Analysing malicious PDF documents and shellcode
It’s time for another video-post, and this time we’re going to look at a malicious PDF document attempting to exploit a known vulnerability in the Collab.collectEmailInfo() function. We’re going to show how you can extract the shellcode and perform some static code analysis using tools like HT and IDA Pro.
Click on image to show video (opens in new window)
For references, here are the tools used in the video:
Hope you’ll find it useful! :)
December 21st, 2008 at 15:35
[...] shellcode is just the same as the one analyzed here. it only changes the url from where to get the malicious [...]
January 28th, 2010 at 05:02
[...] Norwegian Honeynet Project » Blog Archive » Analysing malicious PDF documents and shellcode. Leave a [...]