Easy to Fool? Testing the Anti-evasion Capabilities of PDF Malware Scanners

Understand

Malware scanners try to protect users from opening malicious documents by statically or dynamically analyzing documents.

• However, malware developers may apply evasions that conceal the maliciousness of a document.
• Given the variety of existing evasions, systematically assessing the impact of evasions on malware scanners remains an open challenge.
• This paper presents a novel methodology for testing the capability of malware scanners to cope with evasions.