have previously been attributed to the Russian military intelligence service (GRU),&nbsp;use Cyclops Blink, a Linux malware which can extract device information and download additional payload.</li></ul><li>Feb 24&nbsp;</li><ul><li>The portal of the “Ministry of Agrarian Policy and Food” of Ukraine&nbsp;is defaced by a group named Free Civilian. The group offers databases containing sensitive government and citizens information for sale.</li><li>The Anonymous hacking collective announced their support for Ukraine with the following message:</li><figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt0a848cf892ce5fe6" alt="Figure2 – Anonymous group declaration " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0a848cf892ce5fe6/621e34b4c547bf13f7cbdc4e/03-anonymous-group-declaration.png" /><figcaption >Figure2 – Anonymous group declaration</figcaption></figure></ul><li>Feb 25&nbsp;</li><ul><li>A massive phishing email campaign targets Ukrainian troops’ private “i.ua” and “meta.ua” accounts, delivered by UNC1151 (aka GhostWriter) which relates to officers of the “Ministry of Defence of the Republic of Belarus.”</li><li>The infamous Conti group&nbsp;announces their full support the Russian government in the following blog post:</li><figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt3f77a7ddc1f9f32a" alt="Figure 4 – Conti group declaration" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3f77a7ddc1f9f32a/621e34b41b03c812b3ab3a26/04-conti-group-declaration.png" /><figcaption >Figure 4 – Conti group declaration</figcaption></figure></ul><li>Feb 26 - The Vice Prime Minister of Ukraine Mykhailo Fedorov announces the creation of the “IT Army,” crowdsourced offensive operations against Russian infrastructure, aimed at&nbsp;recruiting cyber specialists willing to help.&nbsp;</li><li>Feb 27 - The LockBit ransomware group declares they will leak all victims’ data.&nbsp;</li><li>Feb 28 – One of Conti group members begins&nbsp;leaking data from the group’s chat after their previous announcement&nbsp;supporting the Russian government.&nbsp;</li><img asset_uid="blt1c1b39da5398d4a1" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1c1b39da5398d4a1/621e34b4a7ffe43cc8639e4e/05-qwe.png" height="auto"/></ul>&nbsp;<h5>IOCs&nbsp;</h5><table><tbody><tr><td>Context&nbsp;</td><td>sha256&nbsp;</td></tr><tr><td>EaseUS driver&nbsp;</td><td>e5f3ef69a534260e899a36cec459440dc572388defd8f1d98760d31c700f42d5&nbsp;</td></tr><tr><td>EaseUS driver&nbsp;</td><td>b01e0c6ac0b8bcde145ab7b68cf246deea9402fa7ea3aede7105f7051fe240c1&nbsp;</td></tr><tr><td>EaseUS driver&nbsp;</td><td>b6f2e008967c5527337448d768f2332d14b92de22a1279fd4d91000bb3d4a0fd&nbsp;</td></tr><tr><td>EaseUS driver&nbsp;</td><td>fd7eacc2f87aceac865b0aa97a50503d44b799f27737e009f91f3c281233c17d&nbsp;</td></tr><tr><td>EaseUS driver&nbsp;</td><td>96b77284744f8761c4f2558388e0aee2140618b484ff53fa8b222b340d2a9c84&nbsp;</td></tr><tr><td>EaseUS driver&nbsp;</td><td>8c614cf476f871274aa06153224e8f7354bf5e23e6853358591bf35a381fb75b&nbsp;</td></tr><tr><td>EaseUS driver&nbsp;</td><td>23ef301ddba39bb00f0819d2061c9c14d17dc30f780a945920a51bc3ba0198a4&nbsp;</td></tr><tr><td>EaseUS driver&nbsp;</td><td>2c7732da3dcfc82f60f063f2ec9fa09f9d38d5cfbe80c850ded44de43bdb666d&nbsp;</td></tr><tr><td>HermeticWiper&nbsp;</td><td>1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591&nbsp;&nbsp;</td></tr><tr><td>HermeticWiper&nbsp;</td><td>0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da&nbsp;</td></tr><tr><td>HermeticWiper&nbsp;</td><td>ca3c4cd3c2edc816c1130e6cac9bdd08f83aef0b8e6f3d09c2172c854fab125f&nbsp;</td></tr><tr><td>HermeticWiper&nbsp;</td><td>2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf&nbsp;</td></tr><tr><td>HermeticWiper&nbsp;</td><td>3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767&nbsp;</td></tr><tr><td>PartyTicket&nbsp;</td><td>4dc13bb83a16d4ff9865a51b3e4d24112327c526c1392e14d56f20d6f4eaf382&nbsp;</td></tr></tbody></table>&nbsp;<h5>Predictions and guidance&nbsp;</h5>The ongoing Russian-Ukrainian conflict is already causing a significant escalation in the quantity and scope of attacks from many, disparate parties. Elevated activity is being seen from state-sponsored