Quickpost: Analysis of PDF/ActiveMime Polyglot Maldocs

jpcert reported a new type of maldoc: “MalDoc in PDF – Detection bypass by embedding a malicious Word file into a PDF file –“.

These maldocs are PDF files that embed a Word document (ActiveMime) in MIME format.

ActiveMime documents can be analyzed by combining my emldump.py tool and oledump.py.

ActiveMime documents were heavily obfuscated in the past, and this is also the case here. As emldump.py version 0.0.11 was only able to handle the obfuscation …

analysis bypass detection document documents file files maldoc maldoc in pdf maldocs malicious malware analysis mime oledump pdf polyglot quickpost tool word word document