Automatic Hooking for Forensic Analysis of Document-based Code Injection Attacks Techniques and Empirical Analyses

摘要: Document-based code injection attacks, where-in malicious (coined shellcode) is embedded in a document, have quickly replaced network-service based exploits as the preferred method of attack. In this paper, we present new technique to aid forensic and diagnostic analysis documents detected using dynamic techniques — namely, automated API call hooking simulation. Our approach provides an trace shellcode few milliseconds. We also results large empirical PDFs collected wild over last years. To our surprise, found that 90% make no use machine-code level polymorphism, stark contrast prior studies on samples from attacks. observed heavy-tailed distribution sequences used by contemporary shellcode.