Welcome everyone to another video expert malware analysis and reverse engineering course. In this video we are 1
going to analyze malicious PDF files. 2
So before we dive into analyzing a malicious PDF file, like like we did for office files, 3
We will first understand the PDF file structure. 4
This will help us in building a stronger base in understanding how exactly the PDF file format looks 5
like. 6
How exactly is structured and how to understand its different component. 7
PDF stands for Portable Document Format and it is a file format to basically represent documents. 8
It's a very simple file format. 9
It basically can be called as a text format where everything is stored in the form of dictionaries and 10
in dictionaries contains information about the file and it contains streams which hold the data about 11
the PDF. 12
For example if you have image or if you have text all those things will go inside the streams of PDF 13
It encapsulates various elements of documents as objects. 14
Just like we mentioned right now, it will have different objects and all those objects will contain properties 15
of different elements inside the PDF, as well as the stream of data that is present in the PDF. 16
It Supports rich and interactive elements, for example it supports images, it supports graphs, you can draw shapes 17
inside it. It has scripting capability as well. 18
So PDF file formats are very much capable of supporting scripting languages like action script and 19
Javascript. 20
You can create dynamic elements and dynamic actions like filling up all forms; loading information 21
dynamically and things like that. 22
In a PDF file, there are four major sections: header, Body, cross-reference and trailer. 23
So let us try to understand what exactly these sections mean. 24
So on the right hand side you can see that there is a structure off of PDF file. In order to view the 25
structure of any PDF file, 26
You can just simply drag and drop the file in a text editor and you can view the structure 27
something similar to the one that I have here on the right hand side. 28
So the first section of the PDF file is its header. So the header is nothing but the magic number which denotes 29
that this is a PDF file and it contains the version of the PDF file. 30
You see here at the top, it says that it's a PDF file version 1.7. So falling downwards you'd see a 31
bunch of objects inside the PDF file. 32
These objects basically constitute the different elements of the PDF file. 33
So '1' basically denotes its name, '0' is its version number and 'obj' denotes the object. 34
Beginning and ending of these signs 35
Basically represents a dictionary. 36
And within those dictionaries you could contain the different elements of the PDF file. 37
Then we have 'endobj' which basically denotes the end of object and then there will be another object and 38
so on. 39
So this was the first part which is harder. 40
The second part is the body. 41
The third parties cross-reference and fourth parties creen. 42
So the Body basically constitutes of all these objects that are there inside the PDF. 43
Let us talk about the cross-reference table here which is our third important element of the PDF file 44
and probably the most complicated one. Cross-reference table is nothing but a table that allows the 45
PDF parser to quickly access every object inside the body. 46
So it begins with 'xref' which denote the cross-reference, then '0' denotes the start of object 47
and '4' denotes the number of objects that are there inside the body. 48
So if you see here we have one two and three objects. 49
So the question is why do we have four here. 50
The answer is this root object over here. 51
So every time the body will contain one less than the total count of the objects because PDF also includes 52
this root object as one. 53
So the total count of number of objects inside the PDF becomes 4. Now the cross-reference stable 54
has a standard format. 55
So this denotes the offset from where the first object is starting this denotes the offset from there. 56
The second object is starting. Then third, fourth. 57
65535 is basically a five digit generation number. 58
It's something that the PDF tool generates for you and here 'f' and 'n' have two different meanings. 59
For example whether that object is a free object or whether that object is in use. 60
The last part is the trailer part, the important part of the PDF file. So trailer contains the 61
overall information about the PDF. 62
So if you look here it begins with the keywords 'startxref'. Then it contains an integer. 63
So this integer basically denotes the beginning of the cross-reference table. 64
So basically points to this location over here. 65
So if it stays 249 it means it's here. 66
So there are four characters it means zero is at location 253. 67
So that's how the table is denoted. 68
And then finally we have End Of File(eof), which tells that the PDF file has ended. 69
So what exactly happens here. Once you load of PDF file do a PDF editor or into a PDF reader software 70
like Adobe Reader The PDF tool starts reading the file from the bottom. It first goes to start xref 71
It figures out the starting byte of data cross-reference table. 72
It comes here. From there it knows that there are four objects inside it. It picks up the location of the first 73
object which is pointed here. 74
Then it comes to the root object where it says that it wants to go to object number one 75
the entire flow then jumps all the way to the top to object number one. 76
Then it reads the content of the object number one and it goes on two to three and so on. 77
So this is how the parsing of a PDF file happens inside a PDF parsing tool