TECH TRAINING 2: PRACTICAL MALICIOUS DOCUMENT ANALYSIS

No ratings

Presented at HackInTheBoxMalaysia 2014 by

Mahmud Rahman

Targeting attack normally will leverage on malicious documents to attack the victim. The buzzword on APT or Advance Persistence Threat was coin out of this attack. Attacker carefully crafted their malicious document with spear phishing email or web and sent it over to target. We have observed a lot of attacks trying to abuse the vulnerabilities on html, office, flash and pdf documents. As users are less cautious opening document files, the malicious document files has become quite a successful attack vector. Many office related documents such as *.doc, *.xls and *.pdf are used in combination with malicious flash or javascript in this attack to provide a better way of obfuscation or more reliable exploitation technique. This hands-on workshop will highlight techniques and issues related to analyzing malicious documents files (office, flash and PDF).This workshop will walk through participant how to analyze in-the-wild malicious documents. We’ll share how we can analyze malicious document file by using few techniques and method against different office file formats. Shellcode analysis will be conducted as well to get the whole picture of malicious documents attack anatomy. By the end of this course, students will be able to analyze a malicious document files and know how to solve obfuscation techniques used and how to extract the payload in order to perform a further analysis.