Static PDF Analysis

---

• PDFs are also commonly used as malware vectors

Tools

pdf-parser.py

pdf-parser.py is designed to parse and analyze the structure of PDF files and enables inspection and extraction of contents and objects.

• part of DidierStevensSuite
• usage: python3 pdf-parser.py <file-name>
  • parses the file and extracts any objects found
  • can find URIs or other indicators
  • -s allows searching
    • e.g., -s "/URI"
• Can copy IOCs in VirusTotal
• Extract embedded file:
  • --object <number>
  • --filter to decode the data string
  • -raw to display output in raw format
  • --dump <file-name> to dump to a file
  • can then use another tool such as oledump.py to analyze the document

pdfid.py

• lightweight tool that can scan PDF and provide high-level overview of structure
• use to identify suspicious elements or objects
  • e.g., javascript or embedded files
• usage: python3 pdfid.py <file-name>
  • outputs components and objects of file
• what to look for when analyzing:
  • JavaScript or JS objects
  • OpenActions
    • can cause PDF reader to take an action when opening the file
  • Launch
    • can be used to launch external software
  • EmbeddedFiles
• then use pdf-parser.py to extract any embedded files or scripts