Hello and welcome.
In this video, I'm going to show you how I do the analysis on Mel PDAF to you.
So go and download this and create a folder in this Melbourne hotel and call it zero two dash flat and
put your zip file there.
After that, go to the malware folder, the two left folder and then unzip the zip code on the password
is cracking lessons dot com.
After unzipping it, you will see a new subfolder column, underscore PDF, underscore two, if you
open it, you will see the malicious PDF file over there.
As you can see, the name of the file is important.
The first thing we use is to extract the metadata from this file.
So we use the EXIF to.
I need to enter the new folder first and then use the to.
On the fire, the first thing you notice is that this was created.
With two high tech shop.
As shown in the producer properties, and then you will notice the creation that these two 017 April
21.
Next thing we do is run the scan on it, so called Yaara, it a dash to the option to suppress warnings
and provide a path to the Larousse.
Which is in the index here.
And finally, the name of the father press enter and Yaro do the scan and you will see that Yaara has
produced something which is not very helpful, is just showing us that the big numbers inside these
--, but did not detect any embedded files or embedded JavaScript YARE did not show anything
of importance, probably because citing this PDF file that will be embedded and zipped zipped inside
it or compress, then Yaara will not be able to scan it.
So in order to dig deeper, we were using a tool called PPTA.
So I'll open a new window.
And navigate to the location of how a malware.
So our NBPA here, kiddush ition interactive mode, so they will be able to do additional commands from
the command line PPTA if necessary.
And PDP pdf has shown us that there is one version of this PDF inside.
Therefore, it is version zero.
Sometimes there can be multiple versions and there is a section called Catalog and catalog is normally
indexed.
So I will cite the PDF.
There is also the takes three streams and they are three encoded objects, three, five, seven and
three.
And Prime Minister shows that there is an object with embedded JavaScript code, which is object number
five.
In addition to that, they are also suspicious elements or connection, which is subject.
You have some names collecting intel and this could be embedded names so that it false and also JavaScript
in danger and also some embedded file in object, 13 11 incantatory.
So you first examine the operation operation, remember, will cost the border to execute whatever is
stated in the operation.
So let's try to re type object, followed by the object number.
And you can see here the object.
There is an open action on JavaScript and JavaScript is an object file and that that is what we see.
In addition to that, there is also a reference to a name identifier, which is subject 11.
And if you see up here, 11 embedded files.
So before we look at your JavaScript, that is trace object eleven.
So we type object eleven and you see the object eleven has a further reference to object then.
So let's go for object 10 now and it's interesting.
And immediately we see that under the names identifier there is a macro document that C m is a Microsoft
document that has got macros in it.
That means it has got embedded script inside it.
So it might appear that this PDF document has got hidden Microsoft document, which has in turn got
macro it and that could be malicious if we see that this macro document is referring to Object four,
so you can trace object for now.
And there is further confirmation of the object for which is the M document.
And we also notice that he references object three.
So let's see one.
Object three.
And we see the object through some binary data.
That's why we see all these junk characters here so we can just press cue on a keyboard to get out of
this listing and type in again and go back to the main information screen we can see here.
The object is the embedded file, which contains to see em Microsoft document, which has a macro script
inside it.
Let us now examine the JavaScript Object five.
So just take five
and we find that this object five is a zip and go that far.
So the script contains this JavaScript function is finished probably to show some kind of dialogue and
to receive the response from the user.
And we also see in export data object and this is what object is a JavaScript function, as you can
refer from here.
I also provide additional resources for your reference data.
I support object.
If you scroll down, you can see your description here.
The explanation of this function JavaScript function is.
To accept in the name of the father that you want to exploit as far as a barometer, the end launch
parameter, so the energy parameter is to according to this description.
The Acrobat reader received a far to a temporary file location and then asked the operating system to
open it.
That means even after expanding or extracting this far, so other values are zero and one.
But in this case, in our case, the second parameter is two over here.
That means the JavaScript will.
Use this function to exploit this macro document and then launch it.
And he will launch launching from a temporary funding.
So this bit of analysis has shown us that when this PDA opens, you execute open action.
We should then execute JavaScript and JavaScript.
We then export these Macrovision object free and then launch it.
Earlier on, we saw that they are asking fair to detect this, and that is because of this.
So this indicates that this file is compressed file.
It is compressed and embedded inside, and that's why YARE was unable to detect this exploit.
So our next task is to extract this doxie file for analysis.
So let's try that.
Now I'm going to use the tool we have used before called PDF parser, and then I will give it the parameters
of object.
And you're going to specify the object, which is object three and also give it the option to apply
any filters.
And we know that it is futa.
It is compressed because of this flight got here and then we also give it to W so that you will not
go and do any mystery formatting is that he will show the real output.
And we also want to dump the extracted file into another.
Philco will be a three four object three and finally the name of the father and he enter.
OK, so you need to give the full name of the PDF, the command, which is to be behind because this
is Python script and now you have it.
And here you can see that it is the compressed file.
And we were right in giving a dash F parameter in order to apply the filters to anticipate the flattened
code parameter.
And now if you take LASU, we can see the object here.
So in order to find out what type of Phyliss we can use to file FILU, tell us what our Phyliss and
you, Davis and Microsoft Word file and he of two seven plus version, meaning that this Microsoft document
is a new version, which means that it is Harki file.
And so the next step will be to analyze this áng for the lesson they will be studying later.
So we have done we have concluded our objective of this exercise, which is to analyze in a straight
and you file, which we found.
Thank you for watching.
I'll see you in the next one.