Hello and welcome in this video, I'm going to talk about streaming and data and coding and how it is
used to obfuscate hidden data or hidden secrets inside PDF document.
PDAF can include data in multiple ways.
Let us take a look at one example of a PDF file which contains the falling object.
This object has caught the stream Keywood and the inside it you have the string.
Hello.
And now he also has the opening object and enclosing an object.
So this whole thing is actually an object which contains a string.
So how are we going to encode this?
To obfuscate this?
This is one way the malicious PDAF Ortel could use hacks and coding, for example, using the Hexa encoding
for Hello, this is what Halloa will look like.
So hish e l l o space and world is converted into the text representation, which is bound for the year
before age 65 or E and so on.
So this is one way in which the string can be obfuscated using hex encoding.
So coming back to this example of change, if we were to use hex encoding for Hello World, we will
get something like this.
So now the Hallowell has been called in to become a different obfuscated string.
This is a list of some of the other available encoding methods.
As we have seen, HelloWallet can be included into Destry.
We can also include the string Hallowell using after including.
So everybody there, including you, used a backslash followed by the the representation for the age
of the one four five four e October five for four hours and so on.
The malicious author can also create a mix between octal and Hex, including, for example, here we
see the character which is incorrect hex including.
Followed by a character being encoded with octal, which is by searching for five and then in character
L, the encoded V hex encoding, which is bound Cixi and the other L is encoded using after encoding,
which is backslash one, five, four and so on.
And to add some variety and further obfuscation, the malicious article also and whitespace for example,
each and some white space followed by the octal encoding for E followed by the hex including four L
and then after that is a space again and so on.
So when this thing is being decoded in the document, the white space will be no.
But this is definitely one way in which the author can defeat static pattern analysis.
If you want to use your arrows, for example, to detect Yarraville, fail to detect this.
So these are some things you should be aware when you are doing analysis as well.
Another way in which the data are malicious script can be Fosgate.
It is about using filters to decode data so the malicious autocratic string on data and encoding using
hex.
For example, you get this.
So this is actually the same as what we saw here for a cease fire, sixty six years, he said minus
eight pounds symbol.
So the object could use something called a filter, a filter would tell a PDF reader that this is your
string here is supposed to be decoded using this method hex code.
So when the object is being read or being read, the PDA reader will then use this tactic to decode
this back into a normal string.
So this is a meaningless filter.
So the syntax is the filter, followed by the type of filter to be applied to the object.
Let's take a look at another example.
It is also possible to combine multiple filters to decode obfuscated string.
So, for example, in this case here, this string here has gone through two processes, two levels
of obfuscation.
The first obfuscation is to decode it in hex, and the second obfuscation is to compress it.
So when the reader sees this filter ewood decoding first, uncompress it first and then only decode
it back from hex to ski so the coding is done in reverse.
So this gives the malware a lot more choice to further obfuscate the string by combining various hex
encoding plus compression as well.
So remember, when you are trying to decode this, trying to obfuscate this, always look for the future
and the type of the encoding obfuscation being used and then apply the obfuscation by going the reverse.
That means decode it in reverse order and compress in this case, followed by Hectically in this case.
There are multiple ways in which obfuscation can be done.
For example, there is a hefty code.
You have also NCW compression.
You also have Zetlin compression base 85 and also encryption itself.
So if you don't find something which is listed here, I always use Google to search for some more information.
So this is a example of a malicious PDAF document.
So in here you can see that this PDA document has got several objects on top here.
You see this object, number one, based on the idea and the version number and the opening object that
includes including object.
And this particular object type catalog.
And then here you have object number seven based on 87, version zero, the opening object to the closing
object.
Take any type of this object, which is JavaScript.
And the object here is denoted by the ideate.
He was Shinjiro, the opening object to the closing object.
And then there's some object within it, which is stream or stream type and closing stream type.
And inside here you see the obfuscated string.
And in here you can see that this string has been put through two processes of obfuscation.
First is to compress it and into two, encode.
How do you read this sequence of objects looking at the first object, which is object number one of
that catalog?
You can see that there is an open I shouldn't be specified here.
This directive and these operations parameter is seven seven refers to this object.
That means when this malicious document is being open, it will execute this directive to open object
number seven.
So it would jump to object number seven.
And number seven, you will see an error directive saying that is JavaScript, JavaScript object and
this JavaScript objects parameter is eight.
And this eight here would then refer down into another object, eight here.
And this object here is to string the obfuscated string that we are seeing here.
So what you will do then he will look at the filter directly and the parameters of this filter, and
then the reader will know that it is supposed to the could of this a using the parameters here.
So it will decoding first, hectically first and then you would uncompress it in order to get back the
original JavaScript code.
And after because of this operation, the PDAF document, we didn't execute whatever JavaScript that
has been decoded into plain text.
So this is the one of the method by which a proper document is able to execute malicious code using
JavaScript, which has been obfuscated.
So that brings us to the end of this video lesson.
Thank you for watching.