O-Checker: Detection of Malicious Documents Through Deviation From File Format Specifications
summary
o-checker inspects files for concrete deviations from format specs (RTF, CFB, PDF) and flags embedded executables that are stored but not displayed, classifying eight anomalous structures such as unreachable PDF objects and unexpected streams. It runs in Python without executing malware, can decode streams and attempt PDF decryption with an empty password, and exports object contents for analysis. Evaluated on Japanese targeted-email samples from 2009–2014, it reports 96.1% detection on 2013–2014 malicious documents.
AI-written summary · about
chapters (9)
- 0:00Welcome and conference notes
- 0:53Introduction to OA Checker
- 2:18Malware detection principles
- 4:50Detection methodology
- 7:32Analyzing PDF structure
- 9:00Using OA Checker
- 10:07Demonstration and analysis
- 12:58Advanced PDF decryption
- 16:46Conclusion and summary
related talks
27mPlatPal: Detecting Malicious Documents with Platform Diversity
01h 03mEffects Malware hunting in Cloud environment
25mCommSec D1 - A Deep Dive Into Malicious Documents
48mDiscovering C&C in Malicious PDF with Obfuscation, Encoding and Other Techniques
28mCOFI break
47mJavaScript Obfuscation: It’s All About the P a c k e r s
20mDetecting Malicious Files with YARA Rules as They Traverse the Network
28mBeyond AV: Detection-Oriented File Analysis