groups, non-state-sponsored actors, and by independent hacktivists like the Anonymous group. &nbsp;The unprecedented raft of sanctions enacted against Russia may invoke further retaliation and response in the form of cyberattacks by Russian-based organized cybercrime groups and state-sponsored or contracted actors. We have already seen several cyber gangs <a href="https://twitter.com/BrettCallow/status/1497249143663652865" target="_blank">supporting Russia</a> threaten to use their resources to strike back against nations and organizations that may coordinate cyberattacks against Russia. &nbsp;We estimate the ongoing physical conflict escalation combined with the new sanctions will lead to a higher risk profile; this will be heightened for sectors associated with sanctions and have high economic or national security value. These may include financial services, aviation and aerospace, energy, and critical infrastructure. &nbsp;&nbsp;Following are some key points to consider or act upon given the changes in the risk profile: &nbsp;<ul><li>Threat actors are targeting organizations with <a href="https://www.zdnet.com/article/ukraine-security-agency-warns-of-ghostwriter-threat-group-activity-phishing-campaigns/" target="_blank">phishing attempts</a> related to the conflict. Security staff should remind or re-educate employees to minimize successful social engineering attempts.</li><li>Every application in the organization can be a potential backdoor to the organization. These applications need to be updated frequently with the latest security patches. Organizations should apply a strict application control policy while limiting applications which are not critical to their business.</li><li>Scripts are a powerful execution mechanism. There are entire industries (healthcare, for example) where most users in the organization have no need to execute scripts. Security staff should restrict scripts execution based on a user’s roles and devices.</li><li>To ensure increased visibility, it is recommended to configure or enable additional layers of logging when and where available.</li><li>Incident response requires considerable time and resources. The initial response of the security staff to a possible threat can make a huge difference in the overall impact of the attack impact. Trained security staff with a dedicated playbook for incident response scenarios should prevent additional infection and lateral movement inside the organization.</li><li>In order to be as evasive as possible threat actors have learned to live-off-the-land. With the use of PowerShell and other libraries in the operating system, bad actors can stay under the radar. SOC operators should be extremely attentive to <a href="https://blog.talosintelligence.com/2019/11/hunting-for-lolbins.html" target="_blank">potential LOLbins</a> attacks.</li></ul><h5>Protection from HermeticWiper with Deep Instinct&nbsp;</h5>Deep Instinct prevents HermeticWiper and PartyTicket statically prior to execution, stopping it before it can deploy.&nbsp;<img asset_uid="bltc997c553b0676e5d" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc997c553b0676e5d/621e34b425232e3cccc40cb5/06-deep-instinct-modal-pe32.png" height="auto"/><img asset_uid="blt8b3c90bb74b58931" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8b3c90bb74b58931/621e34b4669c5d12b9469888/07-deep-instinct-modal-pe64.png" height="auto"/>If you’d like to learn more, please <a href="/request-a-demo" target="_self">request a demo</a>.&nbsp;

What is HermeticWiper – An Analysis of the Malware and Larger Threat Landscape in the Russian Ukrainian War 

PDF As A Weapon Of Choice

