[Antelox]

Hi, here my 2 posts of a PDF Infected, maybe there will be also a third

1: Analysis of a malformed and exploited PDF -> http://antelox.wordpress.com/2010/07/11 ... oited-pdf/

2: Just some Acrobat exploits -> http://antelox.wordpress.com/2010/07/11 ... -exploits/

Comments and criticisms are welcomed :D

Bye. =)

[Alex]

Thanks for sharing. I'm waiting for another of this kind posts.

[Brookit]

Good analysis! Recently I have a lot to do with PDF format, so can you provide the malformed PDF file?

I hope Daniel will release his PDF Insider for free, since zynamics sells their PDF Dissector for 250 €, at least. And visually I don't see a great difference between the features of both. ;)

[EP_X0FF]

Indeed interesting stuff.

Also would be great to have a samples attached here :D

p.s.
Use reputation buttons if you like this analysis :)

[Antelox]

First of all sorry for the delay with which I have responded to the thread then I'm sorry to tell you that I no longer have the sample with me, but you can always do a search through md5 hash :(

Thx very much for the positive feedback!

@Brookit: I do not know exactly when and how Daniel release his fantastic new tool, visit and contact ntcore.com for more info =). I can only tell you that, although it is still in development, PDF Insider is UBER :D

Bye. =)

[__Genius__]

Hi,
I think you guys looking for this sample :

Code: Select all

hxxp://ceterv.net/nn1/files/soreheadprattler.pdf

regards.

[Antelox]

Yep __Genius__ but the domain is down =) so I didn't posted here the link!

Bye. =)

[cjbi]

Here is sample.