Acrobatics
EasyDigital Forensics
Overview
This PDF file was sent through a phishing email, and the machine was hacked. Extract the shellcode from it and obtain its MD5 hash. It was opened with Adobe Acrobat Reader DC 2020.013.20074.
flag format:
flag{shellcode_md5_hash}
Lab Details
Prerequisites & Requirements
- Solid Python Proficiency: An intermediate understanding of Python programming, including scripting, data manipulation, and file operations.
- PDF Structure Fundamentals: Intermediate knowledge of PDF file format, its components, and how objects are embedded.
- Basic Cryptographic Concepts: Familiarity with XOR operations and their application in simple encryption schemes.
What will you learn?
- Deconstruct Adobe Exploits: Gain a practical understanding of how specific Adobe Acrobat Reader exploits function, particularly those involving shellcode execution.
- Reverse Custom Encryption: Develop skills in identifying and decrypting bespoke encryption and obfuscation techniques used in malicious payloads.
- Extract and Analyze Shellcode: Learn methodologies for extracting embedded shellcode from complex file formats and preparing it for further analysis.
Tools
- Python: For scripting custom decryption routines and automating various analysis tasks.
Job Positions
Malware Analyst
Tags
Malware AnalysisShellcodeObfuscationCryptorUnpackingStatic Analysis