Online binary visualization for Pdf documents

Soon Heng Tan Mavric, C. Yeo
{"title":"Online binary visualization for Pdf documents","authors":"Soon Heng Tan Mavric, C. Yeo","doi":"10.1109/ISCE.2018.8408906","DOIUrl":null,"url":null,"abstract":"In this paper, we develop a visualization tool which will facilitate malware reverse engineering to understand characteristics of Portable Document Format (PDF) malware. This tool is useful as it is an online tool which renders it fully accessible regardless of user devices (eg. desktops, tablets, smartphones, etc.). Malware authors typically embed malicious codes into PDF documents which execute JavaScript exploiting a vulnerability within the Adobe Reader JavaScript parser. This then can allow shellcode to be placed into the memory of a computer to run arbitrary codes. By translating PDF binary information into higher level diagrams and images, potential visual signs which differentiate between malicious and legitimate PDF documents can be observed. The proposed online binary visualization tool maps bytes in a file to pixels of assorted colors that somewhat resemble a 2D pixelated heat map. By mapping different schemes of assorted colors, we can identify JavaScript and shellcodes in a PDF document which can then raise a red flag for the human analyst.","PeriodicalId":114660,"journal":{"name":"2018 International Symposium on Consumer Technologies (ISCT)","volume":"28 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2018-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"3","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"2018 International Symposium on Consumer Technologies (ISCT)","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/ISCE.2018.8408906","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
引用次数: 3

Abstract

In this paper, we develop a visualization tool which will facilitate malware reverse engineering to understand characteristics of Portable Document Format (PDF) malware. This tool is useful as it is an online tool which renders it fully accessible regardless of user devices (eg. desktops, tablets, smartphones, etc.). Malware authors typically embed malicious codes into PDF documents which execute JavaScript exploiting a vulnerability within the Adobe Reader JavaScript parser. This then can allow shellcode to be placed into the memory of a computer to run arbitrary codes. By translating PDF binary information into higher level diagrams and images, potential visual signs which differentiate between malicious and legitimate PDF documents can be observed. The proposed online binary visualization tool maps bytes in a file to pixels of assorted colors that somewhat resemble a 2D pixelated heat map. By mapping different schemes of assorted colors, we can identify JavaScript and shellcodes in a PDF document which can then raise a red flag for the human analyst.
查看原文
分享 分享
微信好友 朋友圈 QQ好友 复制链接
本刊更多论文
Pdf文档的在线二进制可视化
在本文中,我们开发了一个可视化工具,该工具将有助于恶意软件逆向工程了解便携式文档格式(PDF)恶意软件的特征。这个工具是有用的,因为它是一个在线工具,使它完全可以访问,无论用户设备(如。台式机、平板电脑、智能手机等)。恶意软件作者通常将恶意代码嵌入PDF文档中,这些文档利用adobereader JavaScript解析器中的漏洞执行JavaScript。这样就可以将shellcode放入计算机的内存中以运行任意代码。通过将PDF二进制信息转换为更高级的图表和图像,可以观察到区分恶意和合法PDF文档的潜在视觉标志。建议的在线二进制可视化工具将文件中的字节映射为各种颜色的像素,有点类似于2D像素化热图。通过映射各种颜色的不同方案,我们可以识别PDF文档中的JavaScript和shellcode,然后为人类分析师发出危险信号。
本文章由计算机程序翻译,如有差异,请以英文原文为准。
求助全文
约1分钟内获得全文 去求助
来源期刊
自引率
0.00%
发文量
0
期刊最新文献
Using MATLAB as auxiliary tool in visual localization for mobile robots Real-time image magnifier with visible-spectrum gaze tracker Low-cost real-time non-intrusive appliance identification and controlling through machine learning algorithm Adaptive edge detection algorithm for multi-focus application The bootstrap Kernel-diffeomorphism filter for satellite image restoration
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
已复制链接
已复制链接
快去分享给好友吧!
我知道了
×
扫码分享
扫码分享
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1