New Malware Alert: MalDoc in PDFs

Discovering a Stealthy Threat
Japan’s Computer Emergency Response Team (JPCERT) has unveiled a disturbing cybersecurity discovery. They’ve identified a novel malware technique known as “MalDoc in PDF.”

The Art of Deception
This malware is a master of disguise. It cleverly hides malicious Word files within seemingly harmless PDF documents. What makes it even more dangerous is its polyglot nature, allowing it to execute as different file types, posing as both a PDF and an Office application.

Outsmarting the Defenders
Malicious actors often employ polyglots to outwit security systems and befuddle analysis tools. In a recent sample studied by JPCERT, the malware contained a VBS macro. When this file is opened as a .doc, it stealthily downloads and installs an MSI malware file. The specific type of malware remains undisclosed.

Security Not Compromised
The good news is that this attack vector doesn’t override security settings that disable the automatic execution of macros in Microsoft Office. These settings still provide robust protection. However, users need to take an extra step by manually deactivating these settings, either by clicking the relevant button or unblocking the file.

A Unique Malware Approach
While the concept of embedding one file type within another is not new among attackers, the MalDoc in PDF technique brings something distinctive to the table. Its primary advantage is its ability to bypass detection by PDF tools like “pdfid,” which typically scrutinize only the outer layer of a file—the legitimate PDF format.

Staying One Step Ahead
JPCERT emphasizes that even though this malware is crafty, analysis tools like “OLEVBA” can still identify the hidden threat within the polyglot. This highlights the importance of employing multi-layered security measures and robust detection methods.

A Rule of Detection
To aid in identifying files utilizing the MalDoc in PDF approach, JPCERT has shared an example of a Yara rule. This rule checks if a file starts with a PDF signature and contains patterns resembling Word documents, Excel workbooks, or MHT files.

Stay vigilant and secure your digital environment against this evolving threat.

