Understanding the Role of Malicious PDFs in the Malware Ecosystem.

机译：了解恶意PDF在恶意软件生态系统中的作用。

获取原文

获取原文并翻译 | 示例

页面导航

摘要
著录项
相似文献
相关主题

摘要

The Portable Document Format (PDF) is a widely used, cross-platform file format for document exchange. Several applications exist for parsing and rendering PDF documents, with Adobe's Acrobat Reader being the most widely used PDF reader. Starting in 2007, several vulnerabilities in Adobe Reader were discovered being exploited in the wild. PDF-based exploits continued to proliferate during 2008 and 2009, and, although recent security reports have noted a decline in the numbers of PDF-based malware in 2011, malicious PDFs are likely to continue to be a significant threat for the next few years, given the ubiquity of the PDF format and the existence of a large base of unpatched Adobe Reader installations.;In this work, we try to understand the role played by malicious PDFs in the malware and spam ecosystems. We collect data from the execution of a set of about 11,000 malicious PDFs obtained from various sources. We find a correlation between the age of a vulnerability and the number of PDFs exploiting that vulnerability. We also find differences in behavior depending on the distribution vector used. Looking at the final payload of the malicious PDFs, we find that some known pay-per-install services seem to use malicious PDFs as an infection vector. Finally, we see a considerable overlap in malware-hosting domains contacted by malicious PDFs and spam-advertised domains seen in emails collected by various spam feeds, pointing to the use of both vectors for malware distribution.

机译：便携式文档格式（PDF）是一种广泛使用的跨平台文件格式，用于文档交换。存在几种用于解析和呈现PDF文档的应用程序，其中Adobe的Acrobat Reader是使用最广泛的PDF阅读器。从2007年开始，人们发现Adobe Reader中的多个漏洞被广泛利用。基于PDF的漏洞在2008年和2009年继续激增，尽管最近的安全报告指出，2011年基于PDF的恶意软件数量有所下降，但恶意PDF可能在未来几年仍将继续成为重大威胁，鉴于PDF格式无处不在，并且存在大量未打补丁的Adobe Reader安装。在此工作中，我们试图了解恶意PDF在恶意软件和垃圾邮件生态系统中的作用。我们通过执行从各种来源获得的大约11,000个恶意PDF集合来收集数据。我们发现漏洞的年龄与利用该漏洞的PDF数量之间存在关联。我们还发现行为的差异取决于所使用的分布向量。通过查看恶意PDF的最终有效负载，我们发现某些已知的按安装付费服务似乎将恶意PDF用作感染媒介。最后，我们看到恶意PDF所接触的恶意软件托管域和垃圾邮件源收集的电子邮件中出现的垃圾邮件广告发布域之间存在相当大的重叠，这表明两种媒介都可用于恶意软件分发。

著录项

作者
Gupta, Moitrayee.;
展开▼
作者单位

University of California, San Diego.;

展开▼
授予单位 University of California, San Diego.;
学科 Computer science.;Information technology.
学位 M.S.
年度 2011
页码 49 p.
总页数 49
原文格式 PDF
正文语种 eng
中图分类
关键词

相似文献

外文文献
中文文献
专利

1. On Existence of Common Malicious System Call Codes in Android Malware Families [J] . Surendran Roopak, Thomas Tony, Emmanuel Sabu IEEE Transactions on Reliability . 2021,第1期

机译：在Android恶意软件系列中存在常见的恶意系统呼叫代码
2. DeepMal: maliciousness-Preserving adversarial instruction learning against static malware detection [J] . Yang Chun, Xu Jinghui, Liang Shuangshuang, Cybersecurity . 2021,第a期

机译：DeepMal：恶意保存对抗静态恶意软件检测的对抗性指导
3. Leveraging malicious behavior traces from volatile memory using machine learning methods for trusted unknown malware detection in Linux cloud environments [J] . Panker Tomer, Nissim Nir Knowledge-Based Systems . 2021,第Auga17期

机译：利用Linux云环境中的机器学习方法利用Volatile Memory的恶意行为迹线
4. PDF/UA - A New Era for Document Accessibility: Understanding, Managing and Implementing the ISO Standard PDF/UA (Universal Accessibility): Introduction to the Special Thematic Session [C] . Olaf Druemmer, Markus Erle International conference on computers helping people with special needs . 2012

机译：PDF / UA-文档可访问性的新时代：理解，管理和实施ISO标准PDF / UA（通用可访问性）：专题会议简介
5. A Quantitative Correlational Study of Malicious Software (Malware) Identification and Security Practitioners’ Training [D] . Puryear, Lonnie Lee. 2019

机译：恶意软件（恶意软件）识别和安全从业者培训的定量相关研究
6. Role of hydrogen peroxide in loss of culturability mediated by visible light in Escherichia coli in a freshwater ecosystem. [O] . I Arana, A Muela, J Iriberri, 1992

机译：过氧化氢在淡水生态系统中由可见光介导的大肠杆菌中可培养性丧失的作用。
7. Phantom Malware: Conceal Malicious Actions From Malware Detection Techniques by Imitating User Activity [O] . Tim Niklas Witte 2020

机译：Phantom Malware：通过模仿用户活动来隐藏恶意软件检测技术的恶意操作
8. Separation of Benign and Malicious Network Events for Accurate Malware Family Classification. [R] . Mohaisen, A., Zhang, Z., Mekky, H. 2015

机译：用于准确恶意软件家庭分类的良性和恶意网络事件的分离。

Understanding the Role of Malicious PDFs in the Malware Ecosystem.

摘要

著录项

相似文献

相关主题

期刊订阅