So let's go to PDF parser. 1
We will again run as >python pdf-parser.py then give the location of the pdf file 2
example1.pdf. Press 'Enter' and it throws bunch of result to us. 3
So the first result of PDF parser is nothing but the complete raw output of the PDF file. 4
You can see that it begins with PDF magic bytes which tells us that it's a PDA file of version 1.4. 5
Then we have objects inside it. 6
You can just keep scrolling down you can see there is one object that contains Stream 7
as you move down. 8
So there is another object. 9
This might seem like suspicious but you have to look at what's what's exactly there inside this particular 10
dictionary. 11
So it seems like it's a font setting element where this PDF has some specific font setting element 12
these are basically 13
the hex representation of the value of that font. 14
So it's not really something critical in terms of maliciousness of the file. You can further come down. 15
So these objects that contain stream these can be of interest. 16
But as you see these objects have been referenced so we have to look who actually is trying to reference 17
to these or whether they are actually being referenced or they are just some placeholders. 18
So if you move down you object 24 tells us that it's basically having a javascript and the javascript 19
is executing a URL with unescape. if you further move down object 25. 20
That's more about the title of PDF and that say we have the end of file 21
OK. 22
In order to quickly search for anything inside the PDF, the option that pdf parser gives us is '-s' 23
with this parameter, you can search for any string inside the inside the PDF. 24
Let's say I want to look for 'javascript' 25
So it gets me all the locations where javascript has been located. 26
For example object number 24 contains javascript and it has the actual script as well. 27
and there is another subject object 26, which contains a dictionary that is calling the 28
javascript and referencing to object number 23. 29
So let us see what exactly is there in object number 26. 30
I think that is going to be the same data that we see here but let's run '-o' which is for object 31
and pass it object number which is 26. 32
So if we press enter it gives us the content of object number 26. 33
So again the object number 26 says that it's trying to call a javascript that is 34
at object number 23 35
So let's go to object 23 and see what's there. 36
So object 23 is interesting here. 37
It's not really doing anything. 38
It is just referencing to object number 24. 39
And you guys know what is there an object on 24. 40
It's our javascript that we just now saw. 41
So this is basically a kind of way by which malware authors try to create a sort of loop so that the 42
PDF tools are not able to quickly recognize where the javascript is located. 43
So if you see there was object 26 was referencing to object number 23 44
in an object number 23 referenced to object number 24. 45
And it was object 24 that actually contained the javascript inside it. 46
So we have the javascript here. 47
Now it's a simple unescape script. 48
All you have to do is just append a document.write to it and you can see what exactly this javascript 49
translates into. Let us quickly analyze another example. 50
So again it's a pretty long output and we already have a result from PDFid. 51
that example2.pdf also contains javascript 52
So let us search for that 53
OK. 54
So it's saying that there is a script that is referencing to an action. 55
So lets search for action here. 56
What exactly it does. 57
OK so if we look at the referencing action, this javascript is trying to launch command.exe. From there 58
It's going to home drive. it's looking weather template.pdf exists on desktop or not. 59
or not. 60
If that file exists it's actually executing it. 61
So this is what this javascript is trying to do it's basically a launch action as soon as you launch 62
that PDF, 63
This is the particular portion of the script that will get executed. 64
So that is how we follow the trails and try to understand what the javascript is trying to do.