Cybersecurity threat detection and response is a game of action and reaction. Cybercriminals endeavor to find creative new ways of misdirection and obfuscation. And security experts work tirelessly to identify, research, and develop new ways to guard against these threats.The weaponization of PDFs is one way bad actors have widened the cybersecurity battlefield, turning what many see as an innocuous file into something used for nefarious purposes.The Portable Document Format, or PDF, as it’s better known, was developed by Adobe in 1993 to allow anyone to view a complex document without the need for a dedicated program and independent of any particular platform. PDF files can be opened in any operating system and with any web browser – or via a PDF reader.Based on the <a href="https://en.wikipedia.org/wiki/PostScript">PostScript</a> language[<a href="#i">i</a>], a PDF can contain a variety of information, including text, hyperlinks, multimedia, images, attachments, metadata, and other data, making it a very detailed format. The PDF reference documentation that describes the potential of this very powerful and versatile file format contains more than 800 pages.In this blog we’ll look more closely at the PDF and a variety of ways cybercriminals are using it to fool detection and infiltrate networks. We’ll also show how Deep Instinct detects compromised PDFs, immediately disabling them from being opened.PDF StructurePDF is composed of 4 main sections: Header, Body, Xref table, and Trailer.Header A simple section that specifies the PDF file format and the version number, in our case 1.7 (the “%” sign in PDF specifies a comment)Body The PDF body contains all of the objects that represent the layout of a document, including images, fonts, pages, scripting code, and more.Cross-Reference (Xref) Table Just as the name suggests, this is a table of cross-references – a data structure that contains references (offsets) to objects (images, etc.) within the file, allowing the PDF reader to find any object at any time without the need to load the entire document into memory, and quickly navigate between pages.Trailer PDF reader will first look at the Trailer as it contains the necessary information for parsing the entire file. The most important keys are the offset to cross-reference table, the number of objects in the file, and the reference to the catalog (root) object. The catalog object is the first object in the Body hierarchy and defines how the document is displayed (the page-layout), the objects are outlined, and the content presented.Common Attack Vectors Now that we’ve reviewed how PDFs are architected, let’s examine how they are being compromised and used by cybercriminals.Similar to MS Office documents, PDF files have been in widespread use for many years now. Along with its popularity and due to the fact that it's a cross-platform format, PDF files are very appealing for threat actors and are used as an initial point of infection for victims.From a simple Phishing attack to a sophisticated exploit, PDF can be weaponized in many ways.Phishing When PDF became a popular document format, cybercriminals recognized an opportunity to use social engineering techniques to deliver Phishing PDFs.As with Office documents, email attachments have become the primary means of distribution.Other document types, such as Office files, have earned a bad reputation over the years because they’ve been widely exploited using various vulnerabilities and macros. PDFs have historically been viewed as a safer format and developed a reputation as being less dangerous due to less publicized breaches and actual threats seen in the wild.Phishing PDFs typically contain a link to an external URL that is designed to forward the user to one of these:<ul><li>Phishing site – (it could be a fake banking, dating site, or other e-commerce page) that encourages victims to enter their personal information which is sent to the attacker.</li><li>Traffic Direction Systems (TDS) – these systems are a web-based gateway designed to analyze a user’s machine to collect system data such as OS, geo-location, language, and more. Using TDS, an attacker can redirect the victim to various advertising websites or even to a malware infection page.</li><li>Malware infectionwebsite – these sites usually contain code that downloads a malicious file onto the victim’s machine.