Is eval () Evil : A study of JavaScript in PDF malware

Abstract

Client-side attacks have become very popular in recent years. Consequently, third party client software, such as Adobe’s Acrobat Reader, remains a popular vector for infections. In order to support their malicious activities, PDF malware authors often turn to JavaScript. Because of this malicious intent, JavaScript from malicious PDF is markedly different than JavaScript from non-malicious PDF. This paper presents a detailed analysis of the content of JavaScript from two sources: malicious and non-malicious PDF files gathered from multiple extractions on VirusTotal Intelligence, in order to provide an overview of the significant differences in the distribution of keywords between the two types of JavaScript. The analysis shows that the obfuscation techniques and the generation of exploit triggering code used by malware authors create artefacts, such as the presence of seldom used functions that are not observable in normal files. Additionally, JavaScript from malicious PDF files lack the keywords associated with common PDF automation tasks such as getting new content from the web, interacting with the document or interacting with the user. This provides empirical confirmation of extrapolations into the detection of malicious JavaScript in PDF files from previous research and provides insight for the creation of a classifier based on keyword distributions.