The De-Obfuscation Method in the Static Detection of Malicious PDF Documents
Yuntao Wang · 2021 7th Annual International Conference on Network and Information Systems for Computers (ICNISC) · 2021
Due to its characteristics of rich functionalities, highly integration and platform independent, the Portable Document Format (PDF) format has become the defector standard for the electronic exchange, these characteristics, however, also have given rise to the use of PDF files as a prime vector for malware propagation. As vulnerabilities in the major PDF viewers keep surfacing, effective detection of malicious PDF documents remains an important issue. In this paper, we propose a static method for the detection of JavaScript-bearing malicious documents. Compared to the traditional static detection method, we add the de-obfuscation process in the static analysis, which effectively improved the detection rate. Our evaluation shows that our method has a good performance in the detection of malicious PDF documents, even when they have been extensively obfuscated.