New PDF Tool to Detect Malicious PDF Using PDF Object Hashing Technique
An open-source tool, PDF Object Hashing, has been introduced to identify malicious PDFs by analyzing their structural characteristics. Developed by Proofpoint, this tool assists security teams in creating effective threat detection rules based on unique…
An open-source tool, PDF Object Hashing, has been introduced to identify malicious PDFs by analyzing their structural characteristics. Developed by Proofpoint, this tool assists security teams in creating effective threat detection rules based on unique object features in PDF files.
The tool focuses on the structural elements of PDFs rather than transient components like URLs or images, enabling attribution to specific threat groups. This approach is particularly relevant as threat actors increasingly use PDFs for malware delivery, credential phishing, and business email compromise (BEC) attacks.
PDFs are commonly used in email-based attacks, embedding elements like URLs leading to malware or QR codes directing to phishing sites. These files can also initiate chains leading to remote access trojans or data theft.
The complexity of the PDF format, with its multiple variations for compatibility, presents challenges in threat detection. This complexity includes encrypted streams hiding URIs, compressed objects obscuring payloads, and flexible structure allowing endless formatting variations. Traditional signature-based detection methods often fail due to these complexities.
An open-source tool, PDF Object Hashing, has been introduced to identify malicious PDFs by analyzing their structural characteristics.
PDF Object Hashing addresses these issues by parsing the file's object hierarchy and extracting types such as Pages, Catalog, XObject/Image, Annotations/Link, Metadata/XML, Producer, and Font/Type1. These are concatenated and hashed into a stable fingerprint, allowing for effective threat detection without decryption.
Proofpoint applied this tool to track threat groups such as UAC-0050, targeting Ukraine with encrypted PDFs impersonating OneDrive. These deliver NetSupport RAT via JavaScript-laden URLs. Hashing exposed structural similarities, enabling rapid signature creation and payload blocking.
Another example involves UNK_ArmyDrive, an actor active in India, using PDFs in BEC lures like fake Bangladesh Ministry documents. The tool facilitated detection and mitigation of these threats through effective clustering and signature development.
Based on reporting by Cyber Security News.