⬇ Download holy card: ·
Blessed MalDoc in PDF, the Two-Faced Document
Patron of ambiguous attachments, files that are two things at once, and antivirus tools that trust the extension.
Life
On 28 August 2023 JPCERT/CC described a simple, mischievous technique: hiding a macro-enabled Word document inside a file that carries a PDF signature. The file opens normally as a PDF, but dragged into Word it runs its macros; tools that classify it as a PDF look no further. A document with two souls, depending on who opens it.
Prayer
O Blessed MalDoc in PDF, who are a PDF to the antivirus and Word to the victim, let our tools look at the content and not only the header. Amen.
How to celebrate
Celebrated by analysing files for what they contain, not what they are called, and disabling Office macros.
One file, two faces, a single trick.