Against PDF Exploit /ASCIIHexDecode /FlateDecode

PDF exploit file that crafted with malicious code that obfuscated with /ASCII85Decode and /FlateDecode are common nowadays to escape detection from normal analysis. However, recent encryption using /ASCIIHexDecode method are gaining popular.

The /ASCIIHexDecode

Related output message decrypted using "pdf-parsey.py" that contributed from Didier Steven, will be paste to Mazilla's decoder. The codes similar like figure below.

The eval() result will be end like figure below

The shellcode will downloading three malware file with different name after decoded using UCS2 decoder.

Links to download malicious files:

trombocit.com/fr2/bksv3.exe

trombocit.com/fr2/ahkmpswy3.exe

trombocit.com/fr2/cmrv3.exe

trombocit.com = 211.95.78.119

Domains sharing same IP address:

abbcp.cn

bobunium.com

byblegum.biz

hubbabybba.biz

netvisao.biz

poppka.net

ppp3ppp.biz

soft-nintend.biz

trombocit.com