Fighting malware and spam

Pretty Darn Fancy

TA!Fancy!PDF

  27 June 2007

Description

Using a PDF file in place of an image (and especially compressed PDFs) to avoid tokenizedation.

Submitted by Joe Chongq.

Example

An example where a PDF sent in a pump-and-dump spam is made to look official (click to enlarge):

Another example, that looks more like 'classical' image spam:

Note that the letters are actually made up of many different colours:

See also blog entries 'Pretty Darn Fancy: Stock spammers using PDF files' and 'Pretty Darn Fancy: Even More Fancy Spam'.