Author Topic: Extract javascript from pdf file  (Read 32935 times)

0 Members and 1 Guest are viewing this topic.

July 14, 2009, 01:15:04 pm
Reply #15

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
The JS is in plain text in the PDF, so just needs a little cleanup, no de-obfuscating. It also doesn't actually install anything. Just seems to be a PoC for a stack overflow (checking on this confirms it).
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

July 15, 2009, 09:25:12 am
Reply #16

sgres

  • Newbie

  • Offline
  • *

  • 2
Hi,

Thanks for the reply. :)
 
The problem is that the javascript is encoded in brackets '['! and I don't know how to convert them to plain text.

Another question that I have is that how can I decode UCS2 to binary or hex? and how can I encode my shellcode in UCS2?

Thanks

sgres

July 15, 2009, 04:57:05 pm
Reply #17

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Another question that I have is that how can I decode UCS2 to binary or hex?

Malzilla
Ruining the bad guy's day

July 15, 2009, 05:54:03 pm
Reply #18

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
and how can I encode my shellcode in UCS2?

We aren't here to help malware authors .... we're here to stop them.
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net