</li></ul>These methods are fairly simple and don’t require a very sophisticated attacker to carry them out.A common trend in recent years – a captcha picture with an embedded URL redirecting the victim to a phishing or unwanted ad website.Actions and JavaScript Most PDF users are aware of and use PDF editing capabilities. In fact, for many, this may be the extent to which they use PDFs. But there is also a feature called  "Actions" which can be used to preform a variety of tasks, including the following:<ul><li>Open a web link</li><li>Open a file</li><li>Run JavaScript code</li><li>Submit a form</li><li>… and other actions</li></ul>These actions are triggered by "Events." Common examples of such “Events” can include saving or closing the PDF, mouse clicking, and so on. A user can create a document that, when closed, will open a web page with a specific location.Some of the actions and triggers that can be created using Adobe Acrobat:<ul><li>SubmitForm – this action allows sending information via an interactive form template to a pre-defined remote location, using AcroForms or newer XML Forms Architecture (XFA)[<a href="#ii">ii</a>] from Adobe.</li><li>JavaScript – if fully supported by the PDF reader, JavaScript can be used to access and manipulate any part of the document. It has also been used to exploit various PDF readers’ vulnerabilities.</li><li>URL – victims can be tricked with various social engineering methods to follow the embedded URLs in an attempt to drop malware, commit phishing, or simply force victims into visiting sites with unwanted ads.</li></ul>In the figure below we can see a basic SubmitForm action that mimics an Amazon email and password form. An attacker can use social engineering to convince potential victims to fill out the form and then forward their credentials to a remote server.This type of plain attack, as with the phishing scams that we’ve seen before, can affect most PDF readers and browsers. These attacks rely on readers’ built-in features by design and will always work, if allowed by users, as opposed to the exploitation of vulnerabilities found in PDF readers.Action that mimics an Amazon form and the malicious code behind it.In addition to phishing, JavaScript can be used to submit filled forms information, as well as leveraged to perform powerful actions like issuing PowerShell commands or dropping a malicious file.Examples of popup messages warning the user of hidden JavaScript content.As we’ve seen, JavaScript can be used to exfiltrate data and/or run malicious code on the user’s machine, but it is also powerful enough to exploit potential vulnerabilities found in PDF readers.Exploits and vulnerabilities PDF documents can be viewed with browsers and PDF readers or dedicated applications for PDF files and each may have vulnerabilities threat actors can exploit.These vulnerabilities can be divided into several categories, including, but not limited to the following:<ul><li>Arbitrary code execution[<a href="#iii">iii</a>]</li><li>Buffer overflow[<a href="#iv">iv</a>]</li><li>Denial-of-service[<a href="#v">v</a>]</li><li>Memory corruption[<a href="#vi">vi</a>]</li><li>Out-of-bounds read</li></ul>Common Vulnerabilities and Exposures (CVE) is a listing of publicly known security weaknesses. There are hundreds of CVE for PDF readers[<a href="#vii">vii</a>] and almost 300 known vulnerabilities for Adobe Acrobat Reader alone[<a href="#viii">viii</a>].While companies update their products regularly, it is important to remember that there are still many “zero day”[<a href="#ix">ix</a>] vulnerabilities that haven’t been reported or discovered yet. Additionally, many users still use older and unpatched versions of PDF readers and browsers.Security researchers and threat actors find new PDF-related exploits almost daily, with “out-of-bounds read” vulnerabilities being one of the most common.An out-of-bounds read vulnerability occurs when a program tries to read data from before the beginning of a buffer or past its end. In computer science, a buffer is a segment of physical memory that stores temporary data so it can be utilized.This usually happens when a pointer of an arithmetic operation results in a position outside the bounds of allocated memory; this may cause the program to crush or corrupt the memory.An attacker can use this vulnerability to their advantage. By reading out-of-bounds memory addresses or secret values, the bad actor can gather information that may assist in achieving an exploitation of an unrelated weakness and execute an arbitrary code on a victim’s machine.Here