Malware Hunting: Discovering Evasive Techniques in PDF Documents

In this technical workshop at the DEF CON 30 Blue Team Village, security researcher Filipi Pires provides an in-depth breakdown of malicious PDF analysis, examining the evasion techniques employed by threat actors to deliver document-based exploits. He begins at 08:00 by discussing cyber resilience strategies, emphasizing that defensive teams must understand attacker delivery tradecraft to protect enterprise endpoints from weaponized email attachments.

Filipi deconstructs the internal architecture of the PDF specification at 16:00, explaining how objects, dictionaries, streams, and cross-reference (XREF) tables function together. At 24:00, he demonstrates inspecting raw file headers and strings to identify anomalous embedded scripts, followed by using diagnostic tools like PDFiD and pdf-parser at 32:00 to detect suspicious OpenAction triggers and embedded JavaScript.

At 40:00, Filipi analyzes advanced obfuscation methods, showing how attackers nest objects and apply multiple encoding layers (such as FlateDecode and hex encoding) to evade static antivirus scanners. He concludes at 48:00 by demonstrating how to extract and decode raw shellcode payloads from PDF streams, providing guidance on authoring robust YARA detection signatures for SOC and malware analysis teams. (AI summary — Gemini Flash)