# US 2013/0160127 A1 · System and method for detecting malicious code of pdf document type

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2013/0160127 A1
- Document ID: US20130160127A1
- Status: Published application
- Kind: A1
- Application number: 13/657,303
- Filed: 2012-10-22
- Published: 2013-06-20
- Earliest claimed: 2011-12-14
- Assignees: Korea Internet & Security Agency
- Inventors: Hyun Cheol Jeong; Seung Goo Ji; Tai Jin Lee; Jong Il Jeong; Hong Koo Kang; Byung Ik Kim
- Web page: https://patentgrep.com/patent/US20130160127A1

## CPC

- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Disclosed herein is a PDF document type malicious code detection system for efficiently detecting a malicious code embedded in a document type and a method thereof. The present invention may perform a dynamic and static analysis on JavaScript within a PDF document, and execute the PDF document to perform a PDF dynamic analysis, thereby achieving an effect of efficiently extracting a malicious code embedded in the PDF document.

## Claims

### Claim 1

A PDF document type malicious code detection system, comprising:
an object extraction module configured to find and extract a plurality of object information contained within a collected PDF document;
a script merge module configured to merge each first JavaScript information from the plurality of extracted object information to generate second JavaScript information;
an obfuscation release module configured to decrypt/decode the obfuscated/encoded second JavaScript information to generate third JavaScript information when the generated second JavaScript information is obfuscated/encoded;
a script static module configured to parse the generated third JavaScript information to extract function/pattern information suspected as a malicious code;
a script dynamic module to execute fourth JavaScript information containing the function and pattern information to generate behavior information according to a malicious behavior; and
a malicious code extraction module configured to extract malicious code information from the behavior information when it is confirmed that a malicious code has been generated.

### Claim 2 (depends on 1)

The PDF document type malicious code detection system of claim 1, further comprising:
a PDF dynamic module,
wherein the PDF dynamic module executes the stored PDF document to perform a behavior analysis when there is no first JavaScript information within the plurality of extracted object information.

### Claim 3 (depends on 2)

The PDF document type malicious code detection system of claim 2, wherein the malicious code extraction module extracts malicious code information confirmed through the behavior analysis.

### Claim 4 (depends on 3)

The PDF document type malicious code detection system of claim 3, wherein the object extraction module extracts a plurality of object information containing at least one of each text information, first JavaScript information and table information.

### Claim 5

The PDF document type malicious code detection system of claim wherein the script static module extracts function/pattern information containing at least one of a URL, a PE file (execution file), a JS.HTM file, a code command such as Run or Shell, and a code command such as Copy or Create.

### Claim 6

A PDF document type malicious code detection method, the method comprising:
(a) parsing a plurality of object information contained within a collected PDF document;
(b) determining whether there is first JavaScript information within the plurality of object information as a result of the analysis;
(c) merging the first JavaScript information when it is determined that there is the first JavaScript information as a result of the determination;
(d) determining whether second JavaScript information generated by the merging is obfuscated/encoded;
(e) decrypting/decoding the second JavaScript information when it is obfuscated/encoded as a result of the determination;
(f) parsing the decrypted/decoded and generated third JavaScript information to perform a script static analysis;
(g) performing a script dynamic analysis on fourth JavaScript generated to contain function/pattern information suspected as a malicious code by the script static analysis; and
(h) extracting malicious code information from behavior information acquired by the script dynamic analysis.

### Claim 7 (depends on 6)

The method of claim 6, further comprising:
(i) executing the collected PDF document to perform a dynamic behavior analysis when it is determined that there is no first JavaScript information as a result of the determination in the step (b).

### Claim 8 (depends on 7)

The method of claim 7, wherein the step (h) further comprises:)
(h-1) extracting malicious code information from behavior information acquired through the dynamic behavior analysis in the step D.

### Claim 9 (depends on 6)

The method of claim 6, wherein the step (f) parses the second JavaScript information to perform a script static analysis when it is not obfuscated/encoded as a result of the determination in the step (d),

### Claim 10 (depends on 9)

The method of claim 9, wherein the script static analysis by the second JavaScript information is performed, and then the steps (g) and (h) are performed for the result.