2

Is fb2 & epub files can be malicious like pdf? If yes, so how I can detect it manually ?

Malicious RTF, doc, docx, xls, ppt files can be detected via OLETOOLS. Malicious PDF files via peepdf, pdfid & others.

1

What is EPUB?

EPUB is an e-book file format with the extension .epub that can be downloaded and read on devices like smartphones, tablets, computers, or e-readers.

Can EPUB file contain malicious code?

Yes it can. (You can read this - https://www.baldurbjarnason.com/notes/epub-javascript-security/)

Here is another example of how epub had security flaw in past: XML External Entities

Are epub files often used by malware authors?

No. Compared to PDF and others formats epub is rarely used by attackers.

If you want to detect suspicious content (i.e. JavaScript) manually you can start with any hex editor and then you can write your own yara rules if it's needed. Of course if JavaScript is present that doesn't mean it has to be malicious but it can be a subject of further investigating.

Search in header of file for:

6D 69 6D 65 74 79 70 65 61 70 70 6C 69 63 61 74 69 6F 6E 2F 65 70 75 62

mimetypeapplication/epub

or:

74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74

text/javascript

More about epub/epub2 and epub3 go here - http://epubzone.org/news/epub-3-and-interactivity

  • This assumes that the only exploit possible using epub is done with Javascript. But this is not the case. Also, the shown signatures might also match non-malicious epub. I suggest to change the answer to include that this is only one possible attack and also that the given signatures might result in false positives. – Steffen Ullrich Dec 28 '17 at 5:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.