PDF Spam Conquered by SpamButcher

We first started running into PDF spam a few weeks ago.

PDF spam is a spam message that is generally empty except for a PDF attachment. Inside the PDF is the actual spam message.

So far the only major PDF mail spam campaign launched we've encountered is one promoting a certain stock. The hope is that people will purchase the stock - driving the price up. Once the stock hits a certain level, the spammer sells and makes his cash.

The presumed advantage to hiding the spam content within a PDF file is that existing junk mail filters won't know how to deal with it.

For that, we'll have to give whoever thought up this tactic some credit. SpamButcher didn't know how to handle these kinds of messages when they first came out, and let most of them pass through. It only caught the messages with other tell-tale signs such as originating from problematic areas of the internet.

But now we've brought the situation back under control. After a few hours research we managed to locate certain "signature" properties common to all the PDF spam we sampled. It's highly unlikely that all these attributes would appear in a normal email messages together.

While this problem has been tackled - it does suggest a possible path for future spam messages. There are certainly other common document formats which almost anyone can view. Perhaps the next round of spam will have their "payloads" embedded within Microsoft Word documents or Powerpoint presentations.

Back