Security Analyst And Documentation - PDF Analysis with PSDStreamDumper and CyberChef.pdf
Jason T. — IT Support and Systems Monitoring
Project: Security Analyst And Documentation - PDF Analysis with PDFStreamDumper and CyberChef
This project involved analyzing a PDF file that had Malicious Code embedded within it that would have delivered a malicious payloads to maintain persistence.
I used PDFStreamDumper to view the Objects and to identify Objects of Interest which has revealed Obsufucated code that uses Powershell to deliver these malicious payloads
This required me to work out of my comfort zone and research more on Base64 and how to acquire the Raw Base64 string from a Scrambled Base64 string.
In my sandbox I used PowerShell to acquire the Raw Base64 string and used CyberChef to decode and reveal what has hidden.
Documentation of my steps to find the hidden code and the contacted domains and Ip address the Malware would have communicated with are included in this
I hope you enjoy what I have to show you, and if you have any suggestions on how I can improve documentation or investigation please feel free to share!
https://drive.google.com/file/d/1_YM8PY80DG9couBrYl52eU4OA-Ht-RL3/view?usp=sharing
#SecurityAnalyst #MalwareAnalysis #Base64 #obsufucation #persistence
2 reactions · 0 comments
Topics: #obsufucation, #malwareanalysis, #persistence, #base64, #securityanalyst