Malicious PDF analysis

Part 5

Shellcode analysis

Now its time to analyze the shellcode to know its capabilities, the below screeshot shows the extracted shellcode



Uploaded with ImageShack.us

the shellcode was converted to exe for further analysis, the below screenshot shows the conversion, the converted exe is called converted_shellcode.exe



Uploaded with ImageShack.us

looks at the strings and opening the convered exe in a debugger/hexeditor, you can say that the shellcode is used as a downloader, in the below screenshots you can also see referecnes to a malicious website (grinchalina8.com), the google search on that website shows that this site is malicious and also you can see references to api calls which is used by downloader and also reference to an exe (pdfupd.exe).
In this case the “LoadLibraryA” api call is used to load urlmon.dll, then uses the api call “UrlDownloadToFileA” to download the exe file “pdfupd.exe” and then it uses “WinExec” api call to execute the downloaded executable.



Uploaded with ImageShack.us



Uploaded with ImageShack.us



Uploaded with ImageShack.us

With this i complete my analysis, i hope this will help beginners like me understand the analysis of malicious pdf document. :-)

Malicious PDF analysis Tutorial Part 1
Malicious PDF analysis Tutorial Part 2
Malicious PDF analysis Tutorial Part 3 Extracting Javascript
Malicious PDF analysis Tutorial Part 4
Part 5 Malicious PDF analysis Tutorial Shellcode analysis