Updated some info for SET (Social Engineer Toolkit) PDF’s x AntiVirus & Scoring System

Virus Total Public API will make my live much easier . Look previous post about it http://spookerlabs.blogspot.com/2010/08/virus-total-public-api.html .

Some results really surprised me . Take a look and do your all conclusions .

Best AntiVirus to detect SET Malicious PDF (higher is better):

      7  "Sophos"
      7  "Microsoft"
      7  "GData"
      7  "F-Secure"
      7  "F-Prot"
      7  "ClamAV"
      7  "BitDefender"
      7  "Avast5"
      7  "Avast"
      6  "Sunbelt"
      6 "nProtect"
      6  "McAfee-GW-Edition"
      6  "eTrust-Vet"
      5  "Symantec"
      5  "PCTools"
      4  "eSafe"
      3  "NOD32"
      3  "Kaspersky"
      3  "Ikarus"
      3  "Emsisoft"
      3  "Antiy-AVL"
      2  "McAfee"
      1  "VBA32"
      1  "Panda"
      1  "AVG"
      1  "Authentium"
      1  "AntiVir"
      1  "AhnLab-V3"


Missed PDF detection for SET malicious PDF's (higher is worst) :

      7  "VirusBuster"
      7  "ViRobot"
      7  "TrendMicro-HouseCall"
      7  "TrendMicro"
      7  "TheHacker"
      7  "SUPERAntiSpyware"
      7  "Rising"
      7  "Prevx"
      7  "Norman"
      7  "Jiangmin"
      7  "Fortinet"
      7  "DrWeb"
      7  "Comodo"
      7  "CAT-QuickHeal"
      6  "VBA32"
      6  "Panda"
      6  "AVG"
      6  "Authentium"
      6  "AntiVir"
      6  "AhnLab-V3"
      5  "McAfee"
      4  "NOD32"
      4  "Kaspersky"
      4  "Ikarus"
      4  "Emsisoft"
      4  "Antiy-AVL"
      3  "eSafe"
      2  "Symantec"
      2  "PCTools"
      1  "Sunbelt"
      1 "nProtect"
      1  "McAfee-GW-Edition"
      1  "eTrust-Vet"

As we can see lot of AntiVirus missed all PDF from SET what is a big problem for companies . Some AntiVirus have some methods that VirusTotal doesn't emulate and possible those methods could detect them .

I'll do a big analysis against all my pdf's and share the results .

Happy Hacking!

Rodrigo "Sp0oKeR" Montoro

Virus Total Public API

Today I started to play with Virus Total Public API http://www.virustotal.com/advanced.html

My initial idea was to send files using command line and get the results quickly so I don't need a web browser and spend time uploading the file .

I read their inital samples/docs and build a mix of codes using python (most retrieve from their samples) and perl (only language I can try somehting) . By now what I have :

$ perl vt-auto.pl /LABS/pdf-basics/samples/AdamSamples/15

Sending file /LABS/pdf-basics/samples/AdamSamples/15 to Virus Total ...
Response from VT with resource "86ee2f99a207d31ea2b69198dc2bf5e7c7946eeae7dacdd6032f2c050525bc07-1282091669"

Waiting 120 seconds to wait file /LABS/pdf-basics/samples/AdamSamples/15 be scanned ...

Sending request fo Virus Total about /LABS/pdf-basics/samples/AdamSamples/15 with resource "86ee2f99a207d31ea2b69198dc2bf5e7c7946eeae7dacdd6032f2c050525bc07-1282091669"

Report Results for /LABS/pdf-basics/samples/AdamSamples/15 :
"nProtect": "Trojan-Exploit/W32.Pidief.16718.AV"
 "CAT-QuickHeal": ""
 "McAfee": "Exploit-PDF.b.gen"
 "TheHacker": ""
 "VirusBuster": "JS.Crypt.BSP"
 "NOD32": "PDF/Exploit.Pidief.AUT"
 "F-Prot": "JS/Psyme.HU"
 "Symantec": "Trojan.Pidief.D"
 "Norman": "JS/Shellcode.GS"
 "TrendMicro-HouseCall": "TROJ_PIDIEF.ADY"
 "Avast": "JS:Pdfka-PO"
 "eSafe": "PDF.Exploit.2"
 "ClamAV": "Suspect.PDF.ObfuscatedJS-5"
 "Kaspersky": "Exploit.Win32.Pidief.aut"
 "BitDefender": "Exploit.PDF-JS.Gen"
 "ViRobot": ""
 "Sophos": "Mal/PdfEx-C"
 "Comodo": "TrojWare.Win32.Exploit.Pidief.aut"
 "F-Secure": "Exploit.PDF-JS.Gen"
 "DrWeb": "Exploit.PDF.166"
 "AntiVir": "EXP/Pidief.JX"
 "TrendMicro": "TROJ_PIDIEF.ADY"
 "Emsisoft": "Exploit.Pidief!IK"
 "eTrust-Vet": "PDF/Pidief.IQ"
 "Authentium": "PDF/Obfusc.D!Camelot"
 "Jiangmin": ""
 "Antiy-AVL": "Exploit/Win32.Pidief"
 "Microsoft": "Exploit:Win32/Pdfjsc.AS"
 "SUPERAntiSpyware": ""
 "Prevx": ""
 "GData": "Exploit.PDF-JS.Gen"
 "AhnLab-V3": "PDF/Shellcode"
 "VBA32": ""
 "Sunbelt": "Exploit.PDF-JS.Gen (v)"
 "PCTools": "Trojan.Pidief"
 "Rising": ""
 "Ikarus": "Exploit.Pidief"
 "Fortinet": ""
 "AVG": "Exploit"
 "Panda": ""
 "Avast5": "JS:Pdfka-PO"

Detection : (31/41)

I'll improve and fix the code so I can share because now it's impossible . That 120 seconds that I wait is just to make sure that the scan will finish before I try to retrive the results but sometimes depending on file size it'll probably fail .

Nice resource from VirusTotal Team , congratulations!

Happy Hacking!

Rodrigo "Sp0oKeR" Montoro