1O-checker:
Detection of Malicious Documents throughDeviation fromFile Format Specifications
Yuhei Otsubo

2Agenda1. Overview of o-checker
2. (DEMO)How to use o-checker📧Targeted email attacks

3

Attachment files in targeted email attacks in 2014

Over 60% of the attachment files are document files

24%

Executable files
etc
RTF

35%

62%

22%

DOC

MS Excel 95/97

3%

7%
7%
2%

MS PowerPoint 2007
PDF

according to “TrendLabs 2014 Targeted Attack Campaign Report”

4Performance of o-checker

Malicious documents(dropper)

Alerto-checker.pyinput• High speed and high detection rates against dropper
TPR 2009-2012:99.2%(360/363) FPR 0.3%(35/10,801)
2013-2014:98.4%(122/124)
Average execution time:0.3 sec• Almost maintenance-free
We have never changed the detection methods since Apl.2013.
Updating
frequency
Anti-virus softwareo-checker

Remarks

new type of malware per day
Every day 310,000(2015)※Almostnone

It needs update, if a new document
file format comes out.

※：http://usa.kaspersky.com/about-us/press-center/press-releases/new-daily-malware-count-kaspersky-lab-decreases-15000-20155

Trend of malicious documents

Targeteddropper
Attacker

Victim97.8 %

Opportunistic

downloader
98.8 %
Attacker

Victim6

Why dropper?

Victims consciously open malicious documents
Typical structure

Typical execution
process
Open the malicious
document file

Malicious document file
Exploit code
Shellcode

Exploit code

Decoy document file

Shellcode
Drop

Executable file
Executable file
Background

Decoy document file
ForegroundDetection mechanism (simplified)

Benign document file
DisplayedContent

StoredContent

Malicious document file
DisplayedContent

StoredContentMissing

All the contents fit intothe format

Not all the contents fit
into the format“o-checker” checks the anomaly
structure of a malicious document file

4. Detection mechanism

Overview of tar(09-12)

We examined various document files used intargeted attacks from 2009 to 2012.
Num.
File type

Ext.

RTF

rtf

dropper
98

downloader

1266.53649
170252.20180.40268.57351.2

Num.

163
363

Rate

97.8 %

2.2 %doc
CFBxlsjtd/jtdc
PDFTotal

Avg. size(KB)pdf

8291.8・tar(09-12) were used in targeted email attacks from 2009 to 2012
・Most of all the files are droppers※ “jtd/jtdc” file type is used in Japanese Word Processor named“一太郎”(Ichitaro).

9Rate of each anomaly structure

We classified 8 anomaly structures.
We can classify 99.2%(360/363) of the droppersof tar(09-12) according to these features.

99.0%

99.0%

99.4%

97 / 98

100 / 101

162 / 163

RTF

CFBPDFAS1 99.0%

AS2 78.2%
AS3 91.1%
AS4 98.0%
AS5 97.0%

AS6 49.7%
AS7 43.6%
AS8 62.6%10

AS7:Unreferenced object
Executable file：Object containing
an executable file

43.6%

Trailer：Object：Link

Executable file

A PDF file containing an executable file

When an executable file is inserted as an object in disregard of
document structure, it is often unreferenced.
11

AS7:Unreferenced object
Executable file

：Object containing
an executable file

43.6%

Trailer：Object：Link

Document catalog

Document
information

Executable file

A PDF file containing an executable file

When an executable file is inserted as an object in disregard ofdocument structure, it is often unreferenced.
12

AS7:Unreferenced object
Executable file：Object containing
an executable file

43.6%

Trailer：Object：Link

Document catalog

Page tree

Document
information

Outline hierarchy

Executable file

A PDF file containing an executable file

When an executable file is inserted as an object in disregard of
document structure, it is often unreferenced.
13

AS7:Unreferenced object
Executable file

：Object containing
an executable file

43.6%

Trailer：Object：Link

Document
information

Document catalog

Page tree

Page

Outlinehierarchy

Page

Executable file

A PDF file containing an executable file

When an executable file is inserted as an object in disregard of
document structure, it is often unreferenced.
14

AS7:Unreferenced object
Executable file

：Object containing
an executable file

43.6%

Trailer：Object：Link

Page tree

Page

Content stream

Document
information

Document catalog

Annotations

Outlinehierarchy

Page

Content stream

Executable file

Thumbnail image

A PDF file containing an executable file

When an executable file is inserted as an object in disregard ofdocument structure, it is often unreferenced.
15

AS7:Unreferenced object
Executable file

：Object containing
an executable file

43.6%

Trailer：Object：Link

Page tree

PageContent stream

Document
information

Document catalog

Annotations

Outlinehierarchy

Page

Content stream

Executable file

Thumbnail image

A PDF file containing an executable file

When an executable file is inserted as an object in disregard of
document structure, it is often unreferenced.
16

How to run “o-checker”• Requirement• Python 2.7.3 or later• Any OSes that can run Python• PyCrypto for 2.7(for an encrypted PDF file)• [command example]> python o-checker.py malware.doc17

DEMO18

Structure of PDF：Encryption：Object

Trailer：LinkDocumentinformation

Document catalog

Page tree

Page

Content stream

Annotations

Encryption
dictionary

Outlinehierarchy

Page

Content stream

Thumbnail image

Structure of a PDF document enctypted
Encryption applies to almost all strings and streams in the PDF file.
Leaving the other object types unencrypted allows random access to theobjects within a document. (except for the object stored in ObjStm)

19

Conclusion
Malicious documents(dropper)o-checker.py

Alert

input

• High speed and high detection rates• Almost maintenance-free• MIT License
Available fromBlack Hat USA 2016 web site20

Thank you!

21