is an example of this vulnerability seen exploited in the wild:CVE-2018-4893 – This vulnerability occurs as a result of computation that reads data that is past the end of the target buffer; the computation is part of XPS (XML Paper Specification)[<a href="#x">x</a>] font processing. Published in February 2018, this critical vulnerability is already three and a half years old at the time of this writing. Nevertheless, it is still being seen in the wild.Anti-Virus vendors vs Mal-PDF Distinguishing between a Phishing PDF and a legitimate one can be challenging. The example below shows just how similar both documents appear to be. They possess a very analogous structure – both consist of one page with little text and a hyperlink to click which redirects the user to a web page.Even next-gen antivirus vendors can struggle to accomplish this task. While the challenges to mitigate this vary by vendor, poor detection capabilities or poor identification and classification can lead to a high false-positive rate. Many antivirus vendors fail to correctly detect phishing PDFs.<div></div>Very similar PDF documents, a legitimate Booking invoice on the left compared to an Apple Phishing email on the right.The figure below is taken from a Phishing PDF[<a href="#xi">xi</a>] that attempts to persuade the user to review the document while redirecting to a fraudulent web page.The PDF was first submitted to Virus-Total on January 14, 2021. Not only was no vendor able to detect it, but this document was analyzed multiple times with zero detections on each analysis.We then dropped the sample in our lab station where our Deep Instinct agent was installed, and we received a popup which alerted us that a threat was detected. Any attempt to open the file was immediately disabled.ConclusionWe have discussed how PDF documents are structured and explained what type of actions are available when creating a file. We’ve seen how an attacker, by using custom JavaScript or built-in actions, can craft a PDF that will deliver a phishing or malware attack, or even use one of many vulnerabilities to exploit the platform and carry out an even more impactful attack.Furthermore, we’ve demonstrated how difficult it is to distinguish between a phishing attempt from a legitimate PDF, and how even next-gen antivirus vendors have a difficult time detecting these types of attacks.Deep Instinct secures its clients with a robust deep learning-based protection mechanism able to seamlessly prevent zero day threats in the form of PDF, PE, and other malicious files.If you’d like to hear more about our industry-leading approach to stopping malware, please <a href="/contact-us/" target="_self">contact us </a>and we’ll set up a demo.Referencesi<a href="https://en.wikipedia.org/wiki/PostScript">https://en.wikipedia.org/wiki/PostScript</a>ii<a href="https://pdf.wondershare.com/pdf-forms/acroforms-vs-xfa-forms.html">https://pdf.wondershare.com/pdf-forms/acroforms-vs-xfa-forms.html</a>iii<a href="https://en.wikipedia.org/wiki/Arbitrary_code_execution">https://en.wikipedia.org/wiki/Arbitrary_code_execution</a>iv<a href="https://en.wikipedia.org/wiki/Buffer_overflow">https://en.wikipedia.org/wiki/Buffer_overflow</a>v<a href="https://en.wikipedia.org/wiki/Denial-of-service_attack">https://en.wikipedia.org/wiki/Denial-of-service_attack</a>vi<a href="https://en.wikipedia.org/wiki/Memory_corruption">https://en.wikipedia.org/wiki/Memory_corruption</a>vii<a href="https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pdf">https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pdf</a>viii<a href="https://www.cvedetails.com/product/497/Adobe-Acrobat-Reader.html">https://www.cvedetails.com/product/497/Adobe-Acrobat-Reader.html</a>ix<a href="https://en.wikipedia.org/wiki/Zero-day_(computing)">https://en.wikipedia.org/wiki/Zero-day_(computing)</a>x<a href="https://www.pcmag.com/encyclopedia/term/xml-paper-specification">https://www.pcmag.com/encyclopedia/term/xml-paper-specification</a>xi be723a06cc6f25242bce9207aed5024dc15d8c5285be5755600bbdac456da7fb

PDF as a Weapon of Choice on the Cybersecurity Battlefield

Discover how Deep Instinct DSX protects your NAS storage more effectively than Trellix.