Automatic signature generation for malicious PDF files

摘要

In some embodiments, automatic signature generation for malicious PDF files includes: parsing a PDF file to extract script stream data embedded in the PDF file; determining whether the extracted script stream data within the PDF file is malicious; and automatically generating a signature for the PDF file.

主权项

1. A system, comprising:
a processor configured to:
receive a Portable Document Format (PDF) file that is known to include malicious content;parse the PDF file to identify a cross-reference table included in the PDF file; andgenerate a signature associated with the PDF file from the identified cross-reference table; and a memory coupled to the processor and configured to provide the processor with instructions.