PDF Obfuscation : Using Hexadecimal in Defining Filter

Posted: November 29th, 2009 | Author: | Filed under: IT Related | Tags: , , , , , | No Comments »

I was reading my RSS feed and suddenly I’ve found this PDF sample. We’ve found PDF-JS Obfuscation with this.info.title last week and this time comes another trick. Using hexadecimal in defining filter..

The following line was found in one of the stream

</Length 0000000/Filter/#41#53#43#49#49#38#35#44#65#63#6f#64#65>>

once converted from hex to ascii, here is what i’ve found

</Length 0000000/Filter/ASCII85Decode>>

Yeah.. nothing much, but yes the sample will be passed to Azizan for enhancement of Analyz3r