Optimal Security : the Lumension Blog

I came across yet another copy of a malicious PDF file being hosted on the Internet. The PDF file highlights the arms race currently being fought by signature based anti-virus vendors and the bad guys. Simply put, by obfuscating the underlying malware, the bad guys can easily slip malicious PDF files through signature-based AV solutions undetected. When an AV vendor creates a signature to match a given version, the bad guys alter the obfuscation method, thus giving them the upper hand.
I took the time to submit this PDF file to www.virustotal.com and was not surprised to find that only 8 out of 40 AV products correctly detected the PDF file as malicious.

To get an understanding of what AV vendors are up against, below is a look at the obfuscated code for this particular PDF file – can you detect any malware?

Here is the PDF file malware with the obfuscation removed at wepawet.com.

Test results on the PFD file from www.VirusTotal.com.

The current malicious PDF files being hosted across the Internet are a not-so-subtle reminder that signature-based AV solutions are simply obsolete. The increased use of obfuscation by the bad guys today further drives home the point that we cannot possibly win the obfuscation arms race with the bad guys. The key solution here is patching the underlying vulnerability as the best line of defense. Lastly, the most effective additional layer of defense is to run an application control/whitelisting solution that will prevent any unwanted application from executing on the users PC, thus preventing malware infestation.