FCScan: A New Lightweight and Effective Approach for Detecting Malicious Content in Electronic Documents

Electronic documents, such as PDF and Microsoft Office documents, have become an ubiquitous attack vector in recent years, especially in complex attacks performed by Advanced Persistent Threats. Current security measures are not effective in protecting users and endpoints, either because they are based on static checks and analysis that attackers can bypass and circumvent, or because they require CPUintensive analysis that is usually off-loaded on external systems, which cannot replicate all of the actual parameters of the intended victim. We present a lightweight analysis system that can perform effective detection of malware in electronic documents in real-time and at the endpoint. To show the effectiveness of our approach, we have implemented and tested a prototype based on the ubiquitous Adobe Acrobat Reader.