Fighting malware and spam

Pretty Darn Fancy

TA!Fancy!PDF

  27 June 2007

Description

Using a PDF file in place of an image (and especially compressed PDFs) to avoid tokenizedation.

Submitted by Joe Chongq.

Example

An example where a PDF sent in a pump-and-dump spam is made to look official (click to enlarge):

Another example, that looks more like 'classical' image spam:

Note that the letters are actually made up of many different colours:

See also blog entries 'Pretty Darn Fancy: Stock spammers using PDF files' and 'Pretty Darn Fancy: Even More Fancy Spam'.

Poll

Virus Bulletin

• Co-operation is the only way
• XXX racted
• Your filters are bypassed: Rustock.C in the kernel
• Family matters
• The Ottawa rules
• DriveSentry Desktop 3.1/3.2 & GoAnywhere 1.0.2/2.0
• The problem of backscatter – part 3