When I mention mapreduce I typically get a blank stare in return and even more so when I talk about it with malware. I think raw data tends to speak much louder than theories or whitepapers, so attached are several JSON output files from multiple ...
Read more →Back when I was looking at averages of information collected across random/malicious documents, I noted that filesize seemed to be a helper in narrowing down whether or not a file could be suspicious (see malicious filter). Ever since I began coll...
Read more →A couple months back I remember reading a post from Symantec about visualizing entropy to identify infected Microsoft documents. At the time it didn't really dawn upon me to visualize the PDF samples I had, but I did take a brief look into how ent...
Read more →In my last post I mentioned that I wanted to put together an API for my malpdfobj tool, so sharing could be easier. The good news is that I have the RESTful API functioning complete with interactive API documentation, python interfaces and the abi...
Read more →I wanted to wait on releasing this until I made some more queries, but that may take a few days, so here it is now. The night I got all my malicious files into my MongoDB instance I started to query. One of the first things I wanted to tackle was ...
Read more →Since releasing the malpdfobj tool (~24 hours), I have been running and testing it. I found a couple bugs that caused issues when inserting some samples into the database, but those are all now fixed (and documented on github). The current code de...
Read more →