Welcome back to another video. In the previous videos, we looked at a few command-line tools for analyzing 1
PDF files. 2
We looked at PDFid and how it can give us some better information about the pdf file. 3
And we also looked at PDF parser as to how we used them to analyze and extract different malicious 4
components of the pdf file 5
In this video I want to quickly introduce you to another powerful tool and it has a GUI interface as 6
well. 7
Again it's a part of your flare pdf repository so you don't really have to download it from anywhere 8
else. 9
And in case you don't have flare set up you can obviously download that tool. 10
It's called PDF stream dumper 11
You can search it on google and you can find the official link from there and you can download it. 12
So let`s launch PDf strean dumper. 13
It has a very simple UI and it has a bunch of options. 14
It has a Javascript UI selection. 15
It has un-escape selection. 16
So this basically translates everything that is in an un-escape format. 17
It helps you put your manual escapes as well. 18
It looks for goto-object streams. 19
It helps you search helps you find/replace. 20
So these are some of the features of PDF stream dumper. 21
Let us go ahead and open a PDF file and see how it looks in PDF stream dumper and up till we launch our file 22
example1.pdf 23
So it basically lists all the objects in hierarchal order. 24
So again we start with the bottom part. 25
If you remember our introductory video about PDF file formats where we talked about PDF tools basically 26
parsing the PDF files from downwards where did it first locate the cross-reference table and from 27
there they started looking into the different objects. 28
So if you look here that's the xref object and then there are a bunch of other objects as well. 29
And it says that the total kind of objects is 27. 30
So it means that the body will have somewhere around twenty six objects inside it. 31
OK so let us come back to the first object on top here to start just looking randomly into each of these 32
objects and see what content they have. 33
So this object basically contains a bunch of text. 34
I think PDF stream dumper also translates the stream data the raw stream data into actual meaningful 35
texts which is not possible when you are using PDF parser. As we keep moving down 36
you'll see bunch of information. 37
Here is another stream of data are present inside it. 38
I'm mainly interested in the Javascript element which we captured while using PDF parser 39
as well. 40
OK so here is embedded JS. 41
And he pointed to object number 24 and on object number 24 has the javascript. 42
It's the same one that we saw in the previous video. 43
So one good thing which we can do with PDF stream dumper is that we can basically select the un escape 44
part and we can just click on un-escape selection and will immediately give you the actual readable 45
ASCII format of what was there in the unescape code 46
So this was not possible when we were doing PDF stream dumper but we'll have to look into different ways. 47
For example we have to manually create a javascript file just escape a document or tried and parse this 48
entire thing and then it would translate. 49
But here in PDF stream dumper you could just do it automatically. 50
All you have to do is just select the characters which are there inside the un-escape and just click 51
on an un-escape selection and it will translate everything for you. 52
So the another important feature that I wanted to show you is the javascript UI feature. 53
So once you reach to the object where javascript is present just click on the javascript UI and launch 54
a separate panel and you can see the javascript here. 55
So in order to have it running all you have to do is just get rid of the extra characters here and prepare 56
a simple javascript out of it and you can actually decode the entire thing yourself. 57
In this example the decoding element is pretty straightforward so I don't think it will be very difficult 58
to decode even by using the un-escaped selection but at times the javascript's can be really complicated 59
and that's where this javascript emulator can be really handy in PDF stream dumper. 60
So we've got rid of extra characters there to see what else is extra here so we don't need this. 61
remove the extra brackets as well 62
let us add document. 63
.write. 64
And close the brackets now let`s click on run and that's it. 65
Here you see the result a document.write. 66
And that's the data that it actually prints. 67
So, people who are not familiar with javascript, document.write is nothing but a print statement 68
which gets you an output of whatever you has passed inside it. 69
So this is how you'll deobfuscate the javascript using PDF stream dumper. 70
Thanks